ConfigServer Community Forum

I'm running CentOS v7.9.2009 with WHM/cPanel. I use Cloudflare and CSF with the Cloudflare extension.

A few weeks ago, my sites started throwing intermittent Cloudflare 520 errors. The server load was fine and there was nothing in the Cloudflare logs, but I saw tons of these in /var/log/messages:

Feb 5 20:12:08 xxxx kernel: Firewall: ICMP_IN Blocked IN=venet0 OUT= MAC= SRC=13.234.35.125...

I really much appreciated and want to thank you for the implementation of iptables-nft support.

As CPanel's Host Access Control dialogue on Rocky Linux 9.2 and WHM 114 showed errors I solved that by removing firewalld and installing iptables-nft. CSF and Host Access Control both work now without problems.

While reading about nftables I stumbled about the following Redhat documentation stating...

On April 1st 2024, Google will implement a new pricing model that will significantly reduce the free tier usage of reCAPTCHA and introduce new prices for the reCAPTCHA Enterprise service.

A different firewall that we use has developed their own bot protection technology in preparation for this change, which will replace Google's reCAPTCHA.

Are there any plans to replace reCAPTCHA or support...

Hi,

I'm trying to figure out what configuration setting within ConfigServer Security & Firewall is causing SMTP emailing with 3rd party providers (in our case Mailgun) from working... If I disable ConfigServer Security & Firewall then the email sending works fine.

WordPress SMTP Mail Log

Versions:
WordPress: 6.4.3
WordPress MS: No
PHP: 7.4.33
WP Mail SMTP: 3.11.1

Params:
Mailer: smtp...

Hello,

I see one IP address blocked on CSF:
# csf -g xxx.xxx.xxx.xxx
(...)
IPSET: Set:bl_CXS_LF_HTACCESS Match:xxx.xxx.xxx.xxx Setting:CXS_LF_HTACCESS file:/etc/csf/csf.blocklists
(....)

As I see on LFD log, the IP was blocked by LFD for htpasswd fail.

However, I'm unable to unblock it from SSH by csf -tr or csf -dr command. Which command I should use to unblock this IP address?

Thanks.

We have this error on direct admin csf install:

Security Error: Invalid parent
Information saved to

Contents of /var/lib/csf/da1709071834.error:

To disable DirectAdmin session checks, create a touch file called /var/lib/csf/csf.da.skip

Security Error: Invalid parent

Session ID =
Session File ...exists.

Environment data:
REMOTE_ADDR =
SESSION_KEY =
SESSION_ID =

Session data:
ip = []...

Hi
there is one of my accounts in the server that keep getting his IP blocked by the firewall because of multiple time failed logins to his email.. we tried to solve the issue by changing his passwords and removing his email accounts from all devices but it still its happening
is there a way to tell the firewall to not block this 1 account no matter what happen?? I tried to look around...

Hi,
either I don't know how to use it or csf.pignore is not working as it should, this is what I tried so far:

# stop monitoring wordpress breakdance /tmp files
dir:/tmp/systemd-private-*-ea-php*-php-fpm.service-*/tmp/
dir:/tmp/systemd-private-*/*
dir:/tmp/systemd-private-*
dir:/tmp/systemd-private-*-ea-php81-php-fpm.service-*/tmp/breakdance-ffea200c/twig-auto-generated-cache/*
and
# stop...

I’m getting a number of emails from CSF for “Suspicious process running under user ____” for Wordfence logs.

Command Line (often faked in exploits):
php-fpm: pool website_url

Files open by the process (if any):
/dev/null
/tmp/.ZendSem.NCrsJg (deleted)
/home/server/public_html/website_url/wp-content/wflogs/ips.php
/home/server/public_html/website_url/wp-content/wflogs/config.php...

Hi there,

for the geolocational blocking module for CSF, if I was to only allow the UK, Would this also include the south of Ireland (Republic of Ireland)?

Hello,
I have a new VM cPanel server runing AlmaLinux 8.9, and after installation of the CSF the server wont start after a reboot.
I have reinstalled the OS and cPanel multiple times, ad it runs fine until i instal CSF and than rebott the server.

I realy need advice in this problem.

Beste regards

Hello,
i want to use CC_DENY for block high risk countries, But I would like one of these countries to be enabled for only one specific user.
it's possible to do it ?

thanks

Hi,

What would be the reason the chkutmp process would be running at 100% cpu for hours?

Regards,
Tommy

i just ran the csf install script, nothing else. you know:

sudo wget
sudo sh install.sh

after 1 week i notice my ufw firewall is disabled!
i enable ufw, and a few min later, ufw is disabled again!
i remove csf, and the nightmare is over.

so what is happening here? does csf, even in testing mode disabled ufw? what a nightmare.
i repeat i did not change anything, i did not enable csf, testing...

I had an application level attack on a Wordpress site that brought the server to its knees. First time I've had this happen ever running about a half dozen small business websites. Configserver is loading multiple RBLs like FIREHOL, etc. I did a blacklist search and out of like 60 lists the IP only showed up on the Barracuda RBL. However the link to the actual RBL gives a 403 error.

The...

Does anyone use the connection limit protection or port flooding settings that doesn't have network level DDOS protection?

What would be typical reasonable settings for a server that is just running website applications that has maybe max 40 website users at any time plus bot scraping traffic and virtually no FTP and maybe one SSH session open at a time? Nothing else such as external MySQL...

I have that error if I put RU as blocked:

CC_DENY = RU,CN,UA,VN,BY,HK,IL,KZ,KP,SA,KR,SY,TH,TW,JP,ID,BR,AR,BD,CO,MA,SG,KR,ZW,AZ,PL,PY,SD,CI,EG,MZ,MX,PK,NP,TZ,MY,PE

Error: FASTSTART: (CC_DENY IPv4) [] . Try restarting csf with FASTSTART disabled, at line 5790 in /usr/sbin/csf

If I remove RU from CC_DENY list and restart csf everything is fine and work well

hello, I am experiencing a csf and cmm download error with wget and wget respectively.

Connecting to download.configserver.com (download.configserver.com)|94.130.90.175|:443... failed: Connection timed out.

my server does download other files via wget so i guess there is no problem with that, however i have a doubt if your firewall may be somehow blocking my server ip.
thanks.

Does this error indicate a Zone file error? If so, what is the best way to correct it?
*ERROR* line:
Command:
Error:

This network is found in /var/lib/csf/Geo/ip2asn-combined.tsv & /var/lib/csf/zone/us.zone

Hi,
I'm getting a lot of lfd on server: Suspicious File Alert , generated by Breakdance page builder for Wordpress.
Looks like this:
File: /tmp/systemd-private-3d4985084fd3401ca76423f2a737ddb8-ea-php81-php-fpm.service-PysP3o/tmp/breakdance-746d3b64/twig-auto-generated-cache/69/6935f4b89776a7d6e242d5319b554acd.php
The file is always different.

How can I exclude /tmp/ folder or disable...