ConfigServer Community Forum

Hi,

I woke up and had 3500+ emails in my inbox from lfd with entries like:
(this is from the lfd.log) but emails contain same content just different format:
Jan 11 12:16:26 www lfd : *Suspicious Process* PID:2859 PPID:4762 User:www-data Uptime:2466 secs EXE:/usr/lib/apache2/mpm-prefork/apache2 CMD:/usr/sbin/apache2 -k start
Jan 11 12:16:31 www lfd : *Suspicious Process* PID:5401 PPID:14391...

I need to run a rule and a redirect ip to port more active when the csf this rule does not work, I tried to release the port more still did not work
my rule: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination MY_EXTERNAL_IP:80
iptables -t nat -A POSTROUTING -j MASQUERADE

if anyone has a suggestion and can help me thank you!

Since last night, I am getting loads of lfd alerts
Time: Sun Dec 22 08:01:31 2013 +0000
Account: dovecot
Resource: Process Time
Exceeded: 34326 > 2400 (seconds)
Executable: /usr/libexec/dovecot/dict
Command Line: dovecot/dict
PID: 24272 (Parent PID:7206)
Killed: No

is this another one we have to add to csf pignore where cpanel have buggered up dovecote again with their incessant fiddling or...

Hi,

Under WHM>>Service Status, LFD is down and I keep on getting email notifications saying:
lfd failed @ Sat Dec 21 00:27:40 2013. A restart was attempted automagically.

I checked /var/log/lfd.log and i got this error message:
Dec 21 00:27:41 lfd : *Error* Invalid configuration line, at line 64
Dec 21 00:27:41 lfd : daemon stopped

I checked /etc/csf/csf/csf.conf, and line 64 is this:
#...

It is gone, how can I reenable the button?

Regards

csf is not Blocking FTP when username matches,
when i make a failed login with just a random username then am blocked, but if the username matches but i put in a wrong password, im not getting blocked,

i use Proftpd

Thanks......

Hello:

Thanks so much for this wonderful software... I am using it at CentOS servers and I am recommending it to my IT friends...

I have a problem at Ubuntu server 12.04.

Configured CSF without problems... I have not included any IP at allow/ignore lists yet.

The problem is the IN port configuration does not apply well... I have:

TCP_IN = 21,22,53,80,8080,8081,30000:50000
TCP_OUT =...

Hi,

I was just wondering what the maximum number of interfaces is supported by CSF?

We have had a few strange occurrences where despite the overall rules (csf.conf) allowing certain ports, we had to add specific rules in csf.allow to permit access for ip addresses to the ports that were already permitted by TCP_IN and TCP_OUT.

This case I have observed on our server running CentOS 6.5...

Hello,

I've uninstalled and re-installed csf on my Centos 6.5 64-bit Build, using Webmin for a control panel. Once I had done that, I've had to manually start the firewall for csf.

I've tried chkconfig for csf and iptables, flushing iptables and adjusting the boot order, but nothing has worked so far.

I'd like this resolved as soon as it can be, so I can have it connected to the web again...

Hi,

I use CSF v6.02, and am trying to use csf.mignore to ignore mails from a particular user andrew . I have added the username andrew to csf.mignore as mentioned in the config server blog post (unable to post URL).

But, outgoing mails are still being reported from that account. Logs are as below:

==========
2013-03-21 09:00:01 1UIbLt-001Oi0-7M ;
close (IN);
chomp @mignore;
foreach my $line...

hello,

i have a linux vps server, cpanel and csf installed.

last week (08-dec-2013) csf updated automatically and after that i am facing a serious problem

as soon i restart or reboot the vps, all network services like httpd, mysql, bind, ssh, pop, smtp, exim stops or are not available to remote users.

can you please tell me if this is a CSF issue? please provide any help or suggestion

Hi,
After eneble CSF i can't send e-mail form webmail. How to fix it?

Hi i just installed csf and there use to be security levels low medium high, but i cant seem to find them now ?

I recently changed the security level from medium to high via WHM which is causing problems so need to change it back to medium.

I have looked everywhere but can no longer seem to find where to change the security level.

Any ideas?

Right now I have a big issue where I have tried disabling ip blacklists from the web by making the file blank, but it still seems to do something. I have post/pre scripts that do allow filters for OpenVZ and whenever the blacklist check comes, it overrides those rules or possibly clears then causing all vps's to go down . I have to do a restart or run the scripts manually to fix.

Need a way to...

hello-

I have two servers that time out while trying to connect to configserver-com when running csf -u (cant ping or wget either)
been this way for better than 12 hours.

are there any know connection issues at configservers end?

thanks-

Hello ppl I have a problem - I think :)

I manage a cloudlinux server with csf ... one of the emails I receive from ldf demon is the fallowing:

Time: Wed Nov 13 21:20:26 2013 +0100
PID: 28321 (Parent PID:28321)
Account: nobody
Uptime: 99 seconds

Executable:

/usr/local/bin/perl

Command Line (often faked in exploits):

syslogd -m

Network connections by the process (if any):

tcp:...

Hey all,
I'm trying to block apps such as dirbuster but it fails, here is my config:

LF_APACHE_404 = 10
LF_APACHE_404_PERM = 1
LF_INTERVAL = 60 (tried 120 also but failed)

Here is the log, tailored from CSF so the log file is the one already configured with CSF.

File does not exist: /home/XXXXX/public_html/s.php
File does not exist: /home/XXXXX/public_html/s.php
File does not exist:...

Recently started using CSF/LFD on a new server (physical) and so far it has been a real gem. Using the latest version 6.37 in a WHM/cPanel environment. Got hit today by a number of sshd login attempts, nothing unusual, but when they eventually went away I noticed that one of the blocked IPs keeps hitting the DENYOUT chain. As per:

# csf --grep 190.91.71.77
Chain num pkts bytes target prot opt...

Hi,

I want to set up this alert if the queue gets to 100. I was testing the alert and set it down to 40. Both cmq and exim -bpc tell me I have 44. What am I missing?

TIA!
Diane