ConfigServer Community Forum

I try combine Firewall and Laravel. Is it possible to install Firewall as a separate installation and not as a cPanel installation?

I try to control Firewall settings within one application.

Is this technically possible?

Hello,

21 port is enabled on my server but when I run the command:

# nmap -p 21,22,80,443 x.x.x.x

Starting Nmap 6.40 ( ) at 2020-03-22 12:22 +0530
Nmap scan report for server1.xxxxxxxxxx.com (x.x.x.x)
Host is up (0.000079s latency).
PORT STATE SERVICE
21/tcp closed ftp
22/tcp open ssh
80/tcp open http
443/tcp open https

Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds
#

Anyone...

Via email I get the following notifications (hundreds a day):

Time: Mon Mar 2 02:16:07 2020 +0000
Account: mailman
Resource: Process Time
Exceeded: 17249 > 10000 (seconds)
Executable: /usr/bin/python2.7
Command Line: /usr/bin/python2 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s
PID: 8576 (Parent PID:8549)
Killed: No

I have added the following lines to my csf pignore...

I have just installed and completed setup latest configserver on a vps running centos 7.
I can receive email lfd on myhost: Excessive Resource Usage,
but I see no other email like SSH Login Alert, Firewall block etc.
What am i missing? Please help. Thanks in advance.

Hi Everyone,

I'm trying to configure CSF to cluster 3 servers, I want server 1 to be the master and then the other two servers to share information.

###############################################################################
# lfd Clustering. This allows the configuration of an lfd cluster environment
# where a group of servers can share blocks and configuration option changes.
# Included...

Hello,
LFD do NOT recognize matching mod_security rules from Imunify.

We tested with many imunify rules with LF_MODSEC directive and DEBUG directive enabled in csf.conf.

Imunify mod_security rules are not counted neither ignored.

Tested with:

Imunify 4.5.6-1
CloudLinux 7.7
cPanel 11.84
CSF 14.02

Example.
In csf.conf
LF_TRIGGER= 0
LF_MODSEC= 10
LF_MODSEC_PERM= 1

Our custom rule matched:...

Hi,

I installed a docker on my machine, running a Discourse instance.

On the host machine, lfd coninues to call out Excessive Resource usage for some commands that I really think are coming from the docker.

Examples:

Executable: /usr/local/bin/ruby
Command Line: unicorn worker -E production -c config/unicorn.conf.rb
---
Executable: /usr/local/bin/ruby
Command Line: unicorn master -E...

yesterday i block ip 62.109.24.84 it work but today this ip still attach my server, then i block this ip again, can you suggest me.

Thank you

We are using the csf RELAYHOSTS setting to prevent lfd from creating temporary firewall entries for customers who successfully check email. We are not on cPanel, so the setting isn't normally there, but it works well. We have a separate daemon that maintains /etc/relayhosts with the IPs of recent successful connections.

The problem is that during a csf upgrade it seems to strip the RELAYHOSTS...

Hi

I'm in the process of moving from Apache to Nginx, but I can't seem to get the new regex rules working for Nginx.

My rule for 404 flood detection is here:

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /.*No such file or directory\), client: (\S+),.*/)) {
return ( NGINX Security rule triggered from ,$1, nginx_404s , 4 , 80,443 , 86400 );
}

An example log is here:

2020/03/08...

Hi,

I was looking through settings, and documentation, and i could not find, any wy to disable just mail of Excessive resource usage . Is that even possible ?

Asking as i want to switch using log reports instead, and do not want completly disable time and resource usage tracking of processes.

I have a sandbox server that mimics my live site. We have some CRM systems that make outbound connections to smtp servers on port 995. And since our sandbox is sync'd/refreshed regularly with our live site, I've blocked outbound port 995 on our sandbox to prevent the sandbox copy of the live servers from accidentally ever retrieving customer email from our POP servers. I can't disable the cron...

I just saw in configserver's blog the following notice:

We are deprecating support for Virtuozzo/OpenVZ servers. Future releases will not take into consideration those platforms which have become onerous to support. The software application may continue to work but support and functionality is no longer guaranteed

Is this about Virtuozzo/OpenVZ hosts or containers?

I'm seeking ideas for the most native way to create a configuration to make LFD ignore all IP addresses within a specific Autonomous System Number.

The use case is this: I don't want to block legitimate web crawlers on my server which may trigger failure logs due to HTTP 403's and HTTP 404's. This is frequently a common behavior for websites I host with many pages, which are crawled by search...

Hello,

Receiving the following:

Time: Thu Mar 5 09:02:42 2020 -0500
Account: openvpn_as
Resource: Process Time
Exceeded: 1832 > 1800 (seconds)
Executable: /usr/bin/python2.7
Command Line: /usr/bin/python2 -c from pyovpn.cserv.wserv_entry import start ; start() -no -u openvpn_as -g openvpn_as --pidfile /usr/local/openvpn_as/etc/tmp/wserv.pid -r epoll
PID: 7125 (Parent PID:7104)
Killed: No

Do I...

Hi All
Since several days ago my log files show the following error /usr/sbin/csf -u
I have two similar servers and both have same error each nigth at the same hour so it looks like some update proccess cannot be completed
I did not find any information on the forum about -u command
Regards

Hi,
I am using the Config server firewall on CentOS. My question is how to configure csf to allow IPv6 connection(FTP,SSH)??
(If i connect through ipv4 it is working but incase of IPv6 it is not working)

hello

My problem is that when connecting to ftp if csf is enabled, ftp cannot be connected
But if ip in csf allow the connection is established !
How to fix a problem that connected to ftp without having to allow ip in csf?

thanks ...

Hello i have many e-mail with this alert, i didnt find nothing about it. How can i solve?

Time: Sat Feb 29 11:17:48 2020 +0100
File: /dev/shm/\i360_blamer_reducer423.u1025
Reason: Suspicious file name
Owner: user:user (1025:1028)
Action: No action taken

Hi,

I am receiving an error when attempting to access the interface. I am getting a 500 Internal Server Error:

No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/csf.cgi): The subprocess reported error number 72,057,594,037,927,935 when it ended. The process dumped a core file.

I rebooted the server but that didn't solve the issue.

I checked available disc space,...