ConfigServer Community Forum

Hi,

I recently installed csf on CENTOS 7, however it, it seems it is not able to block postfix/smtpd sasl auth errors.
Here is the log from /var/log/maillog

Sep 15 14:31:06 LinuxServer postfix/smtpd : warning: hostname mobiup.climberjumbo.com does not resolve to address 141.98.9.195
Sep 15 14:31:06 LinuxServer postfix/smtpd : connect from unknown
Sep 15 14:31:07 LinuxServer postfix/smtpd :...

Hi

How to troubleshoot this problem when the lfd does not start after the installation?

# service lfd restart
Job for lfd.service failed because the control process exited with error code.
See systemctl status lfd.service and journalctl -xe for details.

journalctl -xe
--
-- The unit apt-daily.service has successfully entered the 'dead' state.
Sep 12 20:31:31 ts systemd : Started Daily apt...

I get that CSF acts as a firewall for the server and can thus help to protect against attacks on the server.

However, will it help prevent a DDoS attack on a domain/website (specifically a forum) residing on that server?

I can't figure out how to ignore this folder which is in the server tmp folder. This is a wordpress plugin called zip recipes. It generates these cache files constantly, so I get an email every few minutes. Here is what I tried below. Any ideas on what I am doing wrong?

lfd Suspicious File Alert

Time: Tue Sep 10 11:00:43 2019 -0400
File:...

Hello!

We use Cloudlinux 7.7 and cPanel with latest CSF version.

We are no longer able to access CSF or to run any commands. Tried restarting CSF with csf -ra , but the command does not complete, it just hangs. I can abort it with CTRL + C.

In processes I can see

root 31617 4.0 0.0 169628 20944 pts/1 S+ 13:54 0:00 /usr/local/cpanel/3rdparty/bin/perl /usr/sbin/csf -ra

How can we resolve this...

I've noticed this error when the CC database is being updated:
CC Error: Unable to unzip GeoLite CSV Country database /etc/csf/zone/GeoIPCountryCSV.zip - timeout   

how do i go about resolving this?

Running Amazon EC2 (Amazon Linux) with a load balancer.

CSF has been running fine until today (some 1.5 years).
I logged in via SSH and ran the latest update for EC2.
Then restarted CSF - and https and sftp stop working worldwide.

Disable CSF - all good.

Turn CSF TEST MODE on - all fails.
- My understanding is LFD does not run when in test mode. So LFD not the issue.
I have flushed iptables,...

Hello. Well the cxs subforum looks sort of dead so I'll try this as a start, but maybe this is more appropriate for a ticket. I've read all I can stand about this and just am looking for some simple guidance on an IP block rule concerning the following.

I figured out how to tweak IP address blocking for modsecurity hits in CSF which was a huge help! Bear with me though.

OK so this access log...

I have a CentOS server with iptables rules in csfpost.sh . I want to restart CSF via a cronjob, but so far unsuccessful, I even tried to source all necessary env variables before restarting csf via cron, but still won't work. How do I restart CSF via crontab?

Hello,
Tried to open a specific port (5200) for an application API. Included the port in the allowed list in csf (csf.conf) and still the port is listed as closed. Looked everywhere for information, even tried to add it to public ports via firewalld, still no success (CentOS 7, cpHulk disabled etc.).
lsof -i doesn't show it as listening, neither netstat -na |grep 5200 shows it.
iptables-save |...

Hello,

Seems like csf blocks LDAP.
If i disable csf everything works.

I've added at TCP_IN port 389 but still nothing.

Any ideas on how to resolve this?

Thanks in advance.

Hi there,

I'm using CSF with DirectAdmin and i keep getting bruteforces on the service exim1 and exim2.
I've already deactivated port 465 and 587 since we don't use it inbound/outbound, but port 25 cannot be deactivated in our case.

Is it possible to allow port 25 inbound only for our 2 spam filter IP's?
Tried to do it in CSF, but can't find the option to do so.

Kind regards,
Justin

Hi,

I setup MAILX via gmail for notification alert sending.

How to use this to send CSF alerts too ?

Hi guys.

Fantastic product by the way.

I want some host to be excluded from the RELAY ALERT I'm receiving. These are the IP of my mail filters. I don't want to increase the RT_RELAY_LIMIT so I can keep alerted if another IP is abusing.

Here is the alert I'm receiving:
Time: Wed Jun 12 10:47:22 2019 -0400
Type: RELAY, Remote IP - 144.217.xxx.xxx (CA/Canada/xxx.xxxxxxxxx.net)
Count: 101 emails...

I have a VPS running CentOS 7 and CSF/LFD installed under the Webuzo management system.

I'm trying to prevent the following example (seen in /var/log/exim/main.log)

2019-09-02 17:00:04 dovecot_login authenticator failed for (eusfjgjxli.com) : 535 Incorrect authentication data
2019-09-02 17:00:28 dovecot_login authenticator failed for (eusfjgjxli.com) : 535 Incorrect authentication data...

hello
he has a problem
The site does not send mail
But when you disable *ConfigServer Security & Firewall*
Mail works normal
I use Gmail SMTP

Hi,
I installed CSF Messenger. Everything seems fine. Recaptcha page is working too. When you validate with clicking i'm not a robot button, it says ok.

But when I click Unblock button after that it shows an error.

There has been a problem: Unable to verify with Google reCAPTCHA

I tried almost everything, but it doesn't validate somehow. What could be the problem?

Hi,

We've been having some issues the last couple months with quite a few servers, suddenly ssh is open and we are receiving reports of tons of root login attempts.

reloading csf with 'csf -r' OR rebooting resolves the issue

an nmap of the server will show all ports open, as if no firewall is running at all

csf continues to write to the log showing it is blocking IPs, but it does not appear...

I was thinking about also using PSAD on my server in conjunction with FWSnort (which converts a bunch of snort rules into IPTables rules).

If using UFW then extra steps need to be taken for the two to play nicely together ( ).

I'm just wondering if the same applies to CSF? I can find no mention of using the two together either on here or on the PSAD website. Does anyone here use the two and if...

Could someone kindly point me in the direction of more information regarding the MySQL Data Collection feature? It looks like an interesting feature, based on the description in the config, but it doesn't provide much detail and I'm having configuration challenges.

ST_MYSQL =
The following options are for authentication for MySQL data collection. If the password is left blank and the user set...