ConfigServer Community Forum

It seems LFD outputs its blocked messages (eg. Firewall: *UDP_IN Blocked* IN=eth0... ) to the system journal with priority 4 (warning), even when it's just blocking incoming traffic based on port number. This makes them gold-coloured in my TTY, but more annoyingly it gets spammed out to my VPS's emergency console standard output, putting out lines every few seconds. Is there a way to get LFD to...

Hi,

We are getting lots of Process Tracking notifications for an executable and would like to add it to csf.pignore

/usr/local/cpanel/3rdparty/perl/536/bin/perl

What is the correct syntax to add this to /etc/csf/csf.pignore please?

Thanks very much

Michael

Hello,

I am getting weird block mails everyday from ldf.

The title of the email is:

lfd on : :: (Unknown) blocked permanently

And the content is:

Time: Wed Sep 11 06:44:40 2024 +0300
IP: :: (Unknown)
Temporary Blocks: 48

Temporary blocks that triggered the permanent block:
Tue Sep 10 07:14:01 2024 (CT) IP :: (Unknown) found to have 32 connections
Tue Sep 10 07:44:01 2024 (CT) IP ::...

I'm using this rule I pulled from the forum:

# BLOCKING LiteSpeed attacks by Sergio

if (($lgfile eq $config{CUSTOM4_LOG}) and ($line =~ /^\S+\s+\S+\s\ .*Failed Login Attempt \- username: (\S+) ip: (\S+)/i)) {
return ( $1 ,$2, SECMAS_LiteSpeed , 1 , 1 );
}

on my cPanel/Linux box. In CSF.conf, I have

CUSTOM4_LOG = /usr/local/lsws/admin/logs/error.log

and a sample log line is

2024-09-09...

Hello,

I get this email from my server:
Subject: Cron /usr/sbin/csf -u
Message: csf and lfd have been disabled, use 'csf -e' to enable

I logged in to WHM to enable again all connection become blocked, if I disable via SSH everything works fine.
I can't image what I have to do to work again, should I reinstall csf or how can I find the problem?
I did not changed anything for weeks, csf updated 5...

Hello Everyone :)

I hope you are well. I now manage numerous servers running WHM; and I have lately begun integrating config server security and firewall and login failure daemon to improve the security of these systems. While I have some familiarity with server management; I am new to the more advanced configurations and optimizations that CSF and LFD provide. I am seeking out this informed...

Hello dear community.
I wanted to ask if ConfigServer ModSecurity Control support LiteSpeed Web Server and Imunify360?

Hello,

After setup MESSENGERV3 when IP is blocked, return this error bellow on log, and show 404 page of Litespeed:

Failed to open : Permission denied

My csf.conf:

MESSENGERV3 = 1

MESSENGERV3LOCATION = /etc/apache2/conf.d/

MESSENGERV3RESTART = /scripts/restartsrv_httpd

MESSENGERV3TEST =

MESSENGERV3HTTPS_CONF = /usr/local/apache/conf/httpd.conf

MESSENGERV3WEBSERVER = apache...

In order to sort (some) compatibility with Docker and CSF we are working on an approach to allow docker to handle its iptables adding a chain on prerouting added in csfpost.sh

The problem is that for this to work we need to store all docker generated chains on each csf restart and reload them in csfpost.sh

For my surprise, csfpre.sh is not executed first on that process. CSF first clears all...

Hello everyone

Recently I'm receiving a lot of logs regarding spamd.
Do I need to worry about this?

Aug 21 05:57:24 cloud lfd : *User Processing* PID:270555 Kill:0 User:icaro Time:4337 EXE:/usr/local/cpanel/3rdparty/perl/536/bin/perl CMD:spamd child

Aug 21 06:01:24 cloud lfd : *Suspicious Process* PID:270556 PPID:269407 User:icaro Uptime:4577 secs...

Hello Guys,

I'm new to firewall/server configurations and I have a PCI scan result saying:

THREAT:
Your firewall policy seems to let TCP packets with a specific source port pass through.

IMPACT:
Some types of requests can pass through the firewall. The port number listed in the results section of this vulnerability report is the source
port that unauthorized users can use to bypass your...

Hi,

We have the following issues with Almalinux any suggestions?

# perl /usr/local/csf/bin/csftest.pl
Testing ip_tables/iptable_filter...FAILED - Required for csf to function
Testing ipt_LOG...FAILED - Required for csf to function
Testing ipt_multiport/xt_multiport...FAILED - Required for csf to function
Testing ipt_REJECT...FAILED - Required for csf to function
Testing...

Wondering if someone could explain how Mailscanner handles contact forms?
Probably a dumb question but I didn't find an answer from my searches.
Have been seeing an increase of copy paste stuff into contact boxes on some sites and wondering if using Learn as Spam would affect all the contact forms sent or just the content of the forms ?

Hi,

I'm encountering something I've never seen before. This is on a newish server running AlmaLinux v8.10.0 STANDARD standard
cPanel Version 120.0.14, with the full ConfigServer server package installed when it was brought online. When I check CMQ, it shows two messages in the queue for 92 days. CMQ seems to allow me to delete the messages, but they never actually delete. If I try to get details...

Greetings, within /etc/csf/lfd.pl, we have this little tidbit of code within the getlogfile section (between lines 2194 to 2248).

if ($totlines > ($config{LF_PARSE} * 1000)) {
my $text = *Error* Log line flooding/looping in $logfile. Reopening log file ;
logfile( $text );
if ($config{LOGFLOOD_ALERT}) {
my @alert = slurp( /usr/local/csf/tpl/logfloodalert.txt );
my @message;
foreach my...

How can we disable the passive mode that we had previously enabled as well as activate the SPI that we had disabled.
Thank you very much in advance for your help

The default CSF configuration files allow UDP in/out ports 20 and 21:

UDP_IN/UDP6_IN = 20,21...
UDP_OUT/UDP6_OUT = 20,21...

I believe this is a mistake. The FTP RFC defines it as a TCP-only protocol.

We were also unable to locate any implementation of ports 20,21/UDP in the field.

Viewing in WHM> ConfigServer Security & Firewall - csf v14.20 and it says enabled and also confirmed in lfd.log but it references mod_cloudflare which is no longer supported, so I'm using mod_remoteip. Is this integration still working? If so, how to verify?

Hello, every 5 minutes I receive this email. What I can do ? You never did this before and the configuration is the same as when you did it several years ago, I have not modified anything since then

Time: Wed Jul 10 10:31:06 2024 -0400
Type: LOCALHOSTRELAY, IPv4 localhost - 127.0.0.1
Count: 101 emails relayed
Blocked: No

Sample of the first 10 emails:
******

What I can do ?

Below is a sample of these recent attacks:
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- PCCz
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- zFlw...