ConfigServer Community Forum

hi,
i have csf in centos7.9 with cpanel and when csf is enabled, host tracker cant ping ip server or any website,
when i disabled csf, everything is completely works fine,
so whats the problem?
in my all servers the problem is the same with csf.
* when csf is enabled, everyone can access their website or server but websites like host-tracker.com or check-host.net cant ping them with timeout error.

I've just gone through the process of upgrading from CentOS 7.9 to AlmaLinux using the cPanel elevate script and everything went through successfully.

However, since the upgrade CSF has stopped functioning.

I'm getting hourly alerts with the following errors:

Aug 12 11:10:12 server.xxxxx.com systemd : Starting ConfigServer Firewall & Security - lfd...
Aug 12 11:11:42 server.xxxxx.com systemd :...

Hello.

I'm having problems with outbound emails that contain links to images not displaying in the email unless I disable csf.

I can't imagine what setting within csf is causing this to happen, so:

1) where can I get a fresh install csf.conf file to compare it with and:
2) anyone have a clue why images would not display in this situation.

Thank you.

Hi there

Since a few weeks, 2 or 3, I started having a very strange issue.

The server cannot communicate on self (like doing a curl on it's own ip, or access an image from an url hosted on the same server).

I have 3 servers with the same os, same config, and only this one has the trouble.

Let's take an example of a php website that generates PDF, where in the pdf you have an image loaded by...

I have a new server running CloudLinux 8.8 and while csf starts, it gives the following errors at the end of the startup output;

Command:
Error:
You should check through the main output carefully

*ERROR* line:
Command:
Error:
You should check through the main output carefully

*ERROR* line:
Command:
Error:
You should check through the main output carefully

*ERROR* line:
Command:...

my python script it use requests lib , requests to graph.facebook.com (with alot of requests per seconds )
catch error showing :
HTTPSConnectionPool(host='graph.facebook.com', port=443): Max retries exceeded with url: /me/ (Caused by NewConnectionError(' : Failed to establish a new connection: Connection refused'))

when disable csf csf -x , it working perfectly.
all value of tcp_out, udp_out,...

Hi,
I see that Debian 12 isn't yet listed on the working distros, but not sure where to report this from my testing. Following my test server being updated to Deb 12 (Bookworm), CSF appears to work, but LFD fails to read logs. I get the failed SYSLOG email warnings - although it is writing the check code to SYSLOG, it's not able to read it. Looking at the debug log under debug level 2 every log...

Almost every day, I receive lfd failed email notifications, followed by 1 lfd recovered email notification.

I have a VPS with InMotion. They told me I should look for answers here.

Hi,

Is there any way to receice an alert if csf or lfd turn off?

Best
Joao

We use nf_tables on Debian 11, but on every configserver update the iptables are set back to legacy.

Very strange behavior and it breaks a lot of functionality over and over.

Any fix for this?

attempting update v13.08 to v13.10

With ipset in use and using the following update script, script freezes with message:

*ERROR* IPSET:

Don't know what to do. . .

Hi,

I think it's a strage thing, but csf is dropping my httpd service each minute. When csf is disable, apache works fine.
I don't have any crond running every minute.

Any ideia about this problem?

Thanks
Joao

So I'm an idiot. What can I say?

I've set my customlog1 as follows:
CUSTOM1_LOG = /var/log/nginx/access_log
Yes, that is the correct path.

The format looks like:
118.126.124.10 - - HEAD /manager/html HTTP/1.1 404 0 - Python/3.6 aiohttp/3.8.3

I'm looking for 5 404's from the same IP in the specified time period in order to give them the boot. Truthfully, if they're appearing in that log,...

Hello,
i am facing a big problem?
I am using csf with cpanel / whm .
Please take a look at this part of the exim_mainlog which indicates some of the 4000 dovecot failed logins over the last 5 days. :
Line 118101: 2023-09-15 06:54:10 dovecot_login authenticator failed for 107.40.3.213.static.wline.lns.sme.cust.swisscom.ch :43582: 535 Incorrect authentication data (set_id=abuse@domain.com)
Line...

Advisement from MaxMind sent out today:

MaxMind will begin requiring HTTPS for GeoIP download requests in March 2024. To help customers get ready for this change, we will have a planned, temporary enforcement of this policy on October 17, 2023.

Could the devs kindly advise if CSF is interacting with MaxMind over HTTPS already?

Thank you.

When adding a new ip to the allow list using csf -a, the rule seems to be isnerted into IPTables, however, its not being honored. We still see blocking messages in syslog.

Rebooting is the only way I have found to clear it. Disabling fasstart did not work, enable/disable did not work.

Any ideas on this?

Hello all!
I have problem with CFS. almal 8.8+DA. CSF shows:
You should consider disabling commonly abused php functions, e.g.:
disable_functions = show_source, system, shell_exec, passthru, exec, popen, proc_open
Some client web scripts may break with some of these functions disabled, so you may have to remove them from this list:
Affected PHP versions:
/usr/local/php56/lib/php.ini...

Hello

If an IP starts gobbling up server resources by hitting a website multiple times, can we use CSF to rate limit them ? What I mean is, to slow the resource allocation to that IP if it is hitting the server multiple times.

I currently have an Apache box with linux CentOS7 and I also use Mod Sec.

I cannot decide which will I use for a cPanel server. Imunify360 or CSF? What makes Imunify or CSF better?

Hello,
i recently was checking lfd.log ( i am using CSF/LFD with WHM/cPanel) and it caught my eye that although my server is constantly being targeted by potential perpetrators for trying to login by SMTP there are no entries in the lfd.log that indicate that lfd picks up these failed attempts.
Here is a grepped part of my exim_mainlog indicating failed smtp login attempts :
2023-09-13...