ConfigServer Community Forum

I guess you are aware of this, or soon will be when you get back from your holidays, but an account is now required to use the free MaxMind GeoLite2 databases.

You will see errors like the following in lfd.log

CCL Error: Unable to retrieve GeoLite2 Country database - Unable to download: Can't connect to geolite.maxmind.com:80 (Name or service not known)

Hello all -

Looking for some input on how to allow PPTP / GRE connections. Allowing TCP port 1723 in the config is easy to do - but PPTP also requires a GRE packet type. How can this ben allowed?

Is it normal with active both:

CC_ALLOW_FILTER = UK, US

AND regex.custom.pm:

if (($globlogs{CUSTOM3_LOG}{$lgfile}) and ($line =~ /^.*\ .*(wp-login|xmlrpc).*/)) {
return ( WP whacker ,$1, WP_whacker , 1 , , 172800 );

to continue to receive alerts from non UK, US actors?

ps CC_ALLOW_FILTER = UK, US is active and working as ipset list shows both countries block lists active.

A recent post here on 31st December 2019 by Chirpy states:

Due to MaxMind changing their free download policy to require signup and a license key, a new option MUST be configured to continue to use Country Code lookups (CC_LOOKUPS). The option MM_LICENSE_KEY must be set to the key obtained from the MaxMind site. See:

I see no MM_LICENSE_KEY place holder in my csf install.

Can someone elaborate...

Hi to all of you,
I would like to wish you a Happy New Year 2020.
I am new here and I just installed a new CentOS 7 Plesk Server and I obviously installed CSF Firewall as recommended.
Installation went well and I also configured the csf.conf file.
Nevertheless I have an issue as on my other CentOS7 Plesk Server when I get the LFD Email Alerts (SSH Blocking) the country of the IP shows us as you...

Hey guys .
I just searched in forum and didn't find any thing related to my question so would you please help my to how configure CSF to watching any changed file in specific directory?
I gave FTP access to a freelancer and he's trying to develop some script but I don't trust him so I wanna to watch that directory .

I just edited /etc/csf/csf.dirwatch
and here is my code :...

Hi Team,

i'm looking for the best way to implement CSF. Currently my requirement is to have port 25,80,443 can be access from all over the world. However, certain ports like 465,587,110,143,995,993 only allow from malaysia.

currently i have set TCP_IN for 25,80,443
and CC_ALLOW_FILTER= MY CC_ALLOW_PORTS= 465,587,110,143,995,993

However, i notice that port 587 and 465 still able to be access...

Hi guys,

I have two servers, one fully configured by ConfigServer and the other a small local one with configfirewall set up.

The small local one I have configfirewall set up on: Now over the weekend, this email has been sent to me over and over again for different accounts. I honestly don't know what to make of it, i've tried everything to stop them. A common denominator of the users is that...

I'd like to allow 149.154.167.197-233 on port 443, but haven't been able to figure out how to do this in csf.allow

For one ip address I have:
tcp|in|d=443|s=149.154.167.197

But how do i get the whole range without having to specify each ip address on a single line?

Ever since the 28th November, the majority of lfd alerts i receive via email no longer have any body text.
This started off with the occasional alert not having body text (about 1 in 10) to now ALL of them not having body text.
It doesn't matter which alert: Excessive resource usage, Suspicious process, root access alert, blocked etc. are all affected.
The email headers are populated correctly....

Hi, we have a server on IBM CLOUD and we have installed CSF.

Yesterday we did two procedures by ssh:

cd /var/spool/exim/db
rm -f retry retry.lockfile
rm -f wait-remote_smtp wait-remote_smtp.lockfile
service exim restart

And:

/usr/sbin/exim_tidydb -t 1d /var/spool/exim retry > /dev/null
/usr/sbin/exim_tidydb -t 1d /var/spool/exim reject > /dev/null
/usr/sbin/exim_tidydb -t 1d /var/spool/exim...

Hi, I always install CSF on CloudLinux 7 + cPanel (Centos 7 + cPanel + Cloud Linux) and it works perfectly. But today I was setting up a new server and found that after installing CSF, the lfd service is failing to start.

I've tried restarting CSF and LFD trough SSH and WHM and no success.

When checking LFD status I get this:

lfd.service - ConfigServer Firewall & Security - lfd
Loaded:...

CentOS 6
No changes to CSF for some time.
Recently began getting an error when the daily cron job runs:
/usr/sbin/csf -u

Oops: Unable to download: write failed: Connection timed out

I've tried searching for solutions, but nothing pops out a me. Again, I'd not made any changes prior to this failing. It started failing sometime in the last week or so.

I have a lot of countries blocked, and have...

Hi!

Absolutely love CSF its a godsend, big thanks to the dev team.

I have an issue however that i have 1 particular IP that tried to DDoS me, its from a company that offers DDoS protection so i assume this is a method they use to get customers in the door, i wont mention the name yet as i have reached out to them for comment, there may just be a glitch in their system.

So this IP i have to...

Hi,

I'm using SQL Server 2017 on CentOS 7 x64. many users trying to get access to the SA account of SQL Server with many Password Attempts, unfortunately, I won't block with CSF.

how it's possible to block those users? Please take a look at the attached picture.

Best Regards

Server is CentOS 7.7
csf update script is in /etc/cron.d/csf_update
cron logs show the job is being run once per day as expected
root has been set as the recipient of emails
But I m not getting an email telling me it's run.

I used to get these emails when my VPS was on CentOS 6 with a different host. I moved hosts and am now on CentOS 7.7, and when I installed CSF, I migrated all settings from...

I have reviewed some of the other posts, particularly the one listed below and tried that solution but it did not resolve it. I have been able to duplicate this issue on 2 Webmin servers and a DNS CPanel server. See the notes along with the information to explain and break it down.

<<-- Did not fix it

The error is...

Can't open PID file /run/lfd.pid (yet?) after start: No such file or...

Hello,

We received today a strange email about:

New account has been created with uid: gid: login: shell:

But on the server everything seems to be fine, user not missing, wasn't deleted, scanned with rootkit hunters, etc and it doesn't seems to be compromised.

grep '0:0' /etc/passwd
root:x:0:0:root:/root:/bin/bash

chage -l root
Last password change : never
Password expires : never...

Could someone please direct me to a list of ALL the IP addresses that ConfigServer Services uses?

I have 85.10.199.177 in my csf.allow and csf.ignore files so that CSF+LFD can download updates, but I had to add an empty csf.deny file and restrat scf+lfd in order to get the email from the registration for the HELPDESK.

The email came in on 85.13.219.102 .

I can add that IP explicitly too, but I...

Hi,

It seems that CSF is not watching pureftpd.log and phpmyadmin.log

Is there any way to get the actual counters for each monitored log ?
I meen to see how much failed attempts were made.

In system rsyslog,conf I make this changes:

auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.*...