ConfigServer Community Forum

Hello,

For some reason on one of our servers the following test of a PCI scan fails:

TCP Source Port Pass Firewall

PCI Severity Level: The vulnerability is not included in the NVD.

VULNERABILITY DETAILS
CVSS Base Score: 5
CVSS Temporal Score: 3.6
Severity: 3
QID:34000
Category: Firewall
Last Update: 2017-07-10 17:52:41.0

THREAT:
Your firewall policy seems to let TCP packets with a...

Hello,

I have MESSENGER v1 working on the server with Directadmin but doesn't work with SSL. So, I configured v3. The website to offer the unblock it is show, the captcha too, but when I click to unblock, the IP isn't removed on the deny list, so the IP isn't blocked. What it could be?

Thank you.

Hello!

We are using csf on many of our servers, however, on one of our servers the Messenger service doesn't seem to work.
The server has cPanel and LiteSpeed. It also has BitNinja installed, but the problem happens even if we have the BitNinja service disabled.

Here is what we tried:

Switching to Messenger v1, v2 & v3
Uninstalled and reinstalled csf
Copied the csf configuration file from...

I apologize, but could you still explain how it turns out that in your database - /var/lib/csf/Geo/dbip-country-lite.csv it is written like this: 130.0.232.0,130.0.239.255,UA And in the logs it came: This is what the csf shows... Table Chain num pkts bytes target prot opt ​​in out source destination filter ALLOWIN 3 590 86236 ACCEPT tcp -- !lo * 130.0.234.147 0.0.0.0/0 tcp dpt:2829 IPSET:...

Latest Debian 12

I use TMUX a lot, but lately it doesn't keep the sessions when you restart the server or if you are inactive for a long time.
I suspect it may have something to do with CSF.
Very annoying when you have configured many things.
Have to start from scratch every time.

Very grateful for help.

Hi there everybody thank you for this community and software Csf, like the title say:

Can I execute all features options of web user interface via CLI ?

Hi all,

I would like to ask if there is a feature in csf/lfd where if a user keeps running multiple queries from same IP to be banned and if I can adjust that?

I've got a website of a non profit organization with a large db and getting attacks from multiple IPs from a specific country.
I blocked the country but is a matter of time to use another country to keep going etc so this is not a...

A week ago I received an email saying:

Time: Wed May 15 19:08:50 2024 -0400
File: /tmp/alfacgiapi/getheader.alfa
Reason: Script, starts with #!
Owner: fromhigher:fromhigher (1013:1014)
Action: No action taken

I went in and found that the site was hacked, deleted everything, restored and patched from a clean backup. Also emptied the trash on that account. However, I keep getting this same email...

When my csf.allow file is empty, I can't send (SMTP) or read (POP) emails on my server, it ends up with a timeout. Adding my IP in csf.allow, everything is ok.
I would like to be able to access my emails from anywhere, how should I do ? I have looked for a parameter in csf.conf for that, but have not found so far :confused: . Any help appreciated.

Long time user.

3 servers. all running CSF

1 server IP is not blocked but emails not working on all email clients.
ALLOW that IP and the email starts working.

What is the fix/issue?

the only difference was this server was set up as with SSH on a different port than default.

Is anyone else having this issue?

Thanks.
Mike

Hi There,
Can i use Ubuntu & cPanel and CSF ? Or i will face problems ..?

Thank you

I'm having difficulty with getting SMTP auth failures detected by LFD. I believe this is partially due to Postfix on Ubuntu not reporting the rhost in the /var/log/auth.log file. Here's an example:

May 14 14:05:27 myserver saslauthd : pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=someone@somewhere.com

The other way this can be obtained, is via...

Hello.
When I activate cfs and Fail2Ban, Fail2Ban does not send me detailed information like the one I attached in the email. When I disable cfs it sends.
VPS Server virtualmin for ubuntu 22.04

With CFS enabled

With CFS disabled

What setting should I do in cfs???
Please a help

This started happening and I am not sure what I am missing at the moment. csf.deny is now cleared and I have created an /etc/csf/csf.cloudfront.allow with their full range of IPs and included reference to it in the csf.allow and restarted but I am still seeing timeouts. As soon as I turn off csf, it loads right up. I have also made sure flooding options are disabled but still encountering this...

Hello , I'm getting this message in my email from the cron daemon: Oops: Unable to download: Can't connect to download2.configserver.com:443 (Connection timed out) . now 433 is open and I don't see the cron job in the cron job area of cPanel. I've whitelisted the config server IPs too in CSF. is there a cron job script i can add to the cron job lists in cPanel? Thank you for the help! :)

I have a member on the server that uses google ads. Google is reporting http 500 error for the url's, even though they work fine. They are saying their IP(s) are being blocked. I downloaded a list of all of their IP's and CIDR's (about 300) and added them to the whitelist by editing the allow list. But the problem is still there. I found that if an IP is in the deny list and I add it to the allow...

Hi,
yesterday I updated cpanel and centos on a couple of servers and, after that update, CSF CC_IGNORE is not working.
I had CC_IGNORE for my country working for a long time until yesterday and, after that update, all servers have this issue now.

Does anyone has the same problem?

I tried to restart but no luck.

Best regards

Hello,

I'm reporting a persistent issue I've been experiencing with ZeroTier connectivity when the CSF is active on my Linux system. Despite my attempts to configure the firewall to allow ZeroTier traffic, ZeroTier does not function as long as CSF is active.

Here's what I've done so far:

I have allowed all UDP traffic in both UDP_IN and UDP_OUT sections of my CSF configuration.
I have opened...

Hi Guys
I've been trying for a month to stop LFD warnings from legitimate PHP scripts that are run from cron, but none of the suggestions I've found are working.

I've tried ...

In /etc/csf/csf.signore
/path/to/script.php

In /etc/csf/csf.pignore
cmd:php /path/to/script.php
exe:/path/to/script.php
exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi /path/to/script.php
exe:/bin/bash -c /usr/bin/php...

Dear Sir,

I have installed CSF firewall on Centos Stream 9 on my VPS server successfully without errors.

However, after I set some IP ranges in this file:

$ vi /etc/csf/csf.allow

like:

###############################################################################
# Copyright 2006-2018, Way to the Web Limited
# URL:
# Email: sales@waytotheweb.com...