ConfigServer Community Forum

Hi ConfigServer friends!

I recently installed the CSF and LFD software onto my Cpanel server and I experiencing some problems with users who wish to connect via FTP.
My FTP keep complaining to me that they are unable to list directories of the folder that they have access to.

When I attempted to replicate their experience, I found that this complaint was true.
While using Filezilla ver 3.58.0,...

Hi there,
I am using CSF v14.16 with WHM v104.0.5 on a Machine with CloudLinux v7.9.0.

I am trying to open an additional port 2304, by adding a record for the same in CSF's Firewall Configuration interface
Allow incoming TCP ports
TCP_IN =
20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2079,2080,2082,2083,2086,2087,2095,2096,8443,2304

and have restarted the csf server several times...

We've been getting a large number of distributed attack emails and no option I have disabled alerts for has stopped the emails. Is there any way to stop these? Some of the alerts we're getting

Time: Mon May 2 15:11:40 2022 -0500
IP: distributed imapd attack on account
Failures: 10
Interval: 3600 seconds
Blocked: Permanent Block

Time: Mon May 2 15:05:12 2022 -0500
IP: distributed smtpauth...

Hello,

I'm using virtualmin and csf on my Ubuntu 20.04
Recently I get a lot of SASL LOGIN authentication failed: authentication failure kind of attack on my server.
I want to setup the custom regex to stop this..

I added my mail.log on custom log in /etc/csf/csf.conf

# Log file locations
#
# File globbing is allowed for the following logs. However, be aware that the
# more files lfd has to...

Hello, i am trying to configure my CSF messenger service with recaptcha in directadmin its working sometime with HTTP but its not working with HTTPS
also its show recaptcha 1 time in 10 attempts, can you help me please if anyone required any information that can help you about my setting, please let me know

Thank You

Recently reported by users
When using office365 to send large group mail to the host, there is a bounced message

There are two types of error messages currently appearing:

7/13/2022 5:30:19 AM - Server at PR3PR09MB4265.eurprd09.prod.outlook.com returned '550 5.4.318 Message expired, connection reset (SuspiciousRemoteServerError)(450 4.4.318 Connection was closed abruptly...

With CSF enabled i get this.
curl#7 - Failed to connect to 2a01:4f8:1c17:e53d::1: Network is unreachable
Doesn't matter what version of mariaDB is being used.
When csf is disabled the update works.

I think the documentation is not very explanatory when it comes to the BLOCK_REPORT feature.

I suspect more than one person found out that this only works for triggers from LFD after a lot of debugging.

This hampers more or less the idea of being able to report abusive IP's or report them because half of the features of CSF rely on, well, CSF and not on LFD.

Since CSF already has the option to...

1-2 times per days I am getting a flood of SSH alerts for user/root logins to ssh but looking at the dates they go back several months and are not current logins.

The first time this happened I thought I was compromised but it's been 2 weeks now and I am growing tired of the random floods of email. Any ideas?

I just move my clients to a new server.
I have dovecot and Exim
CSF and imunify360

I get a lot of emails about lfd on jds1.3aliXXXXXXXX.com: blocked XX.68.245.XX (US/United States/c-XX-68-245-xx.hsd1.xx.xxxxxxx.net)

T ime: Fri Jul 8 11:59:08 2022 -0400
IP: XX.68.245.XX (US/United States/c-XX-68-245-xx.hsd1.xx.xxxxxxx.net)
Failures: 5 (smtpauth)
Interval: 3600 seconds
Blocked: Permanent Block...

Hi

We've tried every possible way to ignore the below using the pignore file with no success. There are multiple files from all users.

Time: Wed Jul 6 17:22:24 2022 +0200
File: /tmp/lshttpd/APVH_user_Suphp.sock.pid
Reason: Script, starts with #!
Owner: nobody:nobody (99:99)
Action: No action taken

Any idea what to use to stop the email notifications. These files are created by litespeed...

we have a client with a busy and complex WordPress site that is triggering the php-fpm pool virtual memory size trigger all day everyday

Resource: Virtual Memory Size
Exceeded: 1096 > 1024 (MB)
Executable: /opt/cpanel/ea-php74/root/usr/sbin/php-fpm

the site is secure and is running as it should, so we know theres nothing malicious or anything happening just the false positive alerts are really...

Hello

I have a simple question.

If I allow few countries through cc_allow_filter is my csf.allow whitelisting still works?

For example, if I allow thiese countries: HR, BA, ME and I still try to whitelist a US IP address, is it possible to exclude that IP address, even US is not on the list of allowed countries?

Thanks in advance

This post can be deleted - We found a bug in the way Imunify360 integrates with CSF whereby it removes the iptables entry but fails to add the IP to its own greylist ipset list.

Guys, I'm getting an error like this. Csf is installed on the server and it's blocking push notifications. The problem is caused by csf, but I couldn't find where it is blocking the port. What is preventing push notifications? I will be glad if you help.

ErrorException: Push notification failure: cURL error 7: Failed to connect to fcm.googleapis.com port 443 after 1011

Hello,

I come to you because I received several notification emails from my VPS server entitled: LFD - Suspicious process running under user postgres

Here is the content of the email

Time: Sun May 29 11:00:57 2022 +0200
PID: 12692 (Parent PID:12686)
Account: postgres
Uptime: 801371 seconds

Executable:

/usr/pgsql-10/bin/postgres

Command Line (often faked in exploits):

postgres: wal...

Hello Support.

I am using ConfigServer Security & Firewall - csf v14.16

Within CSF Country Blocks the list of country codes that I save are dynamically disappearing , so that the text field is left empty.

This phenomena has occurred 5 times .

And it usually happens somewhere between 3 to 24 hours.

======

My country code list is . . .

AF, BD, BR, CN, CZ, GR, HK, HU, IT, KR, RO, RU, TR,...

Hi,

I have been going blind on trying to debug why I cannot accept incoming connections on any services via IPv6, even though I can ping fine.

After checking the ip6tables configuration I noticed that the rules are not being added, well at least in Webmin. I am very confused, let me explain why:

- In Webmin -> Linux Firewall I can see all sort of rules being added which reflects what's in...

Running Ubuntu 20.04.4 and found that even though I have a valid csfpost.sh it is not run on server reboots.
root@mybox:/etc/csf# ls -l csfpost.sh
-rwx------ 1 root root 529 Jun 16 13:22 csfpost.sh

If I manually csf -r then it does get executed. I can't find anything in documentation to indicate I have something wrong.

As a workaround I created a line into the cron /etc/cron.d/csf-cron...

I have a vps with cpanel and csf.
I add my ip, as a test, in Deny IP and I can continue browsing without problems.
It is worth clarifying that the IP is not added to Allow IPs.
CSF latest version.

Any suggestion?
Thanks