ConfigServer Community Forum

I'm happy to report that CSF works fine on Centos 8. I fired up a test Centos 8 VM and everything seems to work fine.

# cat /etc/redhat-release
CentOS Linux release 8.0.1905 (Core)

# uname -a
Linux centos8.example.com 4.18.0-80.7.1.el8_0.x86_64 #1 SMP Sat Aug 3 15:14:00 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

The only issues I've run into:

When doing a minimal install of Centos 8 the...

I have CSF installed on a Ubuntu 18.04 machine. We just installed libvirt on the machine and have VMs that are using the internal network adapter virbr0. When libvirt starts, it adds the following rules:

# Generated by iptables-save v1.6.1 on Tue Jun 16 11:48:26 2020
*nat
:PREROUTING ACCEPT
:INPUT ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24...

Hi,

i need to protect FORWARD rules , csf.redirect

-A INPUT ! -i lo -j LOCALINPUT
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j SYNFLOOD
-A INPUT ! -i lo -p tcp -j INVALID
-A INPUT ! -i lo -p icmp -m icmp --icmp-type 8 -j LOGDROPIN
-A INPUT ! -i lo -p icmp -j ACCEPT
-A INPUT ! -i lo -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT !...

When you login to CloudLinux via SSH you get a welcome message something like There have been 9,980 failed login attempts since the last successful login. I was thinking CC_DENY should reduce this number significantly, however I still have a lot of IP's included in that number that are from countries I have blocked. For example in the welcome message it also tells you the last IP blocked, and I...

Hey guys!

I'm hosting a domain for a friend who used to use other hosting provider.
One of his employee is not longer working for him, but this person still have in her smartphone (Actually not her anymore, since she sold it to someone else, but didn't factory reset the smartphone) her old old mail account connected . But this mail box no longer exist, so lfd treats this as a imapd attack.
This...

I cannot seem to get this to work. I am running openlitespeed with mod_security 3.0 module on a non-cPanel CentOS 8 server and it denies access when using test URL, and logs the event like it supposed to, but LFD completely ignores it.

csf.conf has the following:
LF_MODSEC = 5
LF_MODSEC_PERM = 1
MODSEC_LOG = /usr/local/lsws/logs/error.log

I even tried...
MODSEC_LOG =...

Hello,

We'd like to disable the email alerts for certain types of alerts. For example, we don't need an email when there is a POP/IMAP/SMTP login failure, as it's easy to search the logs for there.

Thanks!

Hello,

I'm wondering if CSF has any way to do some aggregate monitoring across a set of clustered servers to look for bad actor IP addresses.

For example even a single IP that is hitting lots of websites across all of our servers is suspicious.

It's really suspicious if it's hitting /xmlrpc.php on multiple sites across our servers and a strong sign it's a bot net or some type of scanning....

Hello,

Anyone can help me to turn off LFD alerts for ossecr service?

Screenshot;

I am getting a lot of emails from the service. I want to turn it off. I have turned off other LFD alerts but I can't turn off for the service I've specified.

Regards,
Khalequzzaman

Hello!
I have server Cpanel Cloudlinux+CSF>
I need make redirect port 4554 on port MySQL 3306.
I added on csf.redirect
But doesn't work , mysql not accept connect

Hello buddies , from somedays I am facing connection was reset by peer issue in my dedicated server.
The Following are installed in my server :
CPanel
CloudLinux
LiteSpeed
ConfigServer Firewall
Imunify360

I asked my friend he said that someone doing Ddos on your server.

sir I checked my IP on check-host.net , and I patched a issue that when UDP Ports showing connection refused then HTTP shows...

Hi,

-I did a simple installation in my server, I installed only: CentOS 8 + Postfix + Mailx + CSF
-I configured in file /etc/csf/csf.conf this data: LF_SSH_EMAIL_ALERT= 1 , LF_SU_EMAIL_ALERT= 1 , LF_SUDO_EMAIL_ALERT= 1 , LF_ALERT_TO= myemail@email.com
-I enabled only 2 ports: SSH port, and port 25 for emails
-I can send emails with command mail and work correctly.
-I not did nothing more for...

Hello,

I was wondering if anybody has any insight into this issue we are seeing. We have centos6 and csf with cpanel integration installed. Sometimes a users IP will be blocked, and after being removed, the hostname will still remain blocked in iptables.

After trying to remove the block through CSF it's saying it doesnt exist:

Unblock 184.153.XXX.XX, trying permanent blocks...

csf:...

Hello

Just i make a fresh installation on dedicated server with centos7 and cpanel.
When reboot server look ofline i believe this happening After installation of csf.
Now i have access only from rescue mode.
In past i didnt had any problem with csf and cpanel (centos 6 + cpanel)

Steps to reproduce:

1.I make fresh installation again.
2.I try to set csf on test mode to disable it.
3.I search on...

hello
im try to open / block port by country with this settings

all country:
TCP_IN = 20,25,53,80,443,465,587,993,995,1167,49152:65534,2080,2443,49152:65534

only from IT
CC_ALLOW_PORTS = IT
CC_ALLOW_PORTS_TCP = 21,110,143,2077,2078,2082,2083,2086,2087,2095,2096

deny all CHINA
CC_DENY = CN

deny BR,VN,TH
CC_DENY_PORTS = BR,VN,TH
CC_DENY_PORTS_TCP = 993,995,465,587

seem all works great...

Hello,

I am having issues with CSF not loading iptables rules on CentOS 8 on reboot. I have to run csf -r to apply the rules after reboot. How can I fix this?

Thanks,

# iptables -n -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# Warning:...

Hi

csf.deny lists the IPs, and the protocol used for the IP blacklist. This is fine.
However, and when running shared servers, it would be really helpful if we could know what email address is being used when it gets blocked.

One of our clients has 30+ email accounts, and supposedly ONE user is constantly get blocked because of wrong SMTP credentials, this is what I see in the logs.

Is there a...

Hello

I've installed Messenger v3 on my DA servers with CL7 and CL8, it works as on the cpanel server but if I block my own IP and access a site ober port 443 the page loads, if I access it over port 80 I get the message from the Messenger.

I have compared the configs of CP with DA and found out that the file /var/lib/csf/csf.conf is not filled with the vhosts.

I changed MESSENGERV3HTTPS_CONF...

I've just noticed the new Docker options in CSF under Docker Settings , if we enable these do we no longer need to add the following to /etc/csf/csfpre.sh ?

#!/bin/bash
iptables -t nat -N DOCKER
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A POSTROUTING -s 172.17.0.0/16 !...

I'm having problems with a Docker container on my server which loses connection to the internet intermittently (it seems to be ok for a day to a few days, then loses connection to the internet). I've posted an issue with Docker, and they think it might be CSF:

The problem is most likely caused by your custom firewall which runs a script periodically and breaks the firewall. Please check if...