ConfigServer Community Forum

Hello,

I can't find how to change the reCAPTCHA pages. I edited all at:

/etc/csf/messenger/

And restarted with:

csf -r
lfd -r

But changes didn't update. Any idea about how to do it?

Another thing, the unblock page only appear without the https.

It will be great to have a guide for this, thanks.

Apologies if this is not really a csf related issue, but notifications have been sent via csf with an issue that my webhost hasn't identified.

I believe from the below that I am experiencing the symptoms of an issue - that my site is not the cause of the issue .

Normal occurrence daily at around 8:34pm
server load . 27
memory used 39 . 36

During the day/night, don't see load above . 8
At...

please delete this post, problem was unrelated to CSF

Hi guys.
Thank you for support.
I was trying to open a port on 24001 but when i check with an external tool says its closed.
I have to setup anything instead of configserver security firewall?

TCP_IN= 20,21,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,2095,2096,1563,6100:6200,24001

I've had a number of failed FTP login attempts over night, but port 21 is not included in Allow incoming TCP ports
Niether is my secret sftp port number.

I'm at a loss how these login attempts managed to get through CSF.

(ftpd) Failed FTP login from 119.xx.xx.xxx (CN/China/Jilin/-/194.xx.xx.xxx.adsl-pool.jlccptt.net.cn): 3 in the last 3600 secs - *Blocked in csf*

CSF blocked them, but if the...

Hi,
I am seeing weird issue that CSF is blocking outgoing request on port 443 although its open in configuration. If I disable csf with -x then I can access the resource on that port over remote server .

Any thought where to look ?

EDIT: Its actually blocking most of the outgoing traffic, just noticed that even port 25 is blocked.

PS : Its centos 7, had already already stopped and removed...

so we use csf on one of our servers to test run it.
i noticed there was an option to show a ban page,

How does this work?

the issue is when a user gets banned from our servers they dont see no message to tell them about it, all they see is a messagee telling them the connection timed out, then i get people leaving thinking we are no longer there.
i want them to see some sort of messsage...

The setting LF_MODSECIPDB_FILE suggests /var/cpanel/secdatadir/ip.pag, but there's no such file in that folder. I also checked all the suggested folders in the setting, like /tmp, couldn't find ip.pag anywhere. But I did find cpanelusername -ip.pag in the folder /var/cpanel/secdatadir/

Is that the file LF_MODSECIPDB_FILE is asking for? If it is, how do I handle this situation? It appears that...

everytime we add an IP to /etc/csf/csf.deny to be blocked 10 minutes or so later it's been removed and can't workout what's remving it ? would there be any reason for this to happen.

I have been trying to get iOS Mail Push Notifications working. The first step was getting the expired certificate renewed.. After much work, that got done. But Push still wasn't working. I read here:

that I would have to ad port 2195 to TCP in CSF which I did, for both IN and OUT. But that hasn't helped. Is it possible there is another CSF configuration preventing Push Notifications?

Hello,

Today we have found CSF not working. It was simply not doing anything no matter what CLI commands I gave. So I uninstalled it and now I am trying to reinstall it. But it just remains stuck with this line:

*** USE_CONNTRACK Enabled

Is there a log where I could check what's the problem?

I mention that the initial problem might have originated from some rpm problems that (I hope) were...

Hi,

I recently installed csf on CENTOS 7, however it, it seems it is not able to block postfix/smtpd sasl auth errors.
Here is the log from /var/log/maillog

Sep 15 14:31:06 LinuxServer postfix/smtpd : warning: hostname mobiup.climberjumbo.com does not resolve to address 141.98.9.195
Sep 15 14:31:06 LinuxServer postfix/smtpd : connect from unknown
Sep 15 14:31:07 LinuxServer postfix/smtpd :...

Hi

How to troubleshoot this problem when the lfd does not start after the installation?

# service lfd restart
Job for lfd.service failed because the control process exited with error code.
See systemctl status lfd.service and journalctl -xe for details.

journalctl -xe
--
-- The unit apt-daily.service has successfully entered the 'dead' state.
Sep 12 20:31:31 ts systemd : Started Daily apt...

I get that CSF acts as a firewall for the server and can thus help to protect against attacks on the server.

However, will it help prevent a DDoS attack on a domain/website (specifically a forum) residing on that server?

I can't figure out how to ignore this folder which is in the server tmp folder. This is a wordpress plugin called zip recipes. It generates these cache files constantly, so I get an email every few minutes. Here is what I tried below. Any ideas on what I am doing wrong?

lfd Suspicious File Alert

Time: Tue Sep 10 11:00:43 2019 -0400
File:...

Hello!

We use Cloudlinux 7.7 and cPanel with latest CSF version.

We are no longer able to access CSF or to run any commands. Tried restarting CSF with csf -ra , but the command does not complete, it just hangs. I can abort it with CTRL + C.

In processes I can see

root 31617 4.0 0.0 169628 20944 pts/1 S+ 13:54 0:00 /usr/local/cpanel/3rdparty/bin/perl /usr/sbin/csf -ra

How can we resolve this...

I've noticed this error when the CC database is being updated:
CC Error: Unable to unzip GeoLite CSV Country database /etc/csf/zone/GeoIPCountryCSV.zip - timeout   

how do i go about resolving this?

Running Amazon EC2 (Amazon Linux) with a load balancer.

CSF has been running fine until today (some 1.5 years).
I logged in via SSH and ran the latest update for EC2.
Then restarted CSF - and https and sftp stop working worldwide.

Disable CSF - all good.

Turn CSF TEST MODE on - all fails.
- My understanding is LFD does not run when in test mode. So LFD not the issue.
I have flushed iptables,...

Hello. Well the cxs subforum looks sort of dead so I'll try this as a start, but maybe this is more appropriate for a ticket. I've read all I can stand about this and just am looking for some simple guidance on an IP block rule concerning the following.

I figured out how to tweak IP address blocking for modsecurity hits in CSF which was a huge help! Bear with me though.

OK so this access log...

I have a CentOS server with iptables rules in csfpost.sh . I want to restart CSF via a cronjob, but so far unsuccessful, I even tried to source all necessary env variables before restarting csf via cron, but still won't work. How do I restart CSF via crontab?