ConfigServer Community Forum

Just recently the CSF/LFD Server Check emails from one of my servers started including the following:

----------------
Server Services Check

On most servers the following services are not needed and should be stopped and disabled from starting unless used:

abrtd

Each service can usually be disabled using:

/sbin/service stop
/sbin/chkconfig off
-----------------

The odd thing is that...

Hello,

How can I disable Temporary Block alert for LF_SSHD ? I need only mail succesfully login mail.

Regards

Hi guys,

Is there an opposite option of csf.rignore list?
I mean, I want to block some reverse dns.
How to do it?

Thanks!

Is there any way (looks like not through CSF - so has to be Linux/IPSET/IPTABLES command I assume?) to display blocking activity history?

Hey guys,

I have a couple clients, although one in particular who has suddenly started getting blocked by css due to failed auth on IMAP.

Im receiving an email every 60 seconds from the server advising he's been permablocked. (he's whitelisted for now to keep his email working)

Nothing at his end has changed. One moment he's connecting no issues, next he's getting blocked - but he's still...

Hello everybody,

I use the CSF as a firewall on my VPS.
But since I don't have a static IP, every time I get a new IP, I first have to log in via the KVM console and whitelist my new IP and only then can I connect to SSH via putty.

Can I somehow share all connections on SSH port 22 so that I can save myself the trouble?

I have already added the following rule to the /etc/csf/csf.allow file and...

Hi all,

I am constantly getting notifications about suspicious process being run and process is php-fpm

Executable:

/opt/cpanel/ea-php73/root/usr/sbin/php-fpm

Command Line (often faked in exploits):

php-fpm: pool

Network connections by the process (if any):

tcp: 127.0.0.1:51036 -> 127.0.0.1:11211

This started to happen after I installed and started to use memcached. And I can see...

Hello,

I'm having a very strange blocking issue for a while now. I run CSF firewall on some cPanel servers and CSF blocks some of the mobile users (on mobile networks) that are using e-mail accounts. What's strange is that I cannot find their IP addresses in any blocklist but after flushing all blocks the users can connect to the mail server again.

I even saved the block list, unblocked and...

---Deleted---

Hello,
Using 3 ip on server. 2 is shared. 1 ip is dedicated for 1 website.

We need to close some ports for this 1 ip or domain. Usually mail ports. But these ports should only be closed for this reserved ip. It should not block other ip and sites on the shared server. Any chance to do this via csf or lfd? Thank you.

Hello!

This maybe a silly question. I've been using CSF on a server for years and just discovered the existence of blocklists.

If I enable a blocklist, in which file these blocks are logged? Or where i can see how much a blocklist is actually blocking.

Thanks!

Hello,

A couple of weeks ago, one server started to behave very strange. Sometimes websites don't work. But after 10 sec they are working.
cPanel takes sometime 1 minute to load and emails are getting errors in customers email clients.
We also get trown out of ssh pretty quickly.

Only way to fix the issue is to disable csf -x.

I see this when I restart csf:
INVALID tcp opt -- in !lo out *...

Hi all,

On a new server with CSF installed and 21 port opened I can’t connect to the server. It tries but is not listing the directory files. Once I turn off the CSF it works fine.

Under messages this is the relevant (I guess ?) part (I swapped IPs etc):

Aug 25 10:48:25 client516 kernel: Firewall: TCP_IN Blocked IN=ens3 OUT= MAC=MACaddress SRC=MyLocalIP DST=MyServerIP LEN=64 TOS=0x00 PREC=0x00...

Hello,
i have install a new server with centos 8 and csf and i have see very bad network performance.
When i disable csf, the performance is good.

In order to confirm the issue i have do this tests:

both servers is empty without any other vps. Also the storage i use have no load at all during tests.

server 1:
Xeon® E-2176G
64G ram
NVME hard disks
Proxmox 6.2-10

server 2:
Ryzen 9 3900
128G...

I have had a series of people visit my server to set up bogus accounts. I have blocked their ip addresses in csf, yet they are able to come back in with those same addresses and continue their malicious ways. I have confirmed the address is in the deny file. Server is Centos 7.6 running cpanel with csf and lfd installed. Any suggestions?

Hello, I'm using Cpanel/CSF with SMTP_BLOCK active.

I have two hosting accounts that must connect to google.com and elasticemail.com to send email.

The first account mysite1 is connecting to google correctly and sending messages, but the second account, the CSF is blocking from connecting to elasticemail.com

My CSF settings are

The SMTP Restrictions from Cpanel is disable.

SMTP_BLOCK = 1...

I've recently done an install of DirectAdmin on a rebuilt server, and csf is not showing in the UI.

It's installed and running, and it shows as such in the Plugin Manager, if just doesn't appear in the UI itself.

Any ideas?

I've posted this on the DA forum as well and so far no joy.

Thanks

Hi All.

What should the file in /usr/sbin/LFD look like?

I keep getting this error and have figued out that the LFD file is missing.

Job for lfd.service failed because the control process exited with error code. See systemctl status lfd.service and journalctl -xe for details.
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled;...

I have this setup to check every hour...is it possible to have it email when there is a detection that the ip is flagged?

right now i get the email with the OK but its just too much for every hour...

thanks

Hello,

I'm using WordOps 3.11.2, and I can't open port 587.

I have a site in Wordpress that uses Contact Form, and when I disable the firewall (csf -f), the contact form works fine. :)

But when I enable firewall, contact form stop working. :confused:

I change the settings in CSF.CONF, but nothing works.

See here:

I tried these commands:

sudo iptables -A INPUT -p tcp --dport 587 -m...