ConfigServer Community Forum

When Cpanel updates it modifies MANY files. And CSF warns the administrator about these changes.
I have created a feature request on Cpanel that was just approved so the update process try to inform CSF LFD of those changes so it stops barking at it.

Please support this feature request here:

Sorry if this is a dumb question, but what's the difference between the DYNDNS_IGNORE and GLOBAL_DYNDNS_IGNORE settings in csf.conf?

Hello,
i have a new vps with almalinux 8.4 and install csf firewall.
works fine but not block attack on ssh.

i check and found on almalinux there isn't a file
/var/log/secure
(like centos 7).

searching i found that centos 8 / almalinux 8 use journalctl
so if i run in ssh
journalctl _COMM=sshd
i found error (like old log files)

so what i write in /etc/csf/csf.conf
SSHD_LOG = .... ????

thank...

I'm having another issue with CSF blocking inbound emails from Gmail. I logged into multiple gmail accounts and tried to send email to one of our servers and the emails are never received. After I disable CSF firewall i can then receive email from all 3 gmail accounts. I flushed all IP blocks, and added Googles entire IP block 209.85.166.0/255 to CSF ignore. Restarted CSF and still CSF is...

I usually receive a minimum of 50 LFD blocked alerts a day, but yesterday I noticed a sudden decrease to only a handful. This seems like an anomaly, so I am a bit concerned. I haven’t made any changes to the Firewall configuration (except for PT_Usermem) and I’m not seeing any major changes in my server activity. In short, I don’t know if this is a problem or not. Just wondering if anyone has...

I understand that for certain sites, like those that accept credit cards, MaxMind provides fraud prevention. But I don't understand what functions it offers in CFS's Firewall Configuration.

Also wondering if there is a log of MM's activity.

Any insights are appreciated.

I have a fairly new 'large' AWS instance which houses around 40 'not very busy' websites, yet I regularly get a High 5 minute load average alert email.

The that I have just received says:
Time: Thu Sep 2 12:35:36 2021 +0000
1 Min Load Avg: 27.97
5 Min Load Avg: 8.12
15 Min Load Avg: 3.15
Running/Total Processes: 68/395

I compare this to an 'x-large' AWS instance I have that houses 100+...

My website suffer from bad bots and Invalid Traffic bots can i configure csf to stop that

Couldn't find a specific forum for OSM so posting here.
Hi, You installed OSM for us as part of the cpanel services a few months ago. OSM has now sent us a mail report but does not say who the user account sending the mail is or what directory the mail script originated from. Are we missing something? Example:
WHM Report URL:

Report Date:

Fri Nov 22 16:03:44 2019

Report Message:

User...

I've been using OSM for over a year and today I went in and it wasn't running saying it needs PCAP? I'm not sure what has happened, obviously, its been running for a while, so PCAP must have been installed. As I remember OSM isn't a self install, so I don't have the install documents.

Hi team,

It appears on all 8 of our WHM servers csf is no longer blocking the IP address in /etc/csf/csf.deny file. Even when manually added the ip addresses are no longer blocked.

We initially assessed and noticed on one server issue as we could not block spam ip from spamming site in CSF it was still continueing. Then we replicated on 8 other servers and noticed CSF was not blocking on any...

So I have been searching for two days and I am not coming up with a clear answer to my questions. I have a managed server by another company were I do not receive any excess mailman resource messages and I checked the settings under csf.pignore

I am receiving multiples of these errors hourly:

Time: Fri Aug 27 16:11:53 2021 -0400
Account: mailman
Resource: Process Time
Exceeded: 55985 > 1800...

Can someone help me?
I can't login to csf admin page when i setup it to a external app proxy in openlitespeed. When i login, alway return to login page, in debug mode, log print request data is null in spite of request data in my browser is correct csflogin and csfpassword. In direct access to csf admin page, login is normal.
So sorry for my bad English. Thank for all.

Hi,
I have blocked an ip xx.xx.65.81 but i can still see ddos attack from that ip.
csf -l shows that DROP rules have been added as shown below:

200 2 1450 DROP all -- !lo * xx.xx.65.81 0.0.0.0/0
200 4 1840 LOGDROPOUT all -- * !lo 0.0.0.0/0 xx.xx.65.81

The IP is present in the /etc/csf/csf.deny file. lfd and csf both services are running.
csf version is v14.10

Is there anything else i can...

CSF, great product, thanks.

I need clarification about the error message I am receiving for a particular client.
dovecot_plain authenticator failed for ( ) :51008: 535 Incorrect authentication data (set_id=xxxxx@xxxx.xxx.xx)

The xx ip address I know is their office IP address, however the IP address 10.242.59.0 I don't recognise, Google search sees it as a private address.
What does the first...

I believe CSF is blocking wordpress jetpack from communicating with wordpress as it throws either a connection timeout error or a gateway 504 error. I am a bit stumped and this is what I have currently so please let me know if it helps or if I need to provide more information.

Server details
CentOS 7.9.2009
Cpanel v98.0.4
csf v14.10

Error: cURL error 28: Operation timed out after 10001...

We would to allow IPs from a FQDN with multiple A records, for example out.adyen.com, which resolves 20 different IPs.

Will this work? Is there a specific way to configure this?

Thanks in advance.

Hi there,

Just wondering if anyone's run into this, I can't find anything directly relevant in the search at least.

We use the SMTP_BLOCK option by default with our whm server and allow exceptions for some users. We had quite a few users listed under SMTP_ALLOWUSER and I thought it may be easier to set up groups and simply put the groups in SMTP_ALLOWGROUP instead of having a disorganized...

Hello there!

I'm newer here, but I have used CSF for a while, and recently we are having problems with spam.

I get the authrelay notification from other countries and when I change the passwords of the compromised account the problem stops, but I would like to stop this definitely, so I tried to fix it by using this configuration:

cc_deny_ports = RU,CN,KR
cc_deny_ports_tcp = 587,25,465...

Hello.
CSF plugin is installed on the Directadmin control panel.
Recently, possibly after updating the CSF, when performing a backup from the panel via FTP, we found that connections were blocked on the allowed port.
Configuration:
TCP_IN 20,21,22,25,53,80,110,143,443,465,587,993,995,2222,35000: 35999
TCP_OUT = 20,21,22,25,53,80,110,113,443,587,993,995,3306,2222,43,35000: 35999
With these ports...