ConfigServer Community Forum

Below is a sample of these recent attacks:
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- PCCz
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- zFlw...

Hello.

I've been trying to find out exactly what IS faststart. All I can find are references to how to start it or stop it. I can't find out within the csf configserver tech notes WHAT IT DOES?

What am I missing?

Thanks

I am attempting to lower my signal to noise ratio on LFD notices so they don't start getting ignored when I get them. For the most part I have done a decent job with the csf.pignore file for weeding out legitimate processes. However, I just got one for LiteSpeed Enterprise web server process itself, and I think it is too generic. If I ignore it as provided in the notice, I would be allowing...

Hey guys,

I'm currently trying to block all incoming traffic to my server that does NOT come from my CDN IP addresses, and I'm hoping to do that with some kind of Allowlist, while denying all others.

My only concern is that I use Atomic Secured Linux (Atomic Protector) for my mod_security rules, and I don't want to create any kind of conflicts that might exist when running two different...

Hello,

In CSF, SMTP AUTH FAILURE block the IP of user instead of USER LOGIN.

For example, a company with 10 users, if 1 of them do wrong auth failure, the IP of company is blocked.

I would like to block only the user and not the company.

Hello,
recently I used mysqltuner.pl to optimize MariaDB on my server.

Is it safe to change mailscanner database from MyISAM to InnoDB?

-------- MyISAM Metrics ----------------------------------------------------------------------------
Consider migrating 13 following tables to InnoDB:
* InnoDB migration request for mailscanner.mcp_rules Table: ALTER TABLE mailscanner.mcp_rules...

Hello,
we use CSF on several cPanel servers. It would be amazing, if CSF could send notifications as POST request to a specific URL with data in JSON, so we could gather it, store in a database and have option to display it in out customer management system and let customers whitelist (that is another part). As it is now - we receive emails and that is often very inconvenient and hard to automate...

I have validate an old server and a new server where will be installed update CSF.
It seems CSF regex.custom.pm almost completely blank.

An example:
# SECTION:OS Specific Settings
# Note: File globs are only evaluated when lfd is started
Is it automatic added settings when it is installed and restarted system like Linux and CloudLinux 8?

hi
i found bundle mailscanner version not include this fix
i patched file manually but can you update the at least at next version with this fix included ?
Thanks

We followed suggested steps to install CSF:

wget
tar -xzf csf.tgz
./install.cpanel.sh
I see it should be cd csf if you like t install.
/etc/init.d/csf restart is not executed. Which command should be set inside root access for cPanel?

The last steps is not working. How to manage this?

Hi,

I’m looking for some advice on how to achieve a specific configuration using CSF.

I have a server that is currently getting hammered by junk web traffic from a whole load of IP addresses all beginning 18.xxx.0.0/16 (where xxx can be any of about 20 values).

I had initially just blocked those ranges entirely in CSF but with it being such a wide block that’s not really feasible - we have...

Latest Debian 12

I use TMUX a lot, but lately it doesn't keep the sessions when you restart the server or if you are inactive for a long time.
I suspect it may have something to do with CSF.
Very annoying when you have configured many things.
Have to start from scratch every time.

Very grateful for help.

Hi there everybody thank you for this community and software Csf, like the title say:

Can I execute all features options of web user interface via CLI ?

Hi all,

I would like to ask if there is a feature in csf/lfd where if a user keeps running multiple queries from same IP to be banned and if I can adjust that?

I've got a website of a non profit organization with a large db and getting attacks from multiple IPs from a specific country.
I blocked the country but is a matter of time to use another country to keep going etc so this is not a...

Hi There,
Can i use Ubuntu & cPanel and CSF ? Or i will face problems ..?

Thank you

Hey guys.

I have been using MailScanner for some time and have had few challenges improving its filtering.

One of these few challenges is being able to identify some messages correctly, my current challenge is.

Let's say I have a domain called
domain1.com hosted on MSFE.

I have received messages from outside the server with a falsified from header, they add the same recipient address to the...

I'm having difficulty with getting SMTP auth failures detected by LFD. I believe this is partially due to Postfix on Ubuntu not reporting the rhost in the /var/log/auth.log file. Here's an example:

May 14 14:05:27 myserver saslauthd : pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=someone@somewhere.com

The other way this can be obtained, is via...

Hello.
When I activate cfs and Fail2Ban, Fail2Ban does not send me detailed information like the one I attached in the email. When I disable cfs it sends.
VPS Server virtualmin for ubuntu 22.04

With CFS enabled

With CFS disabled

What setting should I do in cfs???
Please a help

I have the same problem. Why not add the option to the configuration, something like:
PROTECT_IPSETS = myset_1, myset_2
or another settigns file that contains the names of the list to be left alone at restart:

#FILE csf.ipsets_protected
myset_1
myset_2

I could do that in the main csf PERL file but on update the changes will unavoidably be gone.

Markku

I have a member on the server that uses google ads. Google is reporting http 500 error for the url's, even though they work fine. They are saying their IP(s) are being blocked. I downloaded a list of all of their IP's and CIDR's (about 300) and added them to the whitelist by editing the allow list. But the problem is still there. I found that if an IP is in the deny list and I add it to the allow...