ConfigServer Community Forum

Hi, i have created a phpmail script that uses smtp auth, when the firewall is disabled the script works fine and the email arrives to the user, but when i enable the firewall the emails are blocked

This is what i found on the log file /var/log/messages
Jul 28 09:08:27 core kernel: Firewall: *TCP_OUT Blocked* IN= OUT=enp5s0 SRC=10.45.18.66 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=50199...

greetings...

I have tried multiple times this week to unblock various ip's. When I enter an IP in the Quick Unblock field I get not found in csf.deny

Taking the same IP and doing a Search brings up the listing in csf.deny. Trying to unblock from the search result page also fails with the not found in csf.deny error.

so then I have to go in and manually locate the IP and delete.

I am unable to run csf -u successfully as I keep getting an error:
Unable to download: Protocol scheme 'https' is not supported (IO::Socket::SSL not installed)

- The 'box' does not have an SSL certificate.
- I followed other suggestions:
- installing libwww-perl and LWP-Protocol-https. It was already installed and up to date.
- csf -a 85.10.199.177

Any other suggestions?

Hello,
is there is any way to block ranges of that IP automatically by CSF that is being listed in csf.deny file ?

Hi,

In one of the servers that we manage, we don't want to run any mail server. When we setup CSF and start it, lfd is stopping soon after it has been started. We removed SENDMAIL path line from csf.conf and restarted csf. Still lfd wouldn't run.

------------------------------------ lfd.log entries --------------------------
Jul 25 00:00:02 localhost lfd : Unable to send SENDMAIL alert via []:...

Hello

using CentOS 6.
using csf v9.07

I notice that certain traffic is being blocked, although it should be accepted.

First,
In file csf.allow I have listed the IP-adres of server.mydomain.tld

Second, I have firewall config :
TCP_OUT = 0:65535
UDP_OUT = 0:65535

But when I make command :
scp -2 -i ~/.ssh/id_rsa /root/backup_db.sql.gz MyUser@server.mydomain.tld:/home/MyUser

I get :
ssh:...

Hi, I recently installed CSF as per instructions and set testing mode to 0 and also for safety sake added my IP address to allowed and ignore (for LFD).

As soon as I ran restart using cfr -R I got booted from SSH session and my WHM, CPANEL, sites, DNS, Mail and everything went down. I could not access the IP of the server for any services form any location.

I am in the process of restoring a...

Hello, anyone please can help me with this... Do i have been attacked? I have this log, and you can see from a lot of diferent IPS and they are try to connecto to several Ports.. What Can I do To STOP this?

Thanks.. Carlos Costa

THE LOG

Jan 6 09:33:45 server pure-ftpd: (?@186.167.34.150?) New connection from 186.167.34.150
Jan 6 09:34:45 server pure-ftpd: (?@186.167.34.150?) Logout.
Jan 6...

Hi,
when CSF run a cron for check for updates and find an update it send to me an email notification but is not sent to the email address I set in the config for receive notification but is sent to root address who generate Deliver Status Notification. How I can set a different email address to be alerted of the update process?

Thanks.

Maybe I have to set a valid email address in X_ARF_TO = ?...

Hello,

I have question about Blocking all ICMP except these Dynamic DNS
file (csf.dyndns) - all listed domains will be resolved and allowed through the firewall

If I add Dynamic DNS in these & disallow ICMP to 0 value in configuration will the ICMP be allowed in these Dynamic DNS or not

If no , then how to make it only on ICMP to these Dynamic DNS ?

My Regards

Update#1

I'm using CSf via...

Hi.

I have this issue with CSF that I have added the cloudflare IPV4 ip's to the allow list and also csf.ignore but it still blocks cloudflare and I can't access websites while the csf is activated!

let say this (108.162.225.114) which blongs to cloudflare! the whole block is whitelisted in both allowed ips and ignore file!

I tried to lookup this ip in the blocked list 108.162.225.114, but...

Hi,

I've had this problem for a while now, each time CSF auto updates, my NAT rules in /etc/csf/csfpre.sh are lost in the iptables chain. As the server in question is a VPN server, these rules are required for internet access, all VPN clients thus lose internet connectivity every time CSF updates itself.

The fix is relatively simple, restarting csf with csf -r will re-apply the rules, however...

Hello friends,

Please help me to mitigate DDoS attack. I used own script which parse access.log and block IPs in default way - csf -d

The problem is CSF (latest cpanel version) can't block some IPs, every time I got error:
--
deny failed: is in already in the deny file /etc/csf/csf.deny 1 times
--

This IP seem to be blocked, but it still have full access to my server. However, most IPs are...

I use Centos 7 with directadmin on a VPS

Ever since I installed CSF+LFD and Fail2ban I see these incoming udp (which gets blocked) lines on port 33445 every 10 seconds in my /var/log/messages. All these have the same source aswel.

Jul 6 23:47:10 nlamswsp01 kernel: Firewall: *UDP6IN Blocked* IN=eth0 OUT= MAC=33:33:00:00:00:01:52:54:00:d5:04:93:86:dd SRC=fe80:0000:0000:0000:5054:00ff:fed5:0493...

Hi All,

We are seeing the below error on a few servers and I am wondering if it is related to the recent upgrade of csf - anyone else seeing this?

Jun 23 19:10:46 xxxxx lfd : *System Integrity* has detected modified file(s): /usr/sbin/csf /usr/sbin/lfd /sbin/csf /sbin/lfd
Jun 23 19:10:46 xxxxx lfd : Unable to send SMTP alert via : Invalid argument at /usr/sbin/lfd line 6381.

Jun 23 19:10:46...

I tried reinstalling and that didn't help, Any ideas what I need to do?
Ubuntu Server 15

● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: enabled)
Active: failed (Result: signal) since Sat 2016-07-02 00:30:24 PDT; 21min ago
Process: 4911 ExecStart=/usr/sbin/lfd (code=exited, status=0/SUCCESS)
Main PID: 4914...

Hi Sirs,

I recently uninstall and install the CSF+LFD Services in my VPS Server. It resolve my last problem ( but now all works fine except FTP Service that login fine but cant display directories -no matter what client I use (FTP_Lte, FileZilla, FTP_Pro). The only way to access and works fine is adding the IP to the .

Since it´s impossible to add all clients IPs I ask about some advising, I...

Hi Sirs,

Since the last restarted at 00:30 hours aprox, mys LFD status shows: Status of lfd:lfd dead but pid file exists . I restarted but nothing changed. I erase all IPs blocked in permanent area more than 120 and nothing.
Any idead what is the problem?

regards,

Fernando

I currently have the default cpdavd whitelist rule in place, but it's not working:

exe:/usr/local/cpanel/cpdavd

Here is the alert I am receiving:

Executable:
/usr/local/cpanel/3rdparty/perl/514/bin/perl

Command Line (often faked in exploits):
cpdavd - authenticated as someuser

Can someone suggest the best way to whitelist this one?

Thanks in advance.

- Scott

Hi,

I'm trying to install CSF on a very old server running RHEL 3 ES. I'm getting the following errors,

service lfd restart
Stopping lfd:
Starting lfd: import is not exported by the Exporter module
Can't continue after import errors at /usr/local/csf/lib/ConfigServer/Slurp.pm line 15
BEGIN failed--compilation aborted at /usr/local/csf/lib/ConfigServer/Slurp.pm line 15.
Compilation failed in...