ConfigServer Community Forum

Lately I've been getting heaps of these
GET /.env HTTP/1.1

generally 20 or 30 from a single IP address at a time (not the same IP address all the time or I'd block it).

Is there a way to immediately blacklist an IP that calls this GET request or to block all GET requests to /.env

Main Process: Unmatched [ in regex; marked by line 12

Get this error not sure what it is.

Keep having to restart lfd every hour on one server

Hey,

Just wondering if anyone knows where csf downloads the geoip databases to when it refreshes? Or is it just loaded into a memory stream?

I would like to reference it for another purpose if possible.

Hello

I have had CFS installed on one of my servers and it's been working great, but I keep running into problems where by if a client tries to access their email accounts from an IP other than the one they have been using normally, the IP address get blocked and they cannot access either their website or emails until I allow it on the server.

This has been happening for some time and I'm not...

Hi!,

I would like to open a port just for a user.

For example i have port 993 closed from outside to not permit users do access imap.

But i need to give permission to one user.

So, can i add this line to csf.allow to permit this?
tcp|in|s=993||u=1018

I already tried but doesn't work.

I there a way to do this?

Thanks

I have a bunch of DirectAdmin servers that have modsecurity installed through custombuild 2.0. I can't get CSF to block the denials by modsecurity and would appreciate some help with this. Modsecurity is working according to the audit log but some of the attacks are rather heavy and blocking in the firewall is preferred.

Specs:

Centos 6.8
Apache 2.4.23
PHP 5.4.45
Modsecurity 2.9.1...

I cannot decide which will I use for a cPanel server. Imunify360 or CSF? What makes Imunify or CSF better?

I have some blocking rules set up in csf.blocklists including a paid API key for IPDB with a limit set to 100000 (one hundred thousand). Can you give me some general guidance on other blocks to allow for my server? it is a fairly large VPS with 8 GB of Ram.

I am running a server to provide DNS to my public IP subnet. I want the server to be able to get NTP, OS updates, send email, etc, but only allow incoming tcp/udp/53 from my public subnet. My goal is to block all incoming requests and only allow DNS requests incoming from my subnet 1.2.3.0/24.

Since by default it blocks all and only allows ports I open, I believe it have the ports configured...

Message: CSF unable to detect disable_functions correctly inside Directadmin?

Hi, I still get this message after i installed CSF on my DirectAdmin based Almalinux8 server :-(

Were can i find more info te solve this asap?

Gr. Leo aka MacLeod

I have really weird issue i installed csf to a new server. when user run pm2 to run node app. it runs successfully as soon as the user logout of the cpanel the process disappear.

kindly note that this only happen with cpanel user if i run the command with the root and log out it will work fine

Hi, Is there a way to permanently set up an email to receive warnings about firewall attacks or problems that could endanger the system?
I'm new to ConfigServer firewall & security, so I need to share your experience.
Thanks!

Hey guys,
Is there a way to open DNS queries (port 53) globally, while still using CC_ALLOW_FILTER = US,CA for the rest of the ports?

We have some customers who's mail is getting blocked because servers outside of US/CA can't query the DNS to get the MX entries.

Hello,

LFD goes down after 5 minutes with no warning in the logs.

After a restart this works for another 5 minutes and goes to inactive again.

I'm using this on Cloudlinux 7.7 with Plesk Obsidian.

thor:/var/log# csf -v
csf: v13.07 (generic)

thor:/var/log# systemctl is-active {csf,lfd}
active
inactive

Thank You,

CC_ALLOW_FILTER not working.

# An alternative to CC_ALLOW is to only allow access from the following
# countries but still filter based on the port and packets rules. All other
# connections are dropped

OS: AlmaLinux 8.5 cPanel 102.0.14
also using it with Proxmox Virtual Environment 7.2.
Debian 11.3 Bullseye but using a newer Linux kernel 5.15.30,
QEMU 6.2, LXC 4

Both are using- CSF Version:...

Hello

I need to block all UPD traffic for one host on server. How can I do that ?

Regards

If I were to create an external include file for the csf.deny that listed the IP addresses, would I need to restart the csf service every time the external file was modified?

I would like to use a security detection script that monitors traffic on the website to write an IP to the external csf deny include file. I'd rather not get into execution permissions from a script if possible.

If csf...

I'm trying to figure out a way to add ip addresses to the csf.deny list by means of a php script.
My first approach was to directly write to csf.deny from my php script. But figured that it was better to use usr/sbin/csf -d x.x.x.x because the ip is then directly blocked.

But the above is not working.
Tried with shell_exec and some other commands too.

My php file has ownership root 4711

Any...

I'm running CSF on Centos 7.9 and in all of my domains I can receive emails from gmail in my webmail. Although from other providers like yahoo, outlook or iCloud I can not. Can someone please explain to me how to fix this?

Thanks

Hi,

I've recently setup the emails for csf/lfd and I started getting tons of emails coming through, but most of them appear to be false positives.

I've added the following rules to csf.pignore but they don't appear to be working as the emails for the very same reasons are still coming through even after restarting both CSF and even the entire server....