ConfigServer Community Forum

We are trying to block access to a web server when there is no user agent and not referrer. Example log lines look like this;

40.##.##.## - - GET /wp-admin/css/colors/Admin-Author.php HTTP/1.1 500 17551 - -

The code we put in regex.custom.pm is like this:

if (($globlogs{CUSTOM2_LOG}{$lgfile}) and ($line =~ / - - $/)) {
return ( No User Agent ,$1, UserAgent , 20 , 80,443 , 3600 );
}...

Hello,

We'd like to use the LF_APACHE_404 option to block IP's getting multiple 404 errors. The issue is it appears to be based on HTACCESS_LOG and that is set to /usr/local/apache/logs/error_log. Even if that was pointing at the access log, it's the main Apache log, not the hosted site logs. What would the side effects be if we change that to be /var/log/apache2/domlogs/*/* ?

Thanks in advance

Hi! Greetings from Mexico!

I've been using MSFE for several years, but each day spammers get more creative and resourceful, so I'm getting more and more spam every day.

Any tip or trick so MSFE can filter more spam?

Thanks!

Hello,

To spot some hacked websites and some virus, I'd like to have a log of all outgoing traffic on a list of specific ports. Is this achievable on CSF or I have to manipulate directly iptables?

Thanks in advance.

Hi.
I created an MD5SUM for index.html file and add it to cxs.ignore but CXS continues to show:

WARNING: '.../public_html/wp-content/uploads/ast-block-templates-json/index.html' scanned 6 times in the last 30 seconds, you might want to ignore this resource

I don't want to ignore the route nor the file name but I want to ignore the MD5SUM, Any idea?

Sergio

I have an AlmaLinux 8 server running CSF + LFD, using ipset for a larger corpus. Load looked very, very high, and I noted in the web server logs that IPs which were blocked in CSF were hammering some of my domains. So I did a systemctl status on iptables. It responded that iptables was dead . systemctl status csf showed that CSF was running.

I did a systemctl iptables start , and load plummeted...

At I see 2 buttons View lfd statistics and view system statistics.

These are not displayed on my CSF. (Installed on Debian12)
Is there something to be done at csf.conf ?

PS : I have a log issue (

Hi,

I recently added Abuse IP DB to my CSF blocklists file as I've seen an increase in web scanning, and all of the source IPs were listed on AbuseIPDB, so I figured it may be a good source to add to CSF blocklists..

I noticed some unwanted traffic this morning, and the IP was on AbuseIPDB, so I started digging and found that the csf.block.abuseipdb file in /var/lib/csf only contains around...

Are there any plans to release a version of MSFE that supports the webuzo panel?

Hi all,

Used the CC_DENY option to block AS16276 since some bots hosted there are hammering my site.

Noticed email to some users can no longer be delivered, seems that their mail server is hosted on AS16276 (mail.ovh.net).

Is there any solution to fix both problems? Continue to block AS16276 but allow mail to be delivered?

R=lookuphost T=remote_smtp defer (110): Connection timed out...

So we're running a Proxmox server with several LXC containers, Proxmox is Debian, and Containers are Centos 7. We install CSF on both the Host and the Containers.

We configured everything properly and running 'perl /usr/local/csf/bin/csftest.pl' under the container gives OK on all tests:

# perl /usr/local/csf/bin/csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing...

Hi,

I'm getting suspicious alerts for webalizer process like this for all users. I couldn't find anything suspicious.

USER 917236 0.0 0.0 272464 7172 ? SNs 06:38 0:00 /usr/local/cpanel/3rdparty/webalizer/bin/english -N 10 -D /home/USER/tmp/webalizer/dns_cache.db -R 250 -p -n DOMAIN.com -o /home/USER/tmp/webalizer /etc/apache2/logs/domlogs/DOMAIN.com.bkup

I have noticed that webalizer binary...

CSF or LFD do not detect failed logins via email and do not send report emails.
Hi, I've been using csf for a while now and I've noticed from the journal logs that there are several failed login attempts via pop and imap. It seems that these, unlike ssh login attempts, are simply ignored.
cat /etc/csf/csf.conf | grep mail.log
POP3D_LOG = “/var/log/mail.log”
IMAPD_LOG = ”/var/log/mail.log”
The...

we have written rule in csf allow to only allow connection to port 25 from server ip but we are being able to telnet to this port from another ip

rule is written in csf.allow

tcp|in|d=25|s=server ip

tcp|out|d=25|server ip

our intention is only the server should be able to send and receive mails that is we created mail and from cpanel we login into mail and from there only we should be able to...

I have a web site that I do not want to be accessed from outside of our local network.

It resides on it's own IP address, so I used the Deny Server Ips feature to block all traffic on it's public IP.

But I can still access it from anywhere.

I notice that the purpose of this feature is to allow blocking of all traffic on server configured IP’s if they’re not in use .

Does that mean that if an...

One of client informed me that, he is unable to access their site hosted in my server. I then accessed their PC using anydesk, their IP was in firewall whitelist still they were unable to access. I then stopped the firewall using command line and it started working, then started the firewall and it stopped working again. I then stopped CSF and started the firewall from WHM menu and then it was...

Since the Comodo ruleset is dead, I'm trying to switch over to OWASP.
Mod_Security & the OWASP ruleset are installed on a CWP server.

But when I do, LFD doesn't send the email alert or add it to the csf.deny

CSF setting are:

LF_MODSEC = 5
LF_MODSEC_PERM = 1

I have tried different paths of MODSEC, the default is:
MODSEC_LOG = /usr/local/apache/logs/error_log
and
MODSEC_LOG =...

For whatever reason, When I RU is in CC_DENY, any IP in cidr 169.244.0.0/16 is getting blocked. I downloaded Maxmind's GeoLite2-Country-Blocks-IPv4 DB just to make sure it wasn't a mistake on their end and their DB classifies my 169 range as a US based cidr. I'm unsure what to do at this point, other than either manually adding all the RU cidrs to csf.deny which would most likely greatly affect...

I'm trying to switch over from the Comodo ruleset (Since they are dead now) to OWASP.
CSF/LFD is being used with CWP (Control Web Panel).

Need some help.

I use to get LFD notifications and automatic blocks when using Comodo, but now I get neither.

/etc/csf/csf.conf shows:

LF_MODSEC = 5
LF_MODSEC_PERM = 1
..
..
MODSEC_LOG = /usr/local/apache/logs/error_log

I tried changing it to...

I have the following port range open in TCP-OUT in firewall configuration 49152:65534
I'm trying to use ftp client to copy some backups on FTP, which cannot switch to passive mode.

Firewall: *TCP_OUT Blocked* IN= OUT=ens224 SRC=192.168.1.248 DST=192.168.1.203 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=10054 DF PROTO=TCP SPT=44083 DPT=55600 WINDOW=32120 RES=0x00 SYN URGP=0 UID=0 GID=0

The firewall is...