ConfigServer Community Forum

I've bunch of ips / networks added to csf.deny

csf.deny
1.1.0.0/19 # do not delete

However i want to allow 1.1.1.1 on port 80 and 443 with csf.allow

csf.allow
tcp|in|d=80|s=1.1.1.1
tcp|in|d=443|s=1.1.1.1

or

csf.allow
1.1.1.1

Allow rules above is not working.

- If i add IP adress to both csf.allow and csf.ignore it works but opens all ports which i don't want to
- Adding...

Does this error indicate a Zone file error? If so, what is the best way to correct it?
*ERROR* line:
Command:
Error:

This network is found in /var/lib/csf/Geo/ip2asn-combined.tsv & /var/lib/csf/zone/us.zone

Dear all,

I am using block_all_temp profile to temporarily block the IPs attempting a brute force attack. using this profile, it only allows me to block the IPs for 1 hour aftr this the IPs get unblocked. i want to customize this time to 5 min for example. so that, any IP trying brute force attack will be blocked for 5 minutes only. help will be grateful.

Hamza

Hi there,

With the High Load template for instance, there are set variables which don't seem to be documented.

This includes , , , , and however there doesn't seem to be a way to tweak them. For instance, we'd like to amend how ps is invoked (and likely include a 2nd copy of it, sorted differently), include iostat/sar reports and others.

How does one go about amending what the above variables...

Hi all,
I need help with Check Server Security configuration on cPanel VPS.
My VPS hosts mutliple Wordpress and various different Laravel CMS websites, along with some static content.

I need to know is it safe to do as Security says (disable) and will it impact my websites:
PHP Check
1. Check php for enable_dl or disabled dl()
2. Check php for disable_functions

Server Services Check
3....

I use Centos 7 and DirectAdmin have an issue with unblock adress IP. Validation recaptch works but adress IP still block.

In /home/csf/public_html/index.php file_put_contents doesn't work and unblock.txt and lfd_messenger.log don't create.
PHP Warning: file_put_contents(/home/csf/unblock.txt): failed to open stream: Permission denied in /home/csf/public_html/index.php on line 252PHP message:...

Hello, i want to know is this rule that i have wrote correct?
i mean that can we use source port and desteniation port after each other with same ip.
tcp|in|s=0_65535|s=x.x.x.x
tcp|in|d=(some specific ports)|s=x.x.x.x

Hi all,
I am rebuilding my infrastructure and those services facing the public, I am opting to use CSF instead of vanilla IPTables.

I am having a bit of an issue when CSF is active Bird2 is failing to work properly, I was wondering if anyone else has had this issue before and solved it.

The error I get is:
bird : ospf1: Socket error on enp6s0: Operation not permitted

Setup is Vultr VPS with...

Hi,

I've noticed that the cPanel disk usage emails sent to hosted clients were all marked as low spam.

The emails were sent from cpanel@local-domain-name with a client IP of 127.0.0.1 and tripped the KAM_MAILBOX2 rule with a score of 6.25.

The KAM_MAILBOX2 rule relates to Mailbox Quota Phishing Scams.

How do I stop internal cpanel emails from triggering this rule while keeping the score as...

Hi,

I'm regularly getting an email form cxs Scan saying it is scanning a file but then Clamd gives an error saying there's a File path check failure: No such file or directory. ERROR

cxswatch Scanning /home/username/public_html/wp-content/cache/db/singletables/c99:

then:

# Clamd Error for : /home/username/public_html/wp-content/cache/db/singletables/c99: File path check failure: No such...

My WHM server is nat with private ip in the 10.10.1.0/24 range. I am looking to block 2087 access over the internet

eth0 10.10.1.5 Main/shared IP for: admin and others x.x.x.x

In my csf.allow I have the following config tcp|in|d=2087|d=10.10.1.0/24
and in csf.deny I have the following config tcp|in|s=2087|s=0.0.0.0/0

However, I can access the WHM page over the internet, outside of my network....

Hi.
I have a list of 27 emails and using the option:
TO DOES CONTAIN email@address.com
shows that 12 of them contains the email address.

So, now I want to see the list of the ones that doesn't include that email address using:
TO DOES NOT CONTAIN email@address.com
and when I click VIEW EMAILS, it shows all the 27.

Just to give more information:
All the 27 emails contains about 12+ recipients....

Hello, I have been using Configserver on WHM/Cpanel on CentOS for years and recently moved to a new server with WHM/Cpanel on CentOS.

The file csf.conf keeps getting overwritten with what appears to be a default configuration. I make changes and safe via the UI in WHM/CPanel or I make changes via SSH and Emacs. Either way, after some time the file is replaced with a 'default' csf.conf that...

Hello everyone,

After googling for some time and not finding anything on this problem I'm asking here for some help.

I've setup remote logging for rsyslog on debian 11 and when CSF / LFD ist enabled, I get the following error for rsyslog:
(changed URL inside of the error message because of limitations)
Oct 30 16:54:08 SERVER85 rsyslogd : action 'action-0-builtin:omfwd' suspended (module...

I cannot reproduce this on any other servers, but am not sure where to go with this. LFD is detecting brute forces fine and logs that it is blocking the IP:

Oct 28 17:06:44 dalgarno lfd : (sshd) Failed SSH login from 112.95.75.195 (CN/China/-): 5 in the last 300 secs - *Blocked in csf*

However, the IP does not end up in IPTABLES nor does an entry get written to /etc/csf/csf.deny

I have...

I find csf will not check ip in list or not, if same ip for multi attack, csf will add multi times
I know we can't realtime to check ip list because it will slow down server, but can you add a function let us click on it and check ip list then remove duplicate one?

Thank you

As per CSF v14.17
SMTPAUTH_LOG= /var/log/maillog handles
.* postfix/smtpd : warning: unknown : SASL LOGIN authentication failed: authentication failure
but it does not handle
.* postfix/smtps/smtpd : warning: unknown : SASL LOGIN authentication failed: authentication failure
so for the latter lines you still need to use CUSTOM?_LOG and /etc/csf/regex.custom.pm

Hello all
I needs support. I am trying to protect the login to my application using regex.custom.pm
I added to /etc/csf/csf.conf > CUSTOM1_LOG = /var/log/apache2/my_log

log code

my.domain.com:443 1.1.141.25 - - POST /api/v1/hybrid/session/start HTTP/1.1 200 257 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

the code I made...

I wanted to take the time to come here to thank the developers of csf/lfd. I have been using it on many dedicated CentOS servers for years now and I never had a single problem. It's easy and powerful and I feel that my server are bulletproof!
I want to gradually switch to Debian and I was very happy to see that you also support this distribution.
Thank you very much for your great work!

PS: I...

We've been using this tool for years. Recently have set up a new server, migrated accounts, and tools including this one. But there is no activity in the logs. Don't have a clue where to look. The configuration looks identical.