ConfigServer Community Forum

I travel a lot and find myself at a location where the IP address allocated to me changes every few minutes/hours. I am struggling to enter the correct instructions in the WHM/CPanel firewall to allow an entire block of IP addresses. I would like to allow all IP addresses at :-
98.186.XXX.XX
&
172.56.xxx.xxx

How can I do this?
regards

Hello,
I'm new in csf and trying it.
According to I added to NL CC_DENY for a moment.
csf restart
But maillog still outputs
Mar 6 18:58:24 host postfix/smtpd : connect from unknown
Mar 6 18:58:31 host postfix/smtpd : warning: unknown : SASL LOGIN authentication failed: authentication failure
Mar 6 18:58:31 host postfix/smtpd : disconnect from unknown ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4...

Host: CentOS Linux release 7.9.2009 (Core)
cPanel: 108.0.11
CSF: 14.17

CSF runs for a while (days) then I get an e-mail that lfd is down (becase it can't restart csf). When I check csf, it is zombied. Almost any command that starts 'csf...' hangs. I can either kill it and let it restart, or I can do a csf -r (or a -f and -s) and wait 10 minutes for it to reload (There are a lot of blocks in the...

Hi,

What would be the reason the chkutmp process would be running at 100% cpu for hours?

Regards,
Tommy

Folks,

I had problems with the Country Code CIDR lists from DB-IP, ipdeny.com, or iptoasn.com.

The CIDR lists contained US IP Addresses for Google.com, Googleapis.com, YouTube.com and various ISPs.

I was blocking these Country Codes:

CN,RU,KR,TW,VN,BZ,HK,BR,UA,KZ,CO,AR,BY,KG,PE,VE,TH,TN,AM,BG,TR,DZ,EG,CL,IQ,AZ,AL,LA,NG

Best Regards,

Jim

Hi all,

is it possible to configure LFD to report SSH alerts only from unknown IP addresses or Mac addresses via email?

Disabling SSH login alerts completely is out of the question, as I really appreciate this feature. However, it is also annoying when I have to log in several times myself and end up getting spammed about my own logins.

Kind regards

Hi,

I changed the option: Spam List Skip If Authenticated = from the default no to yes and saved and this stopped all incoming emails from being processed and no incoming emails were delivered. Outgoing emails continued being delivered. Also the bulk list number increased but wasn't being processed and the logs showed MailScanner looping through the start up.

Postfix/Exim only: (yes/no)
If an...

I've raised my max memory setting to 768MB and my max RSS Memory Setting to 512. These are much higher than the default settings. On a Linux server those are pretty large chunks of memory for an application to use. Nothing else triggers an LFD warning except Wordpress websites and I get a warning on the 768MB and 512MB limits about once or twice a day running 4 relatively medium traffic Wordpress...

Usually, when logging in server, LFD sends out a notification, and it includes correct location of my IP. However, for some locations, the IPs are recognised as Russian, while I am sitting in Oslo, Norway :)

I haven't changed any setting in Country Code Lists and Settings part yet. The default CC_SRC=1, which is using MaxMind. Now, do I need to enter MaxMind License Key for using correct IP...

can the PT_USERMEM setting be set to a higher level that 1024 it states but we have a lot of big busy Wordpress sites that ofter hover around 2Gb per process and wanted to keep the alerts coming but at the higher rate...

Hello,

I have been running a server with the GUI active on ConfigServer Security & Firewall - CSF v14.17 for many years. I currently have a site running on it that has an SSL certificate on it:

When I tell Chrome to view the certificate, I see that it is issued to the common name of server.domain.com and is up to date. It has been using Let's Encrypt and operating for many years.

I currently...

Hello!
I am having many blocks on port 38950 (rdp)
the ip (177.206.81.190) is trusted, but it is dynamic.
what can be done to solve this blocking?

7695 Feb 10 07:53:18 node113498-nginx lfd : *Port Scan* detected from 177.206.81.190 (BR/Brazil/177.206.81.190.dynamic.adsl.gvt.net.br). 11 hits in the last 175 seconds - *Blocked in csf* for 3600 secs

Feb 10 07:51:26 node113498-nginx kernel:...

Hello,

MESSENGER was working on my server but now, isn't. I checked all the log/configuration and didn't find why. Is there any option to restore the values to default, rebuild the files, etc?

Thank you.

In the `lfd Dynamic DNS` config section I have three subdomains listed:

myHost1.ddns.net
myHost2.ddns.net
myHost3.ddns.net

I am using DUC IP on my home computer and have verified that my public DNS name is `myHost1.ddns.net` - yet my computer is not able to SSH to my server. The only way I can SSH in is if I add my home networks IP to the `Firewall Allow IPs`

How can I resolve this so I can...

Solved, Thx.

Not having to move to a new page for all actions would be nice. It would also be easier and helpful if there was a way to delete multiple previous scan reports if logged in the database at a time. Even a little popup box to confirm.

Please and Thank you.

Hello,

We have a disgruntled customer that specifically created an email address to subscribe it to spam lists/newsletters and then they set up that email address to forward all emails to one of our support emails, creating a large amount of spam that can't really be blocked by traditional means. The original senders are, more or less, legitimate and mostly legitimate newsletters, so I wouldn't...

Having the instant IP block is an awesome feature and we use it frequently for repeat offenders. But these days so many spammers are sending from multiple IPs from a single CIDR 24 block. It would be so cool to have two options to click to block. One like the current single IP block, and a second one right next to it that blocks the entire range, ie NN.NN.NN.0/24. We do this manually at times but...

Hi there

A new server with Cloudlinux installed, Installed CFS, but all messages are logged to the console, making the console unusable.

I have no idea what setting needs to be done for this to stop. Any help is appreciated, as I am sure I am not the only one. This was presented before here: (but no fix was provided)

screen looks like this:

Instructions I think how to block tor in /etc/csf/csf.blocklists by uncommenting this line (remove the #):
#TOR|86400|0|
and in /etc/csf/csf.conf make sure URLGET is set to use LWP then restart the firewall

We leave the ip=1.2.3.4 and don't change it to our server ip address?