ConfigServer Community Forum

Hi, Sarah.
Is there an option in MailScanner that could block emails that comes with nothing on the subject?

Regards,
Sergio

Hi,

I hope you can help.

We are running new cPanel install on AlmaLinux via Lightsail Instance.

Configuration:
Access to WHM and cPanel is limited to single static IP
SSH port remains as 22
SSH root login disabled
The following services are enabled and working:
MySQL is bound to 127.0.0.1
2-factor authentication for WHM
Security Advisor: all in ‘green’
ImunifyAV: No malware found in scans...

I'm clueless on what this means:
*ERROR* IPSET:
and what is to be done about it.

Alma Linux
csf v14.20

Appreciate some guidance.

thank you all!

Hello!

I have a problem if csf enable.
for example:

CSF ENABLE

dig @8.8.8.8 ns1.besthost.az

; > DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu > @8.8.8.8 ns1.besthost.az
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER > DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu > @8.8.8.8 ns1.besthost.az
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER > DiG...

Hello, I am a new CSF user. I am using Almalinux 8.9 and cpanel. I have successfully installed CSF. But I couldn't achieve my main goal.

I want to block all requests coming directly to my server's ip address. But I want to allow 3-4 ip addresses.
I allowed my own ip addresses in the CSF interface. And I entered 0.0.0.0.0/0 in the Deny field to block all other traffic. but this time the traffic...

Hello,

It would be great if I can avoid using file magic, because these days are many injected php script starts with PK for example, and CXS ignores it, based on the file magic. And they are spamming for example.

Is there any way to scan (and disable) any files which's md5sum is in the cxs.xtra? Now ignores it when the file magic tells it's an archive file (but with .php extension).

Regards,...

Hello!
Recently i've been facing a problem in multiple server, when you add an ip to csf.allow on the UI it'll be added to the chain normally until you restart csf and lfd.
After the restart most of the ips on csf.allow won't be on the allow chain, if I remove them and add again it'll be added until the next restart;
The search option identify the ip on csf.allow but won't find it on the allow...

Hi,
I have setup CSF on our server but we're facing some troubles with too many IPs being blacklisted.
Many IPs that our clients access their e-mail from (dynamic ip ranges) are getting listed in Spamhaus, and thus CSF is blocking their connection to the server. I've checked csf.blocklists file but every RBL entry there is commented, so it shouldn't be affecting this, right? Anyway, i tried...

Currently connection tracking blocks all ports even if you have CT_PORTS defined.

Similar to LF_SELECT, it would be great to have an option to only block defined CT_PORTS.

Thank you.

Hello,

I run CSF on a cPanel server. CSF has MaxMind GeoLite2 Country Database MM_LICENSE_KEY and CC_SRC = 1 set and working ok. Example:

csf -i 66.165.246.164
66.165.246.164 (US/United States/waytotheweb.com)

I use CC_ALLOW option to add a couple of countries I want to whitelist but the problem is I'm still getting those countries IPs blocked (in temporary block list).

Now I created a...

Hello,

After upgrading to Rocky Linux and latest cPanel install, they wont allow Host Access Control anymore. So, I am trying to block all SSH connection except allow IP in the hosts.allow:

=============================
ALL : 1.1.1.1 : allow
sshd : 1.2.3.4 : allow
sshd : ALL : deny
=============================

What rule in the CSF can be defined to achieve the above SSH to block all incoming...

I am a victim of (D)DoS attacks for at least 2 years now from a very persistent attacker. The attacks are coming from spoofed IPs and the attacks are so low that it isn't distinguishable from normal traffic according to my provider (Hetzner).
CSF is able to detect them and block it according to the logs from what I can see in the /var/log/syslog file as the attacking IPs are there. Yet CSF is not...

On March 22, I discovered that SOME emails to users on my server were being returned to senders. Some were definitely coming through, but some weren't. I ended up having to disable CSF, at which time hundreds of emails started to come in.

This problem didn't happen on March 21, so it was a new issue after I hadn't changed anything. So it had to be something automated.

These IPs were in my Temp...

I have CSF setup to only block IP access to service ports for which a block occurs.

When running csf -t, I see an entry for each service port that has been blocked, however, the port column shows an aggregate of the ports being blocked.

For instance:

csf -g xxx.68.22.155

Table Chain num pkts bytes target prot opt in out source destination

filter DENYIN 2 0 0 DROP tcp -- ens192 *...

Hello everyone, I hope you are well!
I've been having problems with CSF for a few months, even though it's the only firewall working on a cPanel server, when using the rules below:

tcp,udp|in,out|d=2087|d=0.0.0.0/0
tcp,udp|in,out|d=2087|d=::/0
tcp,udp|in,out|d=2086|d=0.0.0.0/0
tcp,udp|in,out|d=2086|d=::/0
tcp,udp|in,out|d=2084|d=0.0.0.0/0
tcp,udp|in,out|d=2084|d=::/0...

So I turned on PT_All_Users option check and started getting excessive usages warning emails:

Time: Sun Mar 17 13:36:39 2024 -0500
Account: mailman
Resource: Process Time
Exceeded: 3155 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/python/2.7/bin/python2.7
Command Line: /usr/local/cpanel/3rdparty/bin/python2 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s...

We just ran updates on servers and now on multiple servers I have seen this issue. Customers are having issues connecting to ports that are only available with whitelisting. When I check IP's I see this

csf -g XXX.XXX.XXX.XXX

Table Chain num pkts bytes target prot opt in out source destination
No matches found for XXX.XXX.XXX.XXX in iptables

ip6tables:

Table Chain num pkts bytes target prot...

In the description for PT_LOAD_ACTION:

If a PT_LOAD event is triggered, then if the following contains the path to
a script, it will be run in a child process. For example, the script could
contain commands to terminate and restart httpd, php, exim, etc incase of
looping processes. The action script must have the execute bit an
interpreter (shebang) set

I'm pretty sure the last sentence means...

Every once in awhile, something on my server will get hung up and cause a temporary load spike up to about 10. And then every once in a blue moon, something will REALLY get hung up and cause a load spike up to 100!

I've always had CSF to email me when the load is over 6:

PT_LOAD = 30
PT_LOAD_AVG = 5
PT_LOAD_LEVEL = 6
PT_LOAD_SKIP = 3600

I'd like to keep that in place, but I'd also like to use...

On April 1st 2024, Google will implement a new pricing model that will significantly reduce the free tier usage of reCAPTCHA and introduce new prices for the reCAPTCHA Enterprise service.

A different firewall that we use has developed their own bot protection technology in preparation for this change, which will replace Google's reCAPTCHA.

Are there any plans to replace reCAPTCHA or support...