ConfigServer Community Forum

Hi There,
Can i use Ubuntu & cPanel and CSF ? Or i will face problems ..?

Thank you

Hey guys.

I have been using MailScanner for some time and have had few challenges improving its filtering.

One of these few challenges is being able to identify some messages correctly, my current challenge is.

Let's say I have a domain called
domain1.com hosted on MSFE.

I have received messages from outside the server with a falsified from header, they add the same recipient address to the...

I'm having difficulty with getting SMTP auth failures detected by LFD. I believe this is partially due to Postfix on Ubuntu not reporting the rhost in the /var/log/auth.log file. Here's an example:

May 14 14:05:27 myserver saslauthd : pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=someone@somewhere.com

The other way this can be obtained, is via...

Hello.
When I activate cfs and Fail2Ban, Fail2Ban does not send me detailed information like the one I attached in the email. When I disable cfs it sends.
VPS Server virtualmin for ubuntu 22.04

With CFS enabled

With CFS disabled

What setting should I do in cfs???
Please a help

I have the same problem. Why not add the option to the configuration, something like:
PROTECT_IPSETS = myset_1, myset_2
or another settigns file that contains the names of the list to be left alone at restart:

#FILE csf.ipsets_protected
myset_1
myset_2

I could do that in the main csf PERL file but on update the changes will unavoidably be gone.

Markku

I have a member on the server that uses google ads. Google is reporting http 500 error for the url's, even though they work fine. They are saying their IP(s) are being blocked. I downloaded a list of all of their IP's and CIDR's (about 300) and added them to the whitelist by editing the allow list. But the problem is still there. I found that if an IP is in the deny list and I add it to the allow...

Hello,

I'm reporting a persistent issue I've been experiencing with ZeroTier connectivity when the CSF is active on my Linux system. Despite my attempts to configure the firewall to allow ZeroTier traffic, ZeroTier does not function as long as CSF is active.

Here's what I've done so far:

I have allowed all UDP traffic in both UDP_IN and UDP_OUT sections of my CSF configuration.
I have opened...

Hi, Sarah.
Is there an option in MailScanner that could block emails that comes with nothing on the subject?

Regards,
Sergio

I'm clueless on what this means:
*ERROR* IPSET:
and what is to be done about it.

Alma Linux
csf v14.20

Appreciate some guidance.

thank you all!

Hello!

I have a problem if csf enable.
for example:

CSF ENABLE

dig @8.8.8.8 ns1.besthost.az

; > DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu > @8.8.8.8 ns1.besthost.az
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER > DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu > @8.8.8.8 ns1.besthost.az
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER > DiG...

Hello, I am a new CSF user. I am using Almalinux 8.9 and cpanel. I have successfully installed CSF. But I couldn't achieve my main goal.

I want to block all requests coming directly to my server's ip address. But I want to allow 3-4 ip addresses.
I allowed my own ip addresses in the CSF interface. And I entered 0.0.0.0.0/0 in the Deny field to block all other traffic. but this time the traffic...

Hello,

It would be great if I can avoid using file magic, because these days are many injected php script starts with PK for example, and CXS ignores it, based on the file magic. And they are spamming for example.

Is there any way to scan (and disable) any files which's md5sum is in the cxs.xtra? Now ignores it when the file magic tells it's an archive file (but with .php extension).

Regards,...

Hello!
Recently i've been facing a problem in multiple server, when you add an ip to csf.allow on the UI it'll be added to the chain normally until you restart csf and lfd.
After the restart most of the ips on csf.allow won't be on the allow chain, if I remove them and add again it'll be added until the next restart;
The search option identify the ip on csf.allow but won't find it on the allow...

Hi,
I have setup CSF on our server but we're facing some troubles with too many IPs being blacklisted.
Many IPs that our clients access their e-mail from (dynamic ip ranges) are getting listed in Spamhaus, and thus CSF is blocking their connection to the server. I've checked csf.blocklists file but every RBL entry there is commented, so it shouldn't be affecting this, right? Anyway, i tried...

Currently connection tracking blocks all ports even if you have CT_PORTS defined.

Similar to LF_SELECT, it would be great to have an option to only block defined CT_PORTS.

Thank you.

Hello,

I run CSF on a cPanel server. CSF has MaxMind GeoLite2 Country Database MM_LICENSE_KEY and CC_SRC = 1 set and working ok. Example:

csf -i 66.165.246.164
66.165.246.164 (US/United States/waytotheweb.com)

I use CC_ALLOW option to add a couple of countries I want to whitelist but the problem is I'm still getting those countries IPs blocked (in temporary block list).

Now I created a...

Hello,

After upgrading to Rocky Linux and latest cPanel install, they wont allow Host Access Control anymore. So, I am trying to block all SSH connection except allow IP in the hosts.allow:

=============================
ALL : 1.1.1.1 : allow
sshd : 1.2.3.4 : allow
sshd : ALL : deny
=============================

What rule in the CSF can be defined to achieve the above SSH to block all incoming...

I am a victim of (D)DoS attacks for at least 2 years now from a very persistent attacker. The attacks are coming from spoofed IPs and the attacks are so low that it isn't distinguishable from normal traffic according to my provider (Hetzner).
CSF is able to detect them and block it according to the logs from what I can see in the /var/log/syslog file as the attacking IPs are there. Yet CSF is not...

On March 22, I discovered that SOME emails to users on my server were being returned to senders. Some were definitely coming through, but some weren't. I ended up having to disable CSF, at which time hundreds of emails started to come in.

This problem didn't happen on March 21, so it was a new issue after I hadn't changed anything. So it had to be something automated.

These IPs were in my Temp...

I have CSF setup to only block IP access to service ports for which a block occurs.

When running csf -t, I see an entry for each service port that has been blocked, however, the port column shows an aggregate of the ports being blocked.

For instance:

csf -g xxx.68.22.155

Table Chain num pkts bytes target prot opt in out source destination

filter DENYIN 2 0 0 DROP tcp -- ens192 *...