ConfigServer Community Forum

i have csf setup and its working very good (blocking everything i configured) but its not blocking 404 after 60 404s

my 404 logs look like this

GET /site/cfg000b HTTP/1.1 404 12095 - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

do i need to have any custom settings or why is this not working?

Hello,

I use scanmyserver.com to do an audit of my server. I was looking through the ModSec logs and saw an IP address that was there more than five times, performing a scan. I was curious as to why csf hadn't blocked them. So I went into the GUI and searched for the IP and then realized the IP belonged to scanmyserver, however, the IP address is also listed in the GreenSnow blocklist.

How does...

Hello,

If I wanted to whitelist my server's IPv6 local loopback address, do I need to whitelist:

::1/128
fe80::/10

Or would
::1/128

be enough? Essentially, is it a good idea to whitelist the link-local address (fe80)? Also, should it be fe80::/10 or fe80::/64? I'm still struggling a little with the IPv6 stuff.

Thanks!!!

So it didn't take me long to realize that IP's are not actually being banned when using Cloudflare because iptables isn't looking for X-Forwarded-For in the header (is this even possible?) So the attack comes from Cloudflare IP, which of course is whitelisted, so the server is completely unprotected.

So after reading the documentation, I found BLOCK_REPORT which I can use to fire off an API call...

Anyone knows how can I fix this?

When I restart I also get this message:

open3: exec of /usr/sbin/ipset flush failed: No such file or directory at /usr/sbin/csf line 4947.

Hi friends..

I want setup allow for some country. In my case I want allow 80 port for France. I setup this and all is work perfect.
But problem is next.

I have two servers, First is in DC1 and second is in DC2. This servers have same system OS Ubuntu 14.04.

on DC1 all work perfect but on DC2 this don't want work.

On DC2 work only allow over IP or over DynDNS but allow country don't want...

First question:

How are the rules applied? Is the csf.deny applied first and then csf.allow - or is csf.allow applied first?

Here is my issue.

In the csf.allow file, I have IP ranges allowed for port 80 and port 443 - idea is to prevent them from being blocked:

tcp|in|d=80|s=1.1.1.0/24
tcp|in|d=443|s=1.1.1.0/24

However, computers within that range seem to have mis-configured mail clients....

Hello
I have a mail user witch IP is continuously TCP_IN blocked for portscan.
When I look at the log it uses an MAC-destination:MAC-source:Mac-type combination that is always the same but with different IP all over the world.
But my mailuser says he has a fixed IP !
Does anyone know what is happening ?
Thanks for your help.
Marc

Hi, i'm getting tens of thousands emails per month from cxs and the subject for most of them is in the form of :
cxs on server.server.com (Hits:1)(Viruses:0)(Fingerprints:0)
Is there a way to get this reports only when a virus is detected ?

The command that is shown in the email body is :
(/usr/sbin/cxs --allusers --nobayes --clamdsock /var/clamd --defapache nobody --doptions Mv --exploitscan...

Hello, I am in latest version 10.11 , deactivated LF_CSF and activated WAITLOCK but still have this warning message that LF is down from the cPanel

Hi,

I originally posted on to but realised it was marked as

We have the reCaptcha working on all servers except one. The one server shows Failed to pass human test. Please try again.

I can see that on all the other servers there is an unblock.txt file in eacg /home/csf/ directories. This non-working server does not have this file. I've checked that the csf user has permission to write to...

Hi

lfd/csf block PageSpeed Insights website speed test

if i have enabled csf/lfd i can check website using PageSpeed Insights

if firewall disabled PageSpeed Insights works fine

any sugestions ?

regards

We have a CentOS 7 server where we are running CSF v10.04.

On this server we have Qmail as the MTA (part of Plesk 12.5) and it logs to rsyslog via the 'root' user.

I checked /etc/csf/csf.syslogusers and root is already included in the file by default. However, root does not get added to the mysyslog group as confirmed by the following command:

# groups root
root : root

We have restarted...

In /etc/csf.allow, if I want to enable an IPv6 address for a specific port, is the syntax the same, i.e.:

tcp:in:d=22:s=2601:589:4600:3f05::/64

It does not seem to allow the IPv6 address. Is there a different syntax for allowing IPv6 for a specific port/source address? Thanks.

Rob

Hello everyone!

Im having trouble keeping custom configurations in our CSF installation. We are running WHM build 39, and csf v10.09 (just updated)

The problem occurs after this lfd log output:

May 26 00:00:03 hos lfd : TERM
May 26 00:00:03 hos lfd : daemon stopped
May 26 00:00:07 hos lfd : daemon started on - csf v10.08 (cPanel)

After that restart, no custom settings remain in csf.conf, and...

Hi all,

I've been getting numerous suspicious process alerts each day, listing /usr/bin/php as the suspicious process but no actual process beyond that. I'm not sure if this is a false positive or not - and even if it is I don't know how to block it because it doesn't seem wise to ignore everything under php.

Can anyone help interpret this? I've searched high and low in this and other forums...

Hi there,

I'm trying custom regex to prevent Joomla Brutefoce login base on Wordpress Bruteforce login.
But it's not working. Somebody help me where i'm wrong ?
This is my regex

# joomla
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] POST \/administrator\/index\.php.* 200/)) {
return ( Failed Joomla login from ,$1, joomla , 2 , 80,443 , 3600 );
}

What's the easiest way to block all SMTP traffic from a centos server (with cPanel) and CSF installed?

I'm wanting to test a transferred site on a new server and don't want emails to be sent whilst it's being tested.

Can I set LF_ALERT_TO to multiple email addresses? If so, what is the format?

Hello CSF

I installed your wonderful plugin on Tuesday of this week.

Since then I've received 539 emails from LFD saying:

lfd on mail.myserver.tld: Suspicious process running under user myusername

Its found the same files for each domain on my server and they seem to be files from WordFence

Here follows the email:

Executable:...