ConfigServer Community Forum

Hello!

We use CSF on 30+ servers since very long time ago, always without any serious issues. Only a few months ago, randomly LFD process just stops (many servers affected), giving this message and error bellow:

Oct 4 09:52:20 sh1 lfd : iptables appears to have been flushed - running *csf startup*...
Oct 4 09:52:28 sh1 lfd : csf startup completed
Oct 4 09:52:28 sh1 lfd : *Error* csf reported an...

Hello,
i want to exclude a Country from blocklists.
Blocklists provide good protection but they have some false reports (specially in dynamic ips from ISP providers).
For this reason i want to exclude the Country with the most visitors.
I have try the CC_IGNORE but they not work.
Is any way to do this? I think is very useful feature.
Thank you

When a process exceeds the maximum execution time, the notification doesn't tell me what script was running. Anyway to get LFD to include the information? If not, any suggestions (other than modifying all my scripts) to log the execution time of all PHP scripts being executed on the server and include the script pathname?

Hi,

I am a bit confused about the structure of csf.pignore

How can I ignore a specific exe or cmd for ANY user and for a specific user ?

exe:/usr/sbin/proftpd - ignore proftpd for any user!?

user:bob
exe:/usr/sbin/exec1 - ignore exec1 for user bob?
exe:/usr/sbin/exec2 - ignore exec2 for user bob?

user:charlie
exe:/usr/sbin/exec1 - ignore exec1 for user charlie?
exe:/usr/sbin/exec2 -...

for many years i used this rules and it worked but recently i found it stop working, eg, i removed special port like 22 from csf config to block global access to this port, and added some IPs to whitelist csf.allow to able to access this port. only some IPs. everything worked as well but recently i found this port is open to all. i restarted csf, it fixed but after some days when i tested froma...

If you have a WHM/cPanel VPS and

mx is set to use a third party email provider such as Zoho or gsuite for email and
the VPS only sends outgoing email from web scripts, CSF/LFD and cpanel,
then is incoming SMTP actually required?

If not, how does one lock it down to help stop bots/hackers?

I fixed the issue... not sure how to delete this post though? Thanks

Hello, I have an idea and I'm wondering if it's practical. It would require CSF Firewall considering every access of a PHP page to be a login failure, even though there was no actual login.

My idea is simple. Almost all my sites are hand coded, so there does not exist (for example) a page named wp-login.php. I want to redirect all those requests for non-existent CMS or forum logins to a single...

I have upgraded to last CSF :

I'm very interested in adding https use to messenger which I use fine for years

Logs
Feb 27 18:45:31 web1 lfd : MESSENGER: Error starting HTTPS service: No SSL certs found in MESSENGER_HTTPS_CONF location
Feb 27 18:45:31 web1 lfd : MESSENGER: HTTPS service temporarily DISABLED

See in csf.conf

This option points to the file(s) containing the Apache VirtualHost...

Hello,

I can't find how to change the reCAPTCHA pages. I edited all at:

/etc/csf/messenger/

And restarted with:

csf -r
lfd -r

But changes didn't update. Any idea about how to do it?

Another thing, the unblock page only appear without the https.

It will be great to have a guide for this, thanks.

Apologies if this is not really a csf related issue, but notifications have been sent via csf with an issue that my webhost hasn't identified.

I believe from the below that I am experiencing the symptoms of an issue - that my site is not the cause of the issue .

Normal occurrence daily at around 8:34pm
server load . 27
memory used 39 . 36

During the day/night, don't see load above . 8
At...

please delete this post, problem was unrelated to CSF

Hi guys.
Thank you for support.
I was trying to open a port on 24001 but when i check with an external tool says its closed.
I have to setup anything instead of configserver security firewall?

TCP_IN= 20,21,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,2095,2096,1563,6100:6200,24001

I've had a number of failed FTP login attempts over night, but port 21 is not included in Allow incoming TCP ports
Niether is my secret sftp port number.

I'm at a loss how these login attempts managed to get through CSF.

(ftpd) Failed FTP login from 119.xx.xx.xxx (CN/China/Jilin/-/194.xx.xx.xxx.adsl-pool.jlccptt.net.cn): 3 in the last 3600 secs - *Blocked in csf*

CSF blocked them, but if the...

Hi,
I am seeing weird issue that CSF is blocking outgoing request on port 443 although its open in configuration. If I disable csf with -x then I can access the resource on that port over remote server .

Any thought where to look ?

EDIT: Its actually blocking most of the outgoing traffic, just noticed that even port 25 is blocked.

PS : Its centos 7, had already already stopped and removed...

so we use csf on one of our servers to test run it.
i noticed there was an option to show a ban page,

How does this work?

the issue is when a user gets banned from our servers they dont see no message to tell them about it, all they see is a messagee telling them the connection timed out, then i get people leaving thinking we are no longer there.
i want them to see some sort of messsage...

The setting LF_MODSECIPDB_FILE suggests /var/cpanel/secdatadir/ip.pag, but there's no such file in that folder. I also checked all the suggested folders in the setting, like /tmp, couldn't find ip.pag anywhere. But I did find cpanelusername -ip.pag in the folder /var/cpanel/secdatadir/

Is that the file LF_MODSECIPDB_FILE is asking for? If it is, how do I handle this situation? It appears that...

everytime we add an IP to /etc/csf/csf.deny to be blocked 10 minutes or so later it's been removed and can't workout what's remving it ? would there be any reason for this to happen.

I have been trying to get iOS Mail Push Notifications working. The first step was getting the expired certificate renewed.. After much work, that got done. But Push still wasn't working. I read here:

that I would have to ad port 2195 to TCP in CSF which I did, for both IN and OUT. But that hasn't helped. Is it possible there is another CSF configuration preventing Push Notifications?

Hello,

Today we have found CSF not working. It was simply not doing anything no matter what CLI commands I gave. So I uninstalled it and now I am trying to reinstall it. But it just remains stuck with this line:

*** USE_CONNTRACK Enabled

Is there a log where I could check what's the problem?

I mention that the initial problem might have originated from some rpm problems that (I hope) were...