ConfigServer Community Forum

Right now I have a big issue where I have tried disabling ip blacklists from the web by making the file blank, but it still seems to do something. I have post/pre scripts that do allow filters for OpenVZ and whenever the blacklist check comes, it overrides those rules or possibly clears then causing all vps's to go down . I have to do a restart or run the scripts manually to fix.

Need a way to...

hello-

I have two servers that time out while trying to connect to configserver-com when running csf -u (cant ping or wget either)
been this way for better than 12 hours.

are there any know connection issues at configservers end?

thanks-

Hello ppl I have a problem - I think :)

I manage a cloudlinux server with csf ... one of the emails I receive from ldf demon is the fallowing:

Time: Wed Nov 13 21:20:26 2013 +0100
PID: 28321 (Parent PID:28321)
Account: nobody
Uptime: 99 seconds

Executable:

/usr/local/bin/perl

Command Line (often faked in exploits):

syslogd -m

Network connections by the process (if any):

tcp:...

Hey all,
I'm trying to block apps such as dirbuster but it fails, here is my config:

LF_APACHE_404 = 10
LF_APACHE_404_PERM = 1
LF_INTERVAL = 60 (tried 120 also but failed)

Here is the log, tailored from CSF so the log file is the one already configured with CSF.

File does not exist: /home/XXXXX/public_html/s.php
File does not exist: /home/XXXXX/public_html/s.php
File does not exist:...

Recently started using CSF/LFD on a new server (physical) and so far it has been a real gem. Using the latest version 6.37 in a WHM/cPanel environment. Got hit today by a number of sshd login attempts, nothing unusual, but when they eventually went away I noticed that one of the blocked IPs keeps hitting the DENYOUT chain. As per:

# csf --grep 190.91.71.77
Chain num pkts bytes target prot opt...

Hi,

I want to set up this alert if the queue gets to 100. I was testing the alert and set it down to 40. Both cmq and exim -bpc tell me I have 44. What am I missing?

TIA!
Diane

Hello guys, I'm having a little problem, when active csf after a certain time my teamspeak server is turned off and this only occurs when the csf is connected.

If I leave off the server is turned on without a problem, what can I do to make the csf stop killing the process.

During the installation of this CSF appearing this error.

install.generic sh: line 323: update-rc.d: comando não encontrado
install.generic sh: line 324: update-rc.d: comando não encontrado
install.generic sh: line 325: update-rc.d: comando não encontrado
install.generic sh: line 326: update-rc.d: comando não encontrado
/etc/csf/csfwebmin.tgz -> /usr/local/csf/csfwebmin.tgz

ps.: I do not...

It appears that the ConfigServer firewall doesn't work on systems that call their ethernet ports something else besides eth0 and eth1.

Details:

I'm trying to use ConfigServer firewall on a DirectAdmin based system running on Dell Hardware.

The Dell Hardware names it's ethernet ports em1 & em2 instead of eth0 and eth1.

When I start the firewall the server no longer has access to the Internet,...

I am gettin the following error randomly and frequently when CSF is enabled:

If I disable CSF i dont get the error. Have you seen this before?

Hi can anyone tell me if there is a way to backup all the settings so when you install csf on another server you can just upload a file ?

CSF seems to block configproducts.php of WHMCS.

I see no reason for it. The configuration looks OK but with the firewall enabled; that part of WHMCS is not accessable... it just says waiting for... >

Anybody have a similar issue or a possible resolution?

Thanks very much!

Email User gets this response:

Diagnostic information for administrators:
Generating server: DBXPR04MB031.eurprd04.prod.outlook. com
Receiving server: emea01-internal.map.protection.outlook. com (10.47.216.25)

user@ourdomain. com

11/10/2013 1:31:03 AM - Remote Server at emea01-internal.map.protection.outlook. com (10.47.216.25) returned '550 4.4.7 QUEUE.Expired; message expired'
11/10/2013...

I looked through the csf.conf file and searched the forum but didn't happen to see if this was possible...

Is it possible to configure the emails being sent out to use the user account's GECOS field in /etc/passwd as the From Name in the email that is sent out? If not, can that be set manually somewhere?

I'm looking at this for email organization purposes (easier to identify a server owner by...

Since upgrading to WHM 11.40.0 (Build 6), LFD is sending me regular alerts about excessive resource usage:

Time: Mon Oct 14 07:16:29 2013 -0700
Account: dovecot
Resource: Process Time
Exceeded: 31883 > 1800 (seconds)
Executable: /usr/libexec/dovecot/auth
Command Line: dovecot/auth
PID: 30873 (Parent PID:30861)
Killed: No

and

Time: Mon Oct 14 07:16:29 2013 -0700
Account: dovecot
Resource:...

The update package does not work.
Csf-u command to get the following answer:
Oops: Unable to download: Can not connect to (timeout)
Ping the site works correctly

The X between letters were placed to prevent the post appears to contain links

root @ server1 # csf-u
Oops: Unable to download: Can not connect to (timeout)
root @ server1 # ping-c5
Configserver.coxm PING (85.13.195.235) 56 (84) bytes...

I have got alert form csf regarding suspicious file bc. pl on the server with the following content.

#!/usr/bin/perl
use Socket;
$iaddr=inet_aton($ARGV ) || die( Error: $!\n );
$paddr=sockaddr_in($ARGV , $iaddr) || die( Error: $!\n );
$proto=getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die( Error: $!\n );
connect(SOCKET, $paddr) || die( Error: $!\n );
open(STDIN,...

I am would like to use CSF to block all traffic from all ports from all ips except for ours and a client's.

There are a couple of threads that are close to this but not exactly the same. I want to do this correctly because I am concerned about locking myself out.

If there is anyone out there that could help me out I would appreciate it.

Thanks
Alex

Hi,

I have installed and used csf for a while now, and am thankful it worked so well from the get go. I just stumbled upon a problem that is stumping me.

My Virtuozzo based VPS server has 3 IPs, each on its own adapter: venet0:0, venet0:1 and venet0:2.

Any blocking action has effects on one of the IPs (the initially installed IP on venet0:0), but has no effect whatsoever on any of the 2...

Hi now and then i get an email saying Please use the following links to add to the black list: and says single IP then 24 and 16 can someone tell me where to add them please.