ConfigServer Community Forum

Recently I had to add the IP of a customer's technician that had to make a vulnerability to my CSF whitelist
so he can complete the vulnerability test to one of my servers, because CSF was blocking it just when he
started a port scanning (which is good).

However he sent a report stating that a lot of ports are open, putting me to shame, and now I am wondering if I did something wrong.

If that...

Because much of my server's traffic is coming through CloudFlare, and I've whitelisted CloudFlare's IP addresses, have I rendered CSF and LFD less effective at blocking repeat attacks from the same IP?

Is there a way around this other than by taking CloudFlare out of the equation?

TY

I have received a few emails over the past few weeks similar to the following content. Can someone tell me if this is a serious issue and what I can do to fix it.

find: `/proc/5049': No such file or directory
find: `/proc/5799': No such file or directory
find: `/proc/5801': No such file or directory

/usr/lib/php/.registry /usr/lib/php/.registry/.channel.doc.php.net...

Hello.
I can not access to CSF from my cpanel.
The cpanel support said:
Attempting to even pull up the csf rule list times out:

cPs# csf -l
iptables filter table
=====================
^C
cPs#

This indicates that the issue is with the software itself, and not with any portion of cPanel. Researching this in their forums it looks like you may be able to resolve this by forcing an update of the...

Hi,

We have problem with LF_PERMBLOCK_ALERT notification.
Rule was set to 0 so we don't want to notification when someone is perm blocked and we set LF_PERMBLOCK_ALERT to 0 but we still receive mails.
Can you help me to resolve this issue.

Best regards.

Hi Team,

We are getting daily alert from the servers that the csf is failed. When we check, the error would be like

Error: Error processing command for line (6 times): , at line 329 in /usr/sbin/csf

Its a centos6 + cpanel server. There are no other applications holding the IPtables. This is very frequent and we have to remove the csf.error and restart csf.

We upgraded CSF to the latest...

I've been using CSF for many years and always had good luck using LFD and CC_Deny/Allow, etc. NOW, I migrated my Cpanel server to new hardware, and I can't seem to get the CC_Allow Filter ( I added US,CA only for now) to limit the countries it's allowing access to. I'm getting login attempts from all over the globe.
Secondly, for instance I had 223 SSH login fails since last night and I don't see...

Hi all,

Long time user of CSF and first time posting...

CSF on my WHM server attempted an auto upgrade overnight and failed with the following entry near the end of the emailed log:

Error: Invalid TCP_IN port , at line 3026 Job for lfd.service failed because the control process exited with error code. See systemctl status lfd.service and journalctl -xe for details.

Now I can't start the...

Hi,

I can't get the CSF Messenger to work properly on my Plesk server for SSL websites.
When I navigate to a server IP address, not using SSL, I see the Messenger page telling me I'm blocked.
But when visiting any website on the server, all of which use SSL, the IP is not blocked.
Any idea?

Thanks!

hello guys,

when i enable Perform SMTP packet inspection osm daemon wont start

Feb 13 00:56:18 server3 osmd : daemon stopped
Feb 13 00:56:33 server3 osmd : daemon started
Feb 13 00:56:33 server3 osmd : Main Process: Can't locate Net/Pcap.pm in @INC (you may need to install the Net::Pcap module) (@INC contains: /etc/osm/Modules /usr/local/cpanel...

I've decided to start a new thread because I haven't seen any current working solution, or activity on older threads regarding this issue.

I have spent countless hours over the last 3 months trying to solve this issue with email that is getting blocked which comes from Gmail:

DNS Error: 91335 DNS type 'mx' lookup of localinternetads.com responded with code SERVFAIL

I've read through 3 dozen...

I have csf firewall up and working on a centos 7. I have a web control panel that i only want access from a certain ip address. I am not certain about how to do this.

So I know the port is open on the csf.conf. I know I am supposed to add the port and ip address in the csf.allow.

But I am not sure how to do this. Do i remove the port from the csf.conf file ? Then add only the port and ip...

I contacted the support CPANEL , following the return mail :

I apologize for the confusion, but we cannot update CSF for you, despite the offer made by the previous analyst. CSF is not our product, so we do not provide support for it, including updating it or changing its configuration. You will need to update CSF yourself. You can update CSF in the plug-in in the WebHost Manager, or in the...

I want to ask about the exception of domain access or send an email where I previously made a block for regional China via CSF, but there is one of our customers who objected because of many relations (consumers from that country).

Is there a way of excepting for one of the domains to keep escaping but I still block the region of China.

In essence, I want only one domain to be able to escape or...

Hi All,

I'm using CSF and LFD on one of my WHM servers and have been getting about 6 of these alerts every hour:

Time: Wed Nov 14 06:05:24 2018 -0400
File: /tmp/.xcloner-cc30b
Reason: Suspicious directory
Owner: : (538:538)
Action: No action taken

All 6 are always the same content with the exception of the 5 characters after .xcloner-

Anyone have any suggestions on how to stop these? The...

Hello,

I need to ask for advice about a wierd constellation:

on a directadmin-server with csf i experience that albeit csf.conf states:

TCP_IN = 20,21,25,30,53,80,110,123,143,443,465,587,953,993,995,1935,3000:3039,3478,3479,5001,5060:5099,5222,5269,5275,5349,7443,7070,7777,10000:20000,49160:49300

i find port 3306(TCP) accessible from outside unless mysqld is bound to 127.0.0.1-interface...

I would love to be able to use an allow list to retrieve the CloudFlare IP addresses regularly at these URLs, then apply my own advanced allowed rules to these IP addresses.

Similar to the feature of the Block Lists text file, where one can configure a URL to retrieve IP addresses from to be downloaded regularly and blocked in the firewall, is there currently a feature for an allow list? If...

Hi,

Looking for some help from people if anyone has any idea.

Shortly before and during an inbound syn DDOS attack on https on my server yesterday I notice some weird alerts from CSF Firewall reporting weird outbound traffic.

The IP address is included in the logs as this is null routed and no longer in use.

I interpret the logs as my server was trying to make outbound connections to...