ConfigServer Community Forum

We're not seeing any issue on a basic server installation of Fedora v30:

# cat /etc/fedora-release
Fedora release 30 (Thirty)
# perl csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing ipt_recent...OK
Testing xt_connlimit...OK
Testing...

I am looking for a field to add a command like cphulk

Is there any existing functionallity? Or can be added?

I need to post remote ip/country/reason/time etc to able to track and build my own blocklist

Hello

The delete CloudFlare command is returning the failure
both at the interface and also at the command line.

CloudFlare Delete xxx.104.28.197 for user(s) SRV12:

Message:
csf - CloudFlare: id failed: 400 Bad Request (SRV12)

- Command line
# csf --cloudflare del xxx.104.28.197 SRV12
csf - CloudFlare: id failed: 400 Bad Request (SRV12)

Regards.

Jean

Hello,

I set CF_ENABLE to 1 and put my api and email to the csf.cloudflare file but csf will not sync csf.deny ips to cloudflare firewall

How to maintain and deploy configurations for CSF firewall for several Ubuntu Linux servers?

Currently I maintain configurations for each server separately on my PC. If and when I make a change or improvement I manually ripple it across all the configurations and upload to my servers. This is error prone and tedious. (A configuration is a set of files such as csf.conf, csf.allow, csf.ignore,...

Hello all,

I tried adding port rules for a specific IP that is present in a BLOCKLIST to access the server. It was added to csf.allow

tcp|in|d=80|s=xx.xx.xx.xx
tcp|in|d=443|s=xx.xx.xx.xx
tcp|out|s=80|d=xx.xx.xx.xx
tcp|out|s=443|d=xx.xx.xx.xx

After reloading the csf, when I ran a csf grep, it shows as below

# csf -g xx.xx.xx.xx

Table Chain num pkts bytes target prot opt in out source...

Hello,

Currently, I have configured the csf service so that if a person makes more than 10 attempts to connect to the pop service with a bad password it is temporarily blocked.
But after 5 temporary blocking it is permanently blocked, I would modify this value in order to increase it.
could you tell me how to do that?

Best regards

hi,

i don't know why CSF block my IP (and many others) without any reasons..

i just logged in , then i tried t upload file using File manager .. my ip blocked.
visitors just vist my website from google , CSF blocked them..

maybe i did some fault config.

please help

Hello,

As we know that the IP address deny file in csf.deny is limited to 1000 ip's
lately i had a massive attacks with over a thousands ip address, my question is.... can i set ip address deny limit in csf.deny over than 1000 ip's...?

Thank you

Hi,

csf.conf is using maxmind geolite2 country, but this is not available anymore from 2 Jan 2019.

Any fix?
(using it for CC_ALLOW/CC_DENY)

Thank you.

Hiya all,

I just noticed this happening since today and I don't know what's going on. See the log below:

Apr 25 17:28:46 arabier lfd : (WordPress) Failed wordpress login from 88.68.42.8 (DE/Germany/dslb-088-068-042-008.088.068.pools.vodafone-ip.de): 5 in the last 3600 secs - *Blocked in csf* for 86400 secs
Apr 25 18:35:35 arabier lfd : Incoming IP 88.68.42.8 temporary block removed
Apr 25...

Hi All,

I'm getting hourly Log Scanner Reports --

lfd on xxx.xxx.xxx: Log Scanner Report for 15:00, (lines:144)

I would like to turn these off if possible, does anyone know if this can be done?

Thanks!

Hello,
i have a vps (kmv) and i would block all incoming connections outside Italy.

this server is
Centos 7 + cpanel

so i disable cphulk and install CSF.
then install
yum -y install ipset

my CSF conf is:
...
CC_ALLOW_FILTER = IT
...
LF_IPSET = On
...
FASTSTART = Off
...

restart CSF , i tried reboot server also but i can connect from another my server located in France.

if i disable LF_IPSET...

We are using a reservations system on a new web site. The payment processing in that system uses a hosted payment form at Authorize.net, and when the payment is successfully completed Authorize.net submits a POST back to the reservation system to confirm the payment and retrieves a Thank You page from our web site and displays it to the customer. When the CSF/LFD firewall on the server is...

Hello CSF blocking my own customers IP's address. Please help me to change some settings... I don't want CSF to block my customers IP's like when my customers use his wordpress and try to create a new post CSF blocked his access.

This is happening to me on 2 non-cpanel servers that we're running. Basically the title of the email reads something like: lfd on localhost.localdomain

How do we get localhost.localdomain to be the actual hostname of the server?

We have our hostname attached to each IP in /etc/hosts. On 1 server, the sending email is showing: root@ourdomain.com, but for some reason the other one is still:...

Since the last update to csf we've been getting multiple notifications every time a user accesses phpMyAdmin.

lfd on xxxx.xxxxx.com: Suspicious File Alert
File: /tmp/pma_template_compiles_USERNAME/twig/9f/9f2b0868c0ee3bdb8fbcdba6e363515596d67849ea34a2ad71b70607edbb2a33.php
Reason: Script, file extension
Owner: USERNAME:USERNAME (510:507)
Action: No action taken

I would normally just...

Default vanilla CentOS 7 minimal installation.

After a new CSF installation, executing csf -r you get:

*WARNING* Binary location for in /etc/csf/csf.conf is either incorrect, is not installed or is not executable
*WARNING* Missing or incorrect binary locations will break csf and lfd functionality

I have setup MyJoomla to help manage my Joomla websites. Part of their service is setting up uptime monitors via UptimeRobot.com.

I whiltelisted the IP addresses for both services:

178.62.5.35 # Manually allowed MyJoomla: (England) - Tue Mar 20 14:50:59 2019 DO NOT DELETE
178.62.31.185 # Manually allowed MyJoomla: (England) - Tue Mar 20 14:50:59 2019 DO NOT DELETE
178.62.47.108 # Manually...

Hello,

Lately I'm seeing a lot of incoming SMTP traffic, which is rejected by EXIM.

Example:
2019-04-02 18:29:24 Connection from :59957 refused: too many connections
2019-04-02 18:29:24 SMTP connection from net-2-45-190-15.cust.vodafonedsl.it :28532 lost D=5s
2019-04-02 18:29:24 SMTP connection from :41794 (TCP/IP connection count = 20)
2019-04-02 18:29:24 Connection from :7242 refused: too...