ConfigServer Community Forum

Hello,
I am using whm with csf, csx, and i have zerotier on the server (www.zerotier.com).

From time to time, zerotier goes offline and cannot connect to its network.
To fix this, i stop csf, restart zerotier, it turns on, i turn back on csf. It works for a while.

I have enabled the ports in csf config.

What shall i try next to do?

Thank you

i setup rules/archive.rules file to archive all mail on one of my inbox with:

To: * sa@mydomain.com

and works! but only non spam mail is copied ! how to force all mail: low-spam and high spam, to be copied ?

thanks

Hi

very new to configserver and trying to figure it al out.

Getting loads of these in my logs, how can i block them?? cannot seem to find anything?
Thank you

Apr 18 07:19:18 submission-login: Info: Client has quit the connection (auth failed, 1 attempts in 20 secs): user= , method=LOGIN, rip=46.148.40.92, lip=removed, session=

Hello ALL,

I use centreon to monitoring my servers.

centreon client use SSH to connect to my other servers every 5 min to check process running for exemple.
So I receive email every 5 min...

Account: customuser
Method: publickey authentication
Log line:
.. Accepted publickey for customuser from ... ssh2: ...

Is there any method disable emails for this specific user/ip source ?

Thank you for...

LFD sends emails without Message-ID which causes gmail to flag ethese emails as SPAM

Refer

And with ongoing emails being generated by ldf, the spam rate originating from domain/ip goes high and eventually makes a negative impact on the reputation of the ip and domain

This is definitely a critical bug and needs to be addressed
Kindly treat this as critical to be addressed on urgent priority

Simple - Add a quick deny form to the top of the page or in the header.

Thanks! Have a great day!

That.Is.All.

Hi,
I have configured below settings in csf.conf
LF_HTACCESS = 5
LF_HTACCESS_PERM = 1
HTACCESS_LOG = /usr/local/apache/logs/error_log
PORTS_htpasswd = 80,443

This settings blocks the IPs which makes brute force attempts to password protected directories through http requests, apache logs :

AH01618: user not found: /manage/
AH01618: user not found: /manage/
AH01618: user not found:...

Hello.

I hope everyone is safe and healthy.

Using CSF on Centos server.

Love it. Here is a conundrum.

This ASN is microsoft: ASN8075

When I insert that into the csf to block, it blocks it no problem but also doesn't allow me to send emails to subsribers in that range - keep getting DNS request timeout.

So is there a way to block an ASN inbound from the scanners and such, but allow outbound...

Hi all,

I've got the X country in CC_ALLOW and want to bypass all checks and more specific the imap/pop3.
At the time being if someone fail to login for a few times it blocks the IP. I want not to blocked/checked at all from this X country.
Is that possible?

The CC_DENY_PORTS setting should only block access to TCP and UDP IN, but it applies to OUT as well.

In the description in the conf file, it informs TCP_IN and induces to think that it will be only for IN(put)

# This option uses the same format as TCP_IN/UDP_IN. The ports listed should
# NOT be removed from TCP_IN/UDP_IN
#
# An example would be to list port 21 here then countries listed in
#...

Every day we receive a message from RBL's checks informing us that no responses were received from some spam checklists.

The content of said message shows us several errors similar to this:

Error: open resolver;

The IP address at the end of the URL is an IP address that belongs to Cloudfliare.

This only happens with 2 of the 3 servers that I manage, in these 3 servers the RBL verification is...

If RU is added to the CC_DENY, CSF won't start, with error message:
Error: FASTSTART: (CC_DENY IPv4) [] . Try restarting csf with FASTSTART disabled, at line 5781

Hi, I have some issues using CSX.
When scanning the reports give me File path check failure: Permission denied. ERROR on all files.

the exact line is:

# Clamd Error for : /home/bsov/domains/somedomain.nl/public_html/img/logo2.png: File path check failure: Permission denied. ERROR

Also when I run the script from the shell I get the same error.

Also the CX control menu yields no results.

I...

I travel a lot and find myself at a location where the IP address allocated to me changes every few minutes/hours. I am struggling to enter the correct instructions in the WHM/CPanel firewall to allow an entire block of IP addresses. I would like to allow all IP addresses at :-
98.186.XXX.XX
&
172.56.xxx.xxx

How can I do this?
regards

Hello,
I'm new in csf and trying it.
According to I added to NL CC_DENY for a moment.
csf restart
But maillog still outputs
Mar 6 18:58:24 host postfix/smtpd : connect from unknown
Mar 6 18:58:31 host postfix/smtpd : warning: unknown : SASL LOGIN authentication failed: authentication failure
Mar 6 18:58:31 host postfix/smtpd : disconnect from unknown ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4...

Host: CentOS Linux release 7.9.2009 (Core)
cPanel: 108.0.11
CSF: 14.17

CSF runs for a while (days) then I get an e-mail that lfd is down (becase it can't restart csf). When I check csf, it is zombied. Almost any command that starts 'csf...' hangs. I can either kill it and let it restart, or I can do a csf -r (or a -f and -s) and wait 10 minutes for it to reload (There are a lot of blocks in the...

Hi,

What would be the reason the chkutmp process would be running at 100% cpu for hours?

Regards,
Tommy

Folks,

I had problems with the Country Code CIDR lists from DB-IP, ipdeny.com, or iptoasn.com.

The CIDR lists contained US IP Addresses for Google.com, Googleapis.com, YouTube.com and various ISPs.

I was blocking these Country Codes:

CN,RU,KR,TW,VN,BZ,HK,BR,UA,KZ,CO,AR,BY,KG,PE,VE,TH,TN,AM,BG,TR,DZ,EG,CL,IQ,AZ,AL,LA,NG

Best Regards,

Jim

Hi all,

is it possible to configure LFD to report SSH alerts only from unknown IP addresses or Mac addresses via email?

Disabling SSH login alerts completely is out of the question, as I really appreciate this feature. However, it is also annoying when I have to log in several times myself and end up getting spammed about my own logins.

Kind regards

Hi,

I changed the option: Spam List Skip If Authenticated = from the default no to yes and saved and this stopped all incoming emails from being processed and no incoming emails were delivered. Outgoing emails continued being delivered. Also the bulk list number increased but wasn't being processed and the logs showed MailScanner looping through the start up.

Postfix/Exim only: (yes/no)
If an...