ConfigServer Community Forum

Hi.

I have this issue with CSF that I have added the cloudflare IPV4 ip's to the allow list and also csf.ignore but it still blocks cloudflare and I can't access websites while the csf is activated!

let say this (108.162.225.114) which blongs to cloudflare! the whole block is whitelisted in both allowed ips and ignore file!

I tried to lookup this ip in the blocked list 108.162.225.114, but...

Hi,

I've had this problem for a while now, each time CSF auto updates, my NAT rules in /etc/csf/csfpre.sh are lost in the iptables chain. As the server in question is a VPN server, these rules are required for internet access, all VPN clients thus lose internet connectivity every time CSF updates itself.

The fix is relatively simple, restarting csf with csf -r will re-apply the rules, however...

Hello friends,

Please help me to mitigate DDoS attack. I used own script which parse access.log and block IPs in default way - csf -d

The problem is CSF (latest cpanel version) can't block some IPs, every time I got error:
--
deny failed: is in already in the deny file /etc/csf/csf.deny 1 times
--

This IP seem to be blocked, but it still have full access to my server. However, most IPs are...

I use Centos 7 with directadmin on a VPS

Ever since I installed CSF+LFD and Fail2ban I see these incoming udp (which gets blocked) lines on port 33445 every 10 seconds in my /var/log/messages. All these have the same source aswel.

Jul 6 23:47:10 nlamswsp01 kernel: Firewall: *UDP6IN Blocked* IN=eth0 OUT= MAC=33:33:00:00:00:01:52:54:00:d5:04:93:86:dd SRC=fe80:0000:0000:0000:5054:00ff:fed5:0493...

Hi All,

We are seeing the below error on a few servers and I am wondering if it is related to the recent upgrade of csf - anyone else seeing this?

Jun 23 19:10:46 xxxxx lfd : *System Integrity* has detected modified file(s): /usr/sbin/csf /usr/sbin/lfd /sbin/csf /sbin/lfd
Jun 23 19:10:46 xxxxx lfd : Unable to send SMTP alert via : Invalid argument at /usr/sbin/lfd line 6381.

Jun 23 19:10:46...

I tried reinstalling and that didn't help, Any ideas what I need to do?
Ubuntu Server 15

● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: enabled)
Active: failed (Result: signal) since Sat 2016-07-02 00:30:24 PDT; 21min ago
Process: 4911 ExecStart=/usr/sbin/lfd (code=exited, status=0/SUCCESS)
Main PID: 4914...

Hi Sirs,

I recently uninstall and install the CSF+LFD Services in my VPS Server. It resolve my last problem ( but now all works fine except FTP Service that login fine but cant display directories -no matter what client I use (FTP_Lte, FileZilla, FTP_Pro). The only way to access and works fine is adding the IP to the .

Since it´s impossible to add all clients IPs I ask about some advising, I...

Hi Sirs,

Since the last restarted at 00:30 hours aprox, mys LFD status shows: Status of lfd:lfd dead but pid file exists . I restarted but nothing changed. I erase all IPs blocked in permanent area more than 120 and nothing.
Any idead what is the problem?

regards,

Fernando

I currently have the default cpdavd whitelist rule in place, but it's not working:

exe:/usr/local/cpanel/cpdavd

Here is the alert I am receiving:

Executable:
/usr/local/cpanel/3rdparty/perl/514/bin/perl

Command Line (often faked in exploits):
cpdavd - authenticated as someuser

Can someone suggest the best way to whitelist this one?

Thanks in advance.

- Scott

Hi,

I'm trying to install CSF on a very old server running RHEL 3 ES. I'm getting the following errors,

service lfd restart
Stopping lfd:
Starting lfd: import is not exported by the Exporter module
Can't continue after import errors at /usr/local/csf/lib/ConfigServer/Slurp.pm line 15
BEGIN failed--compilation aborted at /usr/local/csf/lib/ConfigServer/Slurp.pm line 15.
Compilation failed in...

Hello, i am new to linux i recently installed CSF on my server and i dont know what bad i configured after that i am not able to install any plugin through wordpress plugin directory it says couldn't connect to host
also copy function not working cannot copy anything from remote server using pHP.
When firewall is disabled everything works perfect
Thanks

Time: Sat Jun 25 18:16:39 2016 +0200
PID: 32341 (Parent PID:32341)
Account: rpc
Uptime: 62454 seconds
Executable: /usr/sbin/rpcbind
Command Line (often faked in exploits): /sbin/rpcbind -w

I tried to Add ignore rules here: nano /etc/csf/csf.pignore like this:

pcmd:/sbin/rpcbind -w

cmd:/sbin/rpcbind -w
user:rpc

This still did not stopped the emails to arrive? Anything I miss here? I also...

hello

regex.custom.pm has:

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /ModSecurity.*Warning. Operator GT matched 3 at IP/)) {
return ( mod_security wp_login triggered by ,$1, wplogin , 1 , 80,443 , 1 );
}
if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /ModSecurity: Warning. Pattern match 200 at RESPONSE_STATUS/)) {
return ( mod_security wp_login triggered by ,$1, wplogin , 3...

Hi, I've been using CSF for around 6 months with no issues, but in the last 48 hours, presumably an update, I now get the following response when trying to access the menu page (.../cgi/addon_csf.cgi) in WHM:

Internal Server Error: 500
No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/addon_csf.cgi) with exit signal: 9
cpsrvd/11.34.2.8 Server at ds197305-1.lcnservers.com

The...

Hi all
I've got a problem with csf cluster of my 3 servers: only one of them can succesfully ping others.
This is my cluster config:
server01 (192.168.10.141):
CLUSTER_SENDTO = 192.168.10.141,192.168.10.154,192.168.10.155
CLUSTER_RECVFROM = 192.168.10.141,192.168.10.154,192.168.10.155
CLUSTER_MASTER = 192.168.10.155
CLUSTER_NAT = xx.xx.xx.155

server02 (192.168.10.154):
CLUSTER_SENDTO =...

Hi,

How can enable remote connections to mysql database on port 3306

for example for the IP 192.100.172.192

Thanks.

Hello
Google keep changing smtp ip addresses, How to enable smtp.gmail.com and pop.gmail.com in the CSF as hostname?

Just installed a Comodo SSL and I've been having problems periodically with reaching the site.
- When I disable CSF, I get straight through.
- When I restart CSF, I get straight through ... until it happens again.

I've created a cron job to restart CSF every 2 hours, but this is not a permanent fix.

What setting in CSF could be causing this?

I've talked with Comodo support and they get the...

hello there,

I have a server with custom regexp, but the regexp seems not able to be applied.

Am I forget something ?

CUSTOM2_LOg = var/log/exim/reject.log

regex example:

#!/usr/bin/perl
###############################################################################
# Copyright 2006-2016, Way to the Web Limited
# URL:
# Email: sales@waytotheweb.com...

Hi,

Apologies if this has already been covered before, but my initial search in the forum was not very helpful.

What I am trying to achieve on my cpanel server is, If a user from an IP is making multiple requests to any URL on our website, I want that IP to be blocked for sometime. We have no clue how can this be achieved. Any help will be appreciated.

So if an (IP) is making (n) requests to a...