ConfigServer Community Forum

Brute Force Protection in CSF for IMAP, POP3, and SMTP is a support nightmare. Here are a few scenarios:

1. A user inputs an incorrect password in an email app on a device. The app quickly exceeds the login failure threshold and the user's IP address is locked out of the server, even though the app is trying the same password over and over.
2. A user changes their email password and enters the...

I'm currently evaluating several firewalls. My goal is to block all traffics from VPN providers. We have the VPN IP address list from the IP2Proxy in the following format with IP address ranges in decimal format.

17496733 , 17496733 , VPN , TH , Thailand
17496784 , 17496784 , VPN , TH , Thailand
17543533 , 17543533 , VPN , KR , Korea (Republic of)
17544563 , 17544563 , VPN , KR , Korea...

Hi All,

We're getting swamped with LFD Excessive Resource Usage emails and are working on that. Just wondering though, if its possible to modify the email subject as to remove the PID

for example, the email we get now is:

RE: lfd on hostname.servername.com: Excessive resource usage: username (45750 (Parent PID:45750))

Would like it to be:

RE: lfd on hostname.servername.com: Excessive...

At the time of an attack on SSH, a lot of CSF processes are created, sometimes I reach even 60 blocking processes.
This saturates CPU time, what can you do about it?

I've searched and read many posts on this topics before but I still don't find it clear what specific syntax to use in the csf.pignore file. These is the type of warning I'm trying to ignore.

lfd : *Suspicious Process* PID:3792 PPID:3788 User:username Uptime:121 secs EXE:/home/virtfs/elemcms/opt/cpanel/ea-php73/root/usr/bin/php CMD:/opt/cpanel/ea-php73/root/usr/bin/php -f cron.php

Right now I...

Hello,
which directive would be enabled or disabled so that connections to remote services are made without having to whitelist the ip of this service?For example if a client must connect to an API from his website with the IP address: 192.168.2.3 we need to whitelist this IP on the firewall

Best Regards

Hello,

I am trying to add an open port.

The port is listening:
# netstat -punta | grep 5666tcp 0 0 127.0.0.1:5666 0.0.0.0:* LISTEN 1084400/nrpe

but in csf it does not appear in the section: view listening ports

I have added the port in firewall configuration in Allow incoming TCP ports but in the View listening ports I don't see the open port.

What could be the problem?

Best regards,

Check your config for DENY_IP_LIMIT e DENY_TEMP_IP_LIMIT

I have a person or bot that keeps requesting an image(s) that exists on my website creating multiple 404s. I can't block the image because other users might request it. Sometimes over a period of time I might get 2000 emails about 404s. He doesn't do it real fast, just continually and it doesn't create a big load on my server. He changes IPs constantly and changes images that he requests as well...

I installed a new Centos 7 server, the same as my old server.
On my old server I could connect to FTP servers with PASV no problem.
But on my new server it blocks the connection.
SPI is on, Connection tracking is on.

Kernel: 4.18.0-147.8.1.el7h.lve.1.x86_64
CSF: 14.05
cPanel: 90.0.9

Hi,

I'm receiving 5 emails on daily basis for the 5 server, may I know what is going on? it was working well

Oops: Unable to download: Can't connect to download2.configserver.com:443 (Connection timed out)

Regards

1 out of 10 servers updated the messenger index.recaptcha.html file. I have restarted csf, lfd, apache (v2 used), cleared caches, tried different browsers, different domain names but and yet it is still showing the default files when any host is hit at port 8888. This has been an ongoing issue since I can remember with configserver and the messenger module. Where does lfd cache this information?

My changes to /etc/csf/messenger/index.html are not being reflected. I have restarted LFD and CSF multiple times to flush the file from the cache, even deleted my own browser cache, but it still is not displaying the new version. Any clues?

Thanks!
Greg

I am seeing quite a few new files in the messenger directory along with an index.php which references invalid files. I understand what the .text file is for, can we get an up to date breakdown on what files are used for what now?

Thank you.

Hello,

we have csf - ConfigServer lfd Cluster on 6 servers. On master server we have problems with that and lfd stop working because of that.

service lfd status
Redirecting to /bin/systemctl status lfd.service
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: disabled)
Active: inactive (dead) since Wed...

I think I already know the answer to this but I'm running a half dozen Wordpress sites and I'm tired of seeing the gobs of traffic being blocked at the Wordpress security plugin level originating from China. I would consider putting a country block on China in CSF but frankly there is a small chance there could be some legitimate visitors from China (like 1 in 1000) to some of the websites. So a...

Hello,

after my site was attacked I installed CSF v14.05 and it work great.Except that users with ipv6 started getting (connection time out) and very slow browsing to my site. if I disable CSF the problem goes away.

here is my setting in CSF for ipv6:

IPV6 = OFF

IPV6_ICMP_STRICT = OFF

IPV6_SPI = OFF

Allow incoming IPv6 TCP ports:...

Hello all,

After seeing my web server slowing down while my ModSecurity logs were filling with IPs from AmazonAWS, googleusercontent, Microsoft cloud users, DigitalOcean, Tencent, Alisoft, etc., I blocked the IP ranges for all of those services / server farms.

Now I see the message that I put in the subject line of this post next to the Manual Check button, in my implementation of ConfigServer...

Hello,

We have a server with IP reputation system activated.

One of the client's IP got blocked in the firewall in chain CXS_LF_CXS.

The IP doesnt have any history of getting blocked in the server in lfd.log.

Earlier, we could remove these blocked IPs by using cxs -Rremove .

But this block is not removed. Also, this happens repeatedly.

Can someone explain how the reputation system...

I am trying to figure out why the LFD is not showing or catching any ips that have been failing authentication. I have had a lot of unauthorized ips trying to log in to mail, ftp, ssh etc but they never show up in the LFD log nor do they appear in the CSF deny list. I can manually add them to the deny list and they are then blocked but I can't figure out why this is not being done automatically....