General Discussion (csf)

New Topic

2415 topics

Page 1 of 121
- Jump to page:
1
2
3
4
5
…
121
Next

Topics

Replies

Views

Last post

Custom REGEX rules for CSF.

Last post by sahostking « 05 Apr 2024, 07:56
Replies: 93
by Sergio » 21 Feb 2014, 13:55
1

…

6

7

8

9

10
Hi all,
this thread is to add working REGEX that we can share with the community. To add them to this sticky, you should have the regex working in your server, this thread is not intended to solve any issues related with no working regex, the intention is to give users of CSF REGEXs that could make CSF with more security options.

If you want to collaborate, please add your rule to this thread...
93 Replies

2503057 Views

Last post by sahostking
05 Apr 2024, 07:56
Resolving individual IP drop/accept in iptables

Last post by chirpy « 17 Apr 2010, 09:34

by chirpy » 17 Apr 2010, 09:34

If you have one particular IP address that is either dropped or accepted through the firewall that you think should not be, then you can use the new WATCH_MODE in csf.

Before enabling this option and using the CLI command to watch an IP address, check whether it is explicitly listed first using:

csf --grep 11.22.33.44

Where 11.22.33.44 is the IP address you're tracking. If that comes back...

0 Replies

25692 Views

Last post by chirpy
17 Apr 2010, 09:34
Server inaccessible with default installation

Last post by chirpy « 13 Mar 2009, 10:39

by chirpy » 13 Mar 2009, 10:39

So long as you use the default configuration and only change the TESTING parameter in csf.conf then csf should work.

If it doesn't, it suggests a problem with the server environment (kernel, iptables or in the case of a VPS, the host node configuration of the VPS).

If the issue appears to be broken iptables connection tracking in the kernel (e.g. blocking allowed ports such as port 80 for...

0 Replies

26389 Views

Last post by chirpy
13 Mar 2009, 10:39
Process Tracking and csf.pignore

Last post by chirpy « 17 Jan 2009, 15:46

by chirpy » 17 Jan 2009, 15:46

1. If you're seeing legitimate spamd processes on cPanel being reported and want to ignore them, the following can be added to /etc/csf/csf.pignore:

cmd:spamd child

Then restart lfd.

2. If you're seeing legitimate awstats processes on cPanel being reported and want to ignore them, the following can be added to /etc/csf/csf.pignore:

pcmd:/usr/local/cpanel/3rdparty/bin/awstats\.pl.*...

0 Replies

122208 Views

Last post by chirpy
17 Jan 2009, 15:46
VPS iptables problems

Last post by chirpy « 22 Jan 2007, 11:32

by chirpy » 22 Jan 2007, 11:32

If you get iptables errors when trying to start csf on a VPS then you most likely have missing iptables modules for your VPS.

If your hosting provider wants to know how to configure iptables correctly on a VPS server, then you should point them to this Parallels FAQ and have them follow it (plus to add ip_conntrack_ftp to the list of required modules):

csf requires at least these iptables...

0 Replies

52505 Views

Last post by chirpy
22 Jan 2007, 11:32
Is there a way to exclude one user from blocks in CSF?

Last post by ZaCherry « 26 Jul 2024, 22:37
Replies: 2
by ZaCherry » 19 Jul 2024, 09:26

Hi all,
Is there a way to exclude one user (or few) from blocks in CSF?

2 Replies

763 Views

Last post by ZaCherry
26 Jul 2024, 22:37
disable passive mode and enable SPI in csf v14.20

Last post by canbuyon « 24 Jul 2024, 19:30

by canbuyon » 24 Jul 2024, 19:30

How can we disable the passive mode that we had previously enabled as well as activate the SPI that we had disabled.
Thank you very much in advance for your help

0 Replies

506 Views

Last post by canbuyon
24 Jul 2024, 19:30
docker with disable iptables and csf firewall

Last post by alsur « 22 Jul 2024, 14:06
Replies: 1
by ale-ab » 25 May 2023, 07:03

Hello,
i try to use csf firewall with docker
i read some tutorial, and i create a working solutions but i have a small problem...

m S.O. is almalinux 9

of course i try to enable
DOCKER = 1
in csf.conf but doesn't work.

so i use this setings and work
nano /etc/docker/daemon.json

{
iptables : false
}

nano /etc/csf/csfpost.sh

#!/bin/bash...

1 Replies

3886 Views

Last post by alsur
22 Jul 2024, 14:06
Cloudflare integration

Last post by bacg « 18 Jul 2024, 21:54

by bacg » 18 Jul 2024, 21:54

Viewing in WHM> ConfigServer Security & Firewall - csf v14.20 and it says enabled and also confirmed in lfd.log but it references mod_cloudflare which is no longer supported, so I'm using mod_remoteip. Is this integration still working? If so, how to verify?

0 Replies

796 Views

Last post by bacg
18 Jul 2024, 21:54
Csf Block my whitlelist ip

Last post by Sergio « 17 Jul 2024, 01:33
Replies: 9
by Test blogger22 » 19 Jun 2024, 12:47

Hi
I have a very bad problem , i put some ip in csf.allow and even in csf.ignore but they still blocked by firewwall.
can anyone help me?

9 Replies

1400 Views

Last post by Sergio
17 Jul 2024, 01:33
Where does csf keep the list of blocked emails that are associated with IP address

Last post by Sergio « 17 Jul 2024, 01:03
Replies: 4
by ZaCherry » 23 Apr 2024, 10:31

Hi all,
Where does csf keep the list of blocked emails that are associated with IP address?
I remember on one of my previous csf installations I had the ability to see blocked emails and from which IP addresses these emails tried to connect but now I can't find it on this new server.

4 Replies

1551 Views

Last post by Sergio
17 Jul 2024, 01:03
lfd on server1.****.com: LOCALHOSTRELAY Alert for 127.0.0.1

Last post by yoandy « 11 Jul 2024, 19:03

by yoandy » 11 Jul 2024, 19:03

Hello, every 5 minutes I receive this email. What I can do ? You never did this before and the configuration is the same as when you did it several years ago, I have not modified anything since then

Time: Wed Jul 10 10:31:06 2024 -0400
Type: LOCALHOSTRELAY, IPv4 localhost - 127.0.0.1
Count: 101 emails relayed
Blocked: No

Sample of the first 10 emails:
******

What I can do ?

0 Replies

2541 Views

Last post by yoandy
11 Jul 2024, 19:03
How to block SQL injection

Last post by smedby2 « 05 Jul 2024, 07:03

by smedby2 » 05 Jul 2024, 07:03

Below is a sample of these recent attacks:
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- PCCz
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- zFlw...

0 Replies

2353 Views

Last post by smedby2
05 Jul 2024, 07:03
Can't upload files with FTP Active mode if CSF is enabled

Last post by benitomdq « 05 Jul 2024, 00:24
Replies: 2
by benitomdq » 01 Jul 2024, 23:12

I have this problem, maybe you can help me. I am not able to upload files via FTP with CSF active. If I deactivate it I can upload without problems.

My FTP client is very old and has no options. It is part of custom software. It only connects without SSL and uploads files in ACTIVE mode. That's why I can't put it in PASSIVE mode, which surely works. I already have the range of ports open for...

2 Replies

558 Views

Last post by benitomdq
05 Jul 2024, 00:24
LFD overly generic process notice, any way to weed out?

Last post by T313C0mun1s7 « 02 Jul 2024, 17:03

by T313C0mun1s7 » 02 Jul 2024, 17:03

I am attempting to lower my signal to noise ratio on LFD notices so they don't start getting ignored when I get them. For the most part I have done a decent job with the csf.pignore file for weeding out legitimate processes. However, I just got one for LiteSpeed Enterprise web server process itself, and I think it is too generic. If I ignore it as provided in the notice, I would be allowing...

0 Replies

3100 Views

Last post by T313C0mun1s7
02 Jul 2024, 17:03
pignore-syntax insufficiant - why ?

Last post by trueshanti « 30 Jun 2024, 00:00
Replies: 1
by trueshanti » 01 Nov 2023, 19:25

lfd warns me daily about a process i simply cannot teach csf to ignore:
Time: Wed Nov 1 20:08:44 2023 +0100
Account: www-data
Resource: Process Time
Exceeded: 146435 > 1800 (seconds)
Executable: /tmp/appimage_extracted_a3ed3648c2d4a42fcd239937c53130a2/usr/bin/coolwsd
Command Line: coolwsd --config-file=/tmp/appimage_extracted_a3ed3648c2d4a42fcd239937c53130a2/etc/coolwsd/coolwsd.xml...

1 Replies

7426 Views

Last post by trueshanti
30 Jun 2024, 00:00
Using CSF only as an IP address whitelist/blacklist...

Last post by TravvyTrav « 29 Jun 2024, 01:44

by TravvyTrav » 29 Jun 2024, 01:44

Hey guys,

I'm currently trying to block all incoming traffic to my server that does NOT come from my CDN IP addresses, and I'm hoping to do that with some kind of Allowlist, while denying all others.

My only concern is that I use Atomic Secured Linux (Atomic Protector) for my mod_security rules, and I don't want to create any kind of conflicts that might exist when running two different...

0 Replies

3246 Views

Last post by TravvyTrav
29 Jun 2024, 01:44
CSF - SMTP AUTH FAILURE - User block instead of IP block

Last post by info-bel « 24 Jun 2024, 09:03

by info-bel » 24 Jun 2024, 09:03

Hello,

In CSF, SMTP AUTH FAILURE block the IP of user instead of USER LOGIN.

For example, a company with 10 users, if 1 of them do wrong auth failure, the IP of company is blocked.

I would like to block only the user and not the company.

0 Replies

3153 Views

Last post by info-bel
24 Jun 2024, 09:03
With CSF active the port bandwidth drops drastically

Last post by alexg « 22 Jun 2024, 13:16
Replies: 3
by rogalde » 05 Dec 2023, 13:51

I have a VPS with Almalinux8, Cpanel and CSF installed and with a 600Mpbs port. I started experiencing speed issues with FTP uploads (because it limited data upload) and so to check the speeds from the server, I installed speedtest cli.

The results with CSF/LFD activated are:

Idle Latency: 9.79 ms (jitter: 6.93ms, low: 2.03ms, high: 24.56ms)
Download: 50.82 Mbps (data used: 60.1 MB)
363.07...

3 Replies

5093 Views

Last post by alexg
22 Jun 2024, 13:16
CSF regex.custom.pm when installed CSF

Last post by ghtwt655xu « 19 Jun 2024, 08:38

by ghtwt655xu » 19 Jun 2024, 08:38

I have validate an old server and a new server where will be installed update CSF.
It seems CSF regex.custom.pm almost completely blank.

An example:
# SECTION:OS Specific Settings
# Note: File globs are only evaluated when lfd is started
Is it automatic added settings when it is installed and restarted system like Linux and CloudLinux 8?

0 Replies

3271 Views

Last post by ghtwt655xu
19 Jun 2024, 08:38

New Topic

2415 topics

Page 1 of 121
- Jump to page:
1
2
3
4
5
…
121
Next

Return to Board Index

Forum permissions

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum