ConfigServer Community Forum

Hello everyone,

I'm inquiring about the possibility of utilizing CSF to block all bots while allowing an exception for Google bots. Google has kindly provided us with a list of whitelisted IPs at the following links:

Googlebot IPs:
Special Crawlers IPs:
User-Triggered Fetchers IPs:
Google IPs:
I've attempted to research this on various forums but haven't been able to find a solution. Most...

Hello. We have a server with CSF that is not logging iptables blocks to var/logs/messages. Last iptables logs are from december. I tried to restart CSF but not works. I compared CSF configuration with other server that logs iptables well, but there is no differences.

Somebody knows what is happening?.

Thanks.

Kind regards.

lfd is checking to see if syslog is running on more modern systems that have moved on to using journald in place of syslog.

It is flooding my inbox with email:

Time: Thu Aug 24 10:11:05 2023 -0500
Error: Failed to detect code in SYSLOG_LOG

SYSLOG may not be running correctly on server.mydomain.com

I have changed the /var/log/messages entries in /etc/csf/csf.conf to correctly point to...

I am using CSF on Debian 11 server, I installed Wazuh agent and I opened ports 1514 and 1515 in TCP OUT in csf.conf and in csf.allow
restart the CSF by csf -ra, also I used csf -f m but the ports still clocked and I see this in syslog

Aug 24 11:46:16 dns kernel: Firewall: *TCP_OUT Blocked* IN= OUT=ens5 SRC=172.31.31.157 DST=X.X.X.X LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48959 DF PROTO=TCP...

Hello, I have seen other systems using csf and when your password is incorrect a certain amount of times it brings up a ban screen which you can then complete a captcha to unban. I have enter my captcha details and tried everything I could find on the web nothing works, currently when i get banned I just cant access my whm cpanel or server etc but I cant unban myself. Does anyone know why this...

I was trying to figure out why changes to blocklists and firewall configurations didn't seem to be taking effect. After digging into it more today, I think I have found a potential bug.

When restarting csf and lfd through csf -ra or through the web interface, the web interface reports back that CSF and LFD were restarted, however when checking the service status with systemctl status lfd.service...

I am getting tons of emails with this alert.
I have opened port 9993 and works but I am getting theese errors

How I can exclude this service or allow all traffic?

What ports does ZeroTier use?#

It listens on three 3 UDP ports:

9993 - The default
A random, high numbered port derived from your ZeroTier address
A random, high numbered port for use with UPnP/NAT-PMP mappings

That means...

Dear friends,
I have a VPS Ubuntu, I changed the default port ssh from 22 to 2222. I want to know, after I changed the default port ssh, Does CSF block the access if they were failed to login?

Here my setting: LF_SSHD = 5 LF_SSHD_PERM = 1

Normally, CSF monitor SSHD service or port?

Thank you so much!

Hantam

Hello! maybe someone can help me, tried googling but found nothing, I have CSF working perfectly fine but every now and then I have to access my server thru the VNC client from Virtualizor, the problem is that when I open the terminal this is flooded by CSF output (which I already disabled from the logs) making it useless, and afaik this shouldn't be happening, anyone knows how to fix this?
Any...

Hi,

My server is sending these alerts non stop every 30 mins:

Exceeded: 587970 > 1800 (seconds)
Executable: /usr/lib/systemd/systemd-resolved

Exceeded: 419968 > 1800 (seconds)
Executable: /usr/sbin/mariadbd

Exceeded: 587991 > 1800 (seconds)
Executable: /usr/bin/rpcbind

However, I do have these lines in the csf.pignore file. Shouldn't they be ignored for exceeding the time limit?...

Hello!

We are using csf on many of our servers, however, on one of our servers the Messenger service doesn't seem to work.
The server has cPanel and LiteSpeed. It also has BitNinja installed, but the problem happens even if we have the BitNinja service disabled.

Here is what we tried:

Switching to Messenger v1, v2 & v3
Uninstalled and reinstalled csf
Copied the csf configuration file from...

Hello,

I've just update a VM to debian 12 and LFD keeps saying that syslog in not running. I've checked syslog and the code is there. It seems it doesn't read log files at all. I don't receive login notifications or anything related to lfd reading log files.
I've activated the debug mode in csf.conf but it just says that it is parsing the different log files but always with 0 lines read.

I've...

Hello,

I was wondering if there's a way to configure CSF not to block IPs of failed login attempts to IMAP that aren't providing a username. I find that the majority if not all of this type of blocks happen to people with wrong settings configured (e.g: secure port with no encryption selected).

It looks like my CSF configuration is on a trajectory to permanently block the entire internet.

All of these blocks have been triggered because of LF_DISTATTACK.
All of the blocks so far are from SMTPAUTH failures.
In the past 4.5 days CSF/LFD has blocked 836 LF_DISTATTACKs and entered them into csf.deny.
99+% of the blocks are with a SetID=floyd or SetID=floyd@mydomain.com.

I realize that...

Hi community!

Simple question, Can I use scripts on Debian 11, iRedmail 1.6.3 thinking, iRedmail now works with NGINX and PostgreSQL / MariaDB to manage my mail server on iRedmail?

In MailScanner v9.23 when you Release (resend) a message to someone it indicates that it modifies the email header To: field but in fact it inserts a duplicate To: header which makes the message RFC 5322 non-compliant. Google automatically bounces these messages so they never get to the recipient. How do I fix this?

Hello,

In the past I've used the RelayCountry plugin in Spamassassin to create rulesets in our custom.cf to score certain countries higher when email has passed through servers within that country. Here's an example of the config from the Apache Wiki:

header RELAYCOUNTRY_BAD X-Relay-Countries =~ /CN/
describe RELAYCOUNTRY_BAD Relayed through China at some point
scoreRELAYCOUNTRY_BAD 3.0...

Hi,
Sarah.

Is there a way to get a list of all users that have enabled MailControl ?

I have about 8 users that have activated MailControl but they didn't write any email address to get the reports and I will like to know whom they are in order to turn turn off MailControl on their accounts.

Thanks,
Sergio

Hi

Repeated maillog entries of the following form were not detected when they should have been (obfuscated):

Jun 6 13:28:17 vps dovecot: pop3-login: Disconnected: Connection closed: read(size=984) failed: Connection reset by peer (auth failed, 1 attempts in 2 secs): user= , method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, session=

Log entries like this are rare.

CentOS Linux release 7.9.2009
cPanel...

This double not seems like an error:
»
csf.ignore - a list of IP's and CIDR addresses that lfd should ignore and not
not block if detected
«
at