ConfigServer Community Forum

Hi,

I have two servers:
1) CentOS 6, CLOUDLINUX 6.7, x86_64, xenhvm, WHM 56.0 (build 18), CSF v8.25
2) CentOS 7, CLOUDLINUX 7.2, x86_64 kvm, WHM 56.0 (build 18), CSF v8.25

In both servers I have a added a regex in /etc/csf/csf.fignore for emails from JetBackupManager. They provide the regex themselves:

regex:
/tmp/tmp +/virtualenv\- +/.*

The problem is that in CentOS 6, this works just...

Is it possible to have the Distributed DOS to work for Custom LFD?

I apologize if this is already answered or possible..

We occasionally see phished/hacked accounts sending spam via authenticated SMTP, and they typically come from a large number of different IPs.

I know we can block based on failed SMTP failed but I'd like to block *successful* SMTP authentications when they come from too many different IPs (or better yet, when they come from too many different countries).

Any way to do this currently?

Last few days my server is unable to update CSF. I got the error: Oops: Unable to download: Can't connect to download.configserver.com:443

When I try to do a telnet to download.configserver.com on port 443 it is unable to connect.

# telnet download.configserver.com 443
Trying 85.10.199.177...
telnet: Unable to connect to remote host: Connection timed out

I've verified my firewall and this IP...

I have read through the forum's and can't figure out why my Custom Trigger isn't firing...

So, I have a web application which is writing the following to a log file upon Failed Login Attempt.

I am using PHP Error Log Function to write the Failed Attempt
error_log( {$x} {$_POST } {$y} {$z} {$zz} , 0);
This Generates a Log Entry in the /var/log/httpd/error_log as such:
Failed Login for User:...

I get this error every day

You have an unresolved error when starting csf:
Error: FASTSTART: (Packet Filter IPv4) [] . Try restarting csf with FASTSTART disabled, at line 4800 in /usr/sbin/csf

You need to restart csf successfully to remove this warning, or delete /etc/csf/csf.error

if I disable faststart csf is very slow to restart why there are too many rules

Getting an error:

No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/csf.cgi): The subprocess reported error number 13 when it ended.

Cpanel told me to ask CSF :)

All other servers are OK. Tried force update didn't help. Server seems to be working fine otherwise.

Hello,

I installed CSF on Cloudlinux 7 + cpanel server. I disabled firewalld and installed iptables instead. However, the LFD service keep failing after about 30 mins.

# cat /etc/csf/csf.error
Error: FASTSTART: (DROP no logging IPv4) [] . Try restarting csf with FASTSTART disabled, at line 4738 in /usr/sbin/csf

The startup log shows the lfd.service was killed, but I have no idea why it was...

I'm trying to get this regex working properly and having no luck at doing so.

The logfile looks like this:

2016-01-26 15:33:19 Authentication failed for user mrfakeuser from 126.16.117.42

In /etc/csf/csf.conf I've set:

CUSTOM1_LOG = /var/log/pmta/log

In /etc/csf/regex.custom.pm my code looks like this:

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\S+\s+\S+\s+Authentication...

I got an email from the server with this line:
'admin@DOMAIN.COM' to access service 'mail' from IP '155.133.82.177': 31 Time(s)
dovecot: auth: Error: Cpanel::MailAuth: cphulk incremented the failure count for user

However, I have this in my deny list:
155.133.0.0/16 # Error: Cpanel::MailAuth: cphulk Poland Thu Apr 28 13:00:00 2025 DO NOT DELETE

So pray tell me how the user from the IP...

These are our settings on a number of mixed centos installations (Centos 6, and 7) running latest Cloudlinux kernels. We have dozens of servers for which csf.pignore is just not working

csf:v8.22

PT_LIMIT = 600
PT_INTERVAL = 60
PT_SKIP_HTTP = 0
PT_ALL_USERS = 1
PT_DELETED = 0
PT_DELETED_ACTION =
PT_USERPROC = 50
PT_USERMEM = 0
PT_USERTIME = 3600
PT_USERKILL = 0
PT_USERKILL_ALERT = 0...

Hi. I am running CSF on a VPS

In openvz config file, I have the following:

IPTABLES=”ip_tables iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ipt_state iptable_nat ip_nat_ftp ipt_recent ipt_owner ipt_conntrack ipt_helper ipt_REDIRECT”

when entering container, I get this error:...

Getting these errors in my CSF log.

Unable to retrieve blocklist RBN - Unable to download: Not Found

I have installed what I believe to be the correct version of CSF for Cpanel on my VPS / CENTOS 6.7 / WHM 11.52.1 (build 2):

csf -v
csf: v8.08 (cPanel)

It does seem to be enabled and working, however it will not show up in my Plugins list in WHM. I have uninstalled and re-installed with no luck.

Hello,

i have correctly installed and configured CSF messenger, but i would like to get help for this :

I would like to let blocked users to send me an email or access a specific domain on my server to be able to tell me that they are blocked.

If i ask users to send me message to a mail on my server, it can't be sent because they are blocked, and i cannot use a phpform because this feature...

Is it possible to display actual blockage message in csf messenger service ? If it's than please guide me.

We have a server with rackspace and they are asking us to add some rules to iptables so their backup system can connect, something about a loopback system.

I just wanted to check if I should do this or not becasue obviously my concern is that I allow access to everyone outside.

Also, how do I add these rules through CSF interface if I need to?

# Allow access from loopback (Needed for EvMgrC...

Hello,

on another VPS the opposite of the behavior I wrote about some minutes ago happens:

I only opened the following ports:

# Allow incoming TCP ports
TCP_IN = 20,21,25,53,80,443

# Allow outgoing TCP ports
TCP_OUT = 20,21,22,25,53,80,110,113,443,587,993,995

I did not define a csf.allow but I'm able to open

How is that possible?

Hi,

I just want to block certain country. Let say i want to block vietnam. So i put on CC_DENY= VN . After restart and a few days, i got attack from vietnam. Is it suppose to block vietnam from accessing my webpage? Please advice.

Thanks.

Greetings, new here but have been using csf for a long time on different servers.

Recently, I have been unable to open the UI for CSF from my webmin install. Worked previously. Only changes I am aware of were the addition of an ssl certificate, and an update to csf.

Full restart of csf:

root@server5:/home/borg1_vir# csf -ra
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain...