ConfigServer Community Forum

Almalinux 8 / Cpanel on VPS with 4CPU's, 8GB ram. My local internet is 1gb Fiber up and down.
When CSF is enabled (no CC_deny being used... new installation 2 days ago) the download speed is decreased by around 90%.
Watch the video and you'll see it happen.. EVERY TIME!!!

WHM 118.0.25
Almalinux 8.10.0 kvm
CSF 14.22, mailscanner 5.4.4 w/ MSFE 9.26

I have blocked the IP address 128.245.64.22 in CSF:
Table Chain num pkts bytes target prot opt in out source destination
No matches found for 128.245.64.22 in iptables
IPSET: Set:chain_DENY Match: 128.245.64.22 Setting: File:/etc/csf/csf.deny
Permanent Blocks (csf.deny): 128.245.0.0/16 # do not delete

And yet spammers...

I have an issue because every day I receive from lfd information about overload my server and logs shows me many connections from Microsoft adress IP. Manual block IP isn’t good because every day is another IP. In Csf I have set two parameters: CONNLIMIT 80;50,443;50 i PORTFLOOD 80;tcp;100;60,443;tcp;100;6 but it doesn’t work. Could you give me any suggest how to resolve this an issue?

I apologize if this is in the wrong area.

On ModSecurity I switched the ruleset from Comodo to OWASP, and now LFD isn't sending the Mod Security notifications to email.

LFD is sending out emails for other notifications.
Have restarted CSF & LFD, and ran csf -ra

Any suggestions are welcome on what to look at.

Thanks

Hi there,

would be very nice if LFD could ignore the files updated by (unattended) APT updates. It would make sense if LDF could ignore these files. When doing manual APT updates it's still ok if you get an LFD email about the system integrity but especially with the unattended updates it's sometimes quite scary getting a LFD email about your system integrity.

Any help to achieve this is...

I'm getting a version check that's telling me the versions of the RSForms mod_rsform and mod_rsform_list are old. It seems to be looking for version at least 3.3.3, but the current version of the module is 3.1.0, according to the RS Joomla site:

RSForm! Pro Module 3.1.0
With this module you can publish your form into a module (template position).

Same thing for the mod_rsforms_list module:...

Hello,

Due to some requirements, I can't use PT_USERKILL to kill process over PT_USERTIME / PT_USERMEM, I need to use custom script in PT_USER_ACTION to perform advanced checks.

However, I've seen that since I switched PT_USERKILL to 0, I keep receiving Excessive resource usage emails, no matter if PT_USERKILL_ALERT is set to 0 or 1.

How can I disable the Excessive resource usage email without...

Hello to CSF Community,

After migration to AlmaLinux 9 from CentOS 7 I suddenly met the problem with loading files by ftp (example from shell)
curl -u user:password ' -o /var/www/html/df/file1.zip
Result
curl: (7) Failed to connect to example.com port 21: Connection refused

When I stop only CSF service (lfd and iptables leave running as i s) - everything is OK, file will be downloaded by...

Hello

I have a few rules under regex.custom.pm.

Some are very important and I want to receive mail notification and other not so much so no need of notification.

Is there any way I can disable mail notifications for specific rules and keep temp/perm block working as expected?

It would also be cool if we can filter notifications by country.

Thank you

It seems there is a bug with IPv6 support. I installed CSF on an AWS Lightsail instance and in order to automatically obtain a public IPv6 address, AWS requires support for RA/SLAAC. With CSF turned on, the instance receives an IPv6 address on boot but then once valid_lft reaches 0, it falls off the interface and can't be renewed.

I have set:
IPV6 = 1
IPV6_ICMP_STRICT = 0
IPV6_SPI = 1

Operating...

As indicated:

Is there any guidance or roadmap from CSF on --gulp-- firewalld, or other, as RHEL seems to indicate these may be dropped in the next version.

Thank you.

Hi, forgive me if this has already been asked and adequately answered, but I haven't found it so far:

I'm new to DirectAdmin and ConfigServer and trying to configure everything properly. I'm confused because the server security check keeps returning:

You should consider disabling commonly abused php functions, e.g.:
disable_functions = show_source, system, shell_exec, passthru, exec, popen,...

I've seen some posts about using BLOCK_REPORT to customize when an IP is blocked. I'm looking for something that will allow me to execute a custom script whenever CSF identifies accounts exceeding processes, mem, time limits. I want to be able to kill certain accounts (based on their web hosting plan) via a custom script that will allow me to do further reporting/stats at the same time.

Is there...

Hello people,

There are a lot of questions on this forum regarding this, and I have read most of them. As is usually the case, I am receiving a huge amount of notifications from CSF, from a cron.php that the user of this server has placed and wants to run every 5 minutes. This process is legit, and we want to keep it running. The output is this:

Executable:

/home/virtfs/...

Hello,

I'm looking for a way to add entries to the global Whitelist and Blacklist of the ConfigServer MailScanner Front-End via command line or API. Currently, the only available method is to manually add items through the cPanel interface, which is manageable when dealing with 2 or 3 servers. However, when the number of servers increases to, for example, 10 or more, this manual process becomes...

OS: CloudLinux release 9.4 (Vladimir Vasyutin)
CSF version: csf: v14.21 (cPanel)

Hi,

I'm facing a strange issue where CSF is not blocking nor allowing IPs in Almalinux/CL 9.
If I add a temporarly allow like this, it creates an IPTABLES entry and it doesn't work (port 22 is not in TCP_OUT):

# csf -ta 12.34.12.34
ACCEPT all opt -- in !lo out * 12.34.12.34 -> 0.0.0.0/0
ACCEPT all opt -- in * out...

Hello,
After upgrading from Ubuntu 22.04 to 24.04, and while CSF+ProFTP server was working fine, now it doesn't allow to retrieve directory listing.
Any suggestions ?

Hello ,
I created a custom modsec rule that returns a 403 status code if there is a sql injection attempt, i want csf to block the ip that is triggering this rule by monitoring the log that modsec is logging in it , but it isnt blocking it at all
the log came up as either
/usr/local/apache/error_log or
/var/log/apache2/error_log

so in csf.conf i specified the MODSEC_LOG to be...

It seems LFD outputs its blocked messages (eg. Firewall: *UDP_IN Blocked* IN=eth0... ) to the system journal with priority 4 (warning), even when it's just blocking incoming traffic based on port number. This makes them gold-coloured in my TTY, but more annoyingly it gets spammed out to my VPS's emergency console standard output, putting out lines every few seconds. Is there a way to get LFD to...

Hello,

I am getting weird block mails everyday from ldf.

The title of the email is:

lfd on : :: (Unknown) blocked permanently

And the content is:

Time: Wed Sep 11 06:44:40 2024 +0300
IP: :: (Unknown)
Temporary Blocks: 48

Temporary blocks that triggered the permanent block:
Tue Sep 10 07:14:01 2024 (CT) IP :: (Unknown) found to have 32 connections
Tue Sep 10 07:44:01 2024 (CT) IP ::...