ConfigServer Community Forum

For whatever reason, When I RU is in CC_DENY, any IP in cidr 169.244.0.0/16 is getting blocked. I downloaded Maxmind's GeoLite2-Country-Blocks-IPv4 DB just to make sure it wasn't a mistake on their end and their DB classifies my 169 range as a US based cidr. I'm unsure what to do at this point, other than either manually adding all the RU cidrs to csf.deny which would most likely greatly affect...

Something has happened overnight and blocklists cant be downloaded.
lfd.log

Feb 6 07:20:36 server lfd : Unable to retrieve blocklist CSF03 - Unable to download: Can't connect to raw.githubusercontent.com:443 (Name or service not known)

I'm trying to switch over from the Comodo ruleset (Since they are dead now) to OWASP.
CSF/LFD is being used with CWP (Control Web Panel).

Need some help.

I use to get LFD notifications and automatic blocks when using Comodo, but now I get neither.

/etc/csf/csf.conf shows:

LF_MODSEC = 5
LF_MODSEC_PERM = 1
..
..
MODSEC_LOG = /usr/local/apache/logs/error_log

I tried changing it to...

I have the following port range open in TCP-OUT in firewall configuration 49152:65534
I'm trying to use ftp client to copy some backups on FTP, which cannot switch to passive mode.

Firewall: *TCP_OUT Blocked* IN= OUT=ens224 SRC=192.168.1.248 DST=192.168.1.203 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=10054 DF PROTO=TCP SPT=44083 DPT=55600 WINDOW=32120 RES=0x00 SYN URGP=0 UID=0 GID=0

The firewall is...

I changed from cPanel to CWP Control Panel and I am running the latest version of CSF and everything was fine until the otherday I could not access any domain on my server, yet I can access any IP on the server so when I need to access a domain I have to disable CSF.

I have my IP in csf.allow & csf.ignore and it is still blocking me on Port 80 and I cannot figure out why, anyone have...

None of the mail coming from my customers contact forms are being scanned. When I look at the email in Mailscanner FE it says Not Scanned at the top. Consequently my customers are getting a ton of spam delivered to their inboxes generated from their contact forms. I have searched endlessly but nothing is white listed that I can see that would cause this. The server's IP is whitelisted in CSF, but...

Hi,

I recently installed CSF with default rules in a cPanel/AlmaLinux with LiteSpeed.
When accessing a link like Safari keeps loading until error connecting...
If I disable CSF it works.

I can't find any logs about this issue... no logs for blocked or other issues, it just drops...

HI I enabled the web UI for CSF, getting connection reset by peer while doing a curl

The webpage at might be temporarily down or it may have moved permanently to a new web address.

ERR_UNSAFE_PORT

UI = 1

# Set this to the port that want to bind this service to. You should configure
# this port to be >1023 and different from any other port already being used
#
# Do NOT enable access to this...

Hi guys, I'm new here, but I've been using CSF for many years! Over 2024, there has been a surge in Internet attacks and I've recently discovered something with my CSF install that I think is weird and wanted your opinion and eventually maybe a suggestion to mitigate the issue:

In my config, I have:
LF_TRIGGER = 0
LF_APACHE_404 = 200
LF_APACHE_404_PERM = 3600 (1 hour)
LF_INTERVAL = 300 (5...

Hi,

I think CSF doesn't attention to allow list of IPs when we temporary deny an IP address
But it fails deny when we want to deny normally

Thanks

Hi, i already set email notification to off but seem like i still received notification like almost 1k per day.

May i know how to completely disable all the notification please?

Greetings. I have a Virtualbox with debian 12 freshly installed. I installed CSF but cannot access the UI.

Im following the tutorial at:

The output log of installing is as follows:

sudo sh install.sh

Selecting installer...

Running csf generic installer

Installing generic csf and lfd

Check we're running as root

mkdir: foi criado o diretório '/etc/csf'
'install.txt' ->...

Hi,

Dmesg is flooded by logs like:
OS=0x08 PREC=0x20 TTL=239 ID=54321 PROTO=TCP SPT=49541 DPT=8728 WINDOW=65535 RES=0x00 SYN URGP=0
Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=96:00:03:eb:25:ed:d2:74:7f:6e:37:e3:08:00 SRC=92.255.85.147 DST=138.199.144.66 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=64262 PROTO=TCP SPT=54582 DPT=3364 WINDOW=1024 RES=0x00 SYN URGP=0
Firewall: *TCP_IN Blocked* IN=eth0...

Hi there,

We allow remote MySQL access for specific IP adress, by adding a rule to the csf.allow file as following;

d=3306|s= #

This has been working fine for a couple of years now.

However, since a few days we got multiple complaints that MySQL access is blocked. When checking the logs I see these entries; indicating that the port is blocked. I have seen multiple cases of this, on...

After the most recent DA update (version 1.672). The Admin interface to MSFE gives this error and no other indication.

CSF was fixed by touch /var/lib/csf/csf.da.skip

Is there a fix coming for MSFE'?

We checked the issue with CS Mail Queue Plugin closer with one of our developers and were able to apply the workaround in the same way as it is applied for CSF PlugIn. Added this 2 lines:

unless (-e /var/lib/csf/csf.da.skip ) {
...
}

root@server:~# grep -R -A22 csf.da.skip /usr/local/directadmin/plugins/cmq/exec/da_cmq.cgi
unless (-e /var/lib/csf/csf.da.skip ) {
if ($ENV{SESSION_ID} =~...

I have CSF configured to block SMTP Auth attacks, syntax errors, and POP3/IMAP access attempts. However, none of those appear to be being blocked at present and only SSH attacks appear to be blocked. I've double checked my configuration and it appears to be correct, but it's like CSF is ignoring it. I installed the software with CPanel but that shouldn't be the reason for that I wouldn't think....

Hello to all,
For the last few weeks, when I try to install a WordPress from a cPanel account, I receive this error:
WordPress was installed with errors:
Downloading and unpacking
Impossible to download pack 6.7.1 from

If I stop or restart CSF, it work for a few minutes, but then block again.

In TCP_IN and TCP_OUT, ports 80 and 443 are listed.

What can possibly do this?

Thank you.

Hello ,

This is my first time here , i had joined today to discuss about many email alerts i am receiving since a week or so .

There is 3 types of emails :

1- It is titled by : lfd on *server name* : Suspicious File Alert‏
and contains :

File: /tmp/systemd-private-be537481d81d48b4b230533e9c529e32-ea-php81-php-fpm.service-teQo08/tmp/python3.61
Reason: Linux Binary
Owner: *website-username*...

hi,
i've a cpanel server with regex.custom.pm, but getting ignored and no block

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /^(\S+).* HTTP\/.* 403/)) {
return ( 403 bruteforce ,$1, block , 2 , 80,443 , 604800 );
}

CUSTOM1_LOG is
CUSTOM1_LOG = /var/log/apache2/domlogs/*/*
Access log with 403

1.1.1.1 - - HEAD /?play=ulti700?page=1&mqwsaWOeAy&cLLFTOZk59 HTTP/2 403 0 - Mozilla/4.0...