ConfigServer Community Forum

Hello,

Tested on 3 servers. centos6 and centos7
if someone got banned for portscanning , his IP doesn't sent to csf.deny file. and of course you can't unblock it's IP or find it in /etc/csf/csf.deny , it just shows in /var/log/lfd that this IP is blocked.

However there's no way to unblock it by anyway because it doesn't in /etc/csf/csf.deny, and csf -tr doesn't work too.....and you have to...

Just thought I would post this here as it may help someone in the future.

I could not get LFD to start on 2 VPS's that had minimal installs of Ubuntu.

In the end what worked for me was installing sendmail.

Hi,

I am new to csf and lfd. I am facing a problem for last few days.

My server is sending emails to me with title Excessive processess under a user .

The email contents are following (replaced actual username with )

Time: Fri May 27 08:25:09 2016 +0530
Account:
Process Count: 31 (Not killed)

Process Information:

User: PID:31536 PPID:31534 Run Time:22(secs) Memory:391256(kb)...

OK so I set up CSF on centos, with webmin.

After enabling it and trying to access SSH with a VPN ip, I still get the login screen (and can still login).
When I try to access webmin via port 10000 I am however denied.

So what is the issue here? Why is the webmin port correctly blocked, but the SSH port not?
I am using a custom SSH port, is that the issue?

Hello guys,

Sorry im newbie, im builting CSF on CentOS 6.7. Now i want to create a user and that user can use CSF for unblock IP on server or do something to unblock IP without root user.
Can someone suggest me something to do?
:confused:

It's vital that we offer 3306 remote connection as a shared hosting provider, but at the same time, we expose ourselves to constant attacks which seem to have intensified recently.

As per forums.cpanel-net/f354/do-you-allow-remote-mysql-access-157645.html (renamed forums.cpanel-net as the forum wouldn't let me post links)

Adding:

mysql mysql -e select Host,User from user where...

Im currently running csf on centos and it's running well. The challenge is those damn brute forcers trying to get in on ssh.

They are basically running 3 attempts per ip then rotating. So csf sees attempt then blocks it, however by the time it blocks, they've already rotated to another ip.

In the normal Iptables I can simply do the following:
iptables -I INPUT 1 -p tcp -s exampleIP#1 --dport...

Hello,

The lfd won't start on a new cpanel DNS-Only server running CentOS 7.2. CSF installed with no errors that I could find, and the csftest.pl file shows OK for all tests.

Can anyone point me in the right direction for what might be wrong?

Here's output from the WHM Plugin page when I click the lfd Restart buttom:

Restarting lfd...
Job for lfd.service failed because a fatal signal was...

whilie restarting csf in WHM i get this error (this is a brand new install of WHM Cpanel)

open3: exec of /usr/sbin/ipset flush failed at /usr/sbin/csf line 4771

any ideas what i can do to fix this..

thanks so much :)

Good morning,

Occasionally we receive a dozen or so notifications from cPHulk that it detected a brute force attack and tried to block the IP. These messages all typically occur within a minute or two which doesn't make sense since we're set to apply a 15 minute temporary ban at first detection. Reviewing the cPHulk logs I see that iptables is often unavailable when cPHulk tries to update it....

I'm setting up a server keepalived, however they need to release the VRRP protocol, but do not know how in the CSF, and found nothing on Google for the subject. You can make this release the CSF?

Hello everyone!

I am receiving this type of logs. Is it something dangerous? Is anything that i can do?

Sorry for the stupid question but i am new.

Thank you!

is anyone reliably using this on ubuntu 16.04? on a quick search, the only thing I found regarding ubuntu 16.04 was a bug report:

thanks,

Andrew

I'm running csf on my debian 8 server to try to mitigate against login attacks. To give Apache and php5-fpm more memory we moved mysql to another server and I wrote additional iptables scripts to allow mysql traffic on the apache server and put them into
/etc/csf/csfpre.sh
/etc/csf/csfpost.sh
so that they would be included on startup. They are set with chmod u+x and have the required #!bash in...

While two vps are seemingly identically configured, one refuses ftp connection with the error message
port command failed and 500 I won't open a connection to 192.168.1... (only to 'external IP') and the
other works properly. What must be changed in CSF settings to make it work?

Hi,

Could you please help me to understand how (and if it's possible) to make CSF always allow connection to certain ports, like 80 for instance, no matter what. For example, in case Port Scan took place and CSF needs to block this IP/range of IPs, is there a way to make sure that blocked IP will still be able to use port 80?

Regards,
Ilia

I have noticed with recent updates that the GUI has become less user friendly and no longer sticks with general layout of WHM. Many issues such as missing home screen navigation links, large bulky buttons and text coupled with fixed width boxes really makes it difficult to actually see anything. The new fixed width layout leaves white space on half my screen and viewing log files is painful....

When ipv6 is disabled by Anaconda then we are seeing this in the LFD logs (Note that IPv6 is disabled in the csf.conf via IPV6 = 0 );

Unable to retrieve blocklist MAXMIND - Unable to download: Can't connect to www.maxmind.com:443 (socket: Address family not supported by protocol)

# cat /etc/modprobe.d/ipv6.conf
# Anaconda disabling ipv6
options ipv6 disable=1

# cat...

Hi,

I am trying to find out why i cannot access my owncloud server when CSF is running. I can use webmin on ports 10000 and ssh on 22 etc while CSF is running but apache won't serve pages over port 443 whilst its running.

Also It seams LFD cannot get out on port 80 either. I have enabled port 80 and 443 on incoming and outgoing tcp/ip rules.

Sep 19 07:01:51 BBSANFRAN lfd : Unable to retrieve...