ConfigServer Community Forum

I am not great at doing regular expressions to suppress certain messages from appearing in my hourly logs. Since I upgraded the servers to CloudLinux, I am seeing a slew of these messages and would like to remove them from the log. According to Sarah, I need to add an ignore in the csg.logignore which will not stop CSF from blocking or handling these threats, but it will remove it from the hourly...

Any tips on how to get this working? I tried the code below and it still doesn't work. When I restart LFD, it doesn't list all of the files. I also tried setting htaccess to a single domain and then failing the htaccess multiple times and nothing is happening. Any ideas?

HTACCESS_LOG = /var/log/httpd/domainds/*.error.log

AH01618: user asd not found: /clients/reports/
AH01618: user asda...

Hi.

I have postfix+dovecot+openDKIM running fine in my CentOS (without ccpanel). All softwares are configured and running fine. OpenDKIM uses milter/filter in postfix and call an script (perl) using 'spawn' proccess to run this filter. Without LFD started, everything works fine. If I start LFD, this script stops working. I alread tried to add this script and 'spawn' executable to proccess ignore...

Hello,
I'm trying to use Check for IPs in RBLs , but getting:

New x.x.x.x (PUBLIC)

NOT CHECKED

information for every server's IP.
Any hint?
I tried to find out if anything should be configured for that, but no posts about similar problems nor information about configuration.

Hi,

I have 3 servers which I want to put into a csf cluster. I tested it with 2 servers but got errors.

This is how I install & configured csf cluster:
I just downloaded and installed csf using a tutorial

Then I added these changes to the default config:
Server 1 (192.168.1.1)

TESTING = 0
CLUSTER_SENDTO = 192.168.1.2
CLUSTER_RECVFROM = 192.168.1.2
CLUSTER_MASTER = 192.168.1.1...

wondering where csf store the blocked ip´s when you have temporary ban enabled? csf.deny i guess is for the permanent and i thought should be in csf.tempban but i do not see any ip on this one when i receive the blocked email alert.

Any idea?

Thanx!

G'day.

My webhost (Linode VPS) has recently become the target of DDoS attacks. I've put my site behind Cloudflare (free) but it doesn't seem to be helping at all.

So I've decided to give CSF a try. I'm running Centos 6.5 with standard LAMP setup for a few Wordpress sites. After installing CSF I setup the UI in the config file and restarted both CSF and LFD but I'm unable to gain access to the...

Hi,
I started to use IPSET with CSF, really nice addition, hope in a future Chirpy creates a GUI on where to add or delete IPs on the IPSET.

POST EDITED DUE TO NEW ADVANCES!!

I have to admit, with new toys to play there will always be a chance to forget something, lol.

CSF + IPSET works great!!!

After configuring everything on the server I restarted CSF completely and CSF created a few IPSET...

Have a strange issue here. Recently a VPS we manage has had massively increased traffic (400%+) than usual. With CSF/LFD enabled, even though load on the box is low, connections are extremely slow and often timeout or take over 20 seconds to load. With CSF/LFD disabled, connections are much faster and don't timeout at all.

No recent configuration changes have been made, and we use the same...

Hi, I am on a GoDaddy VPS, and I am having the issues like such:

Testing ipt_recent...FAILED - Required for PORTFLOOD and PORTKNOCKING features
Testing xt_connlimit...FAILED - Required for CONNLIMIT feature
Testing ipt_owner/xt_owner...FAILED - Required for SMTP_BLOCK and UID/GID blocking features
Testing iptable_nat/ipt_REDIRECT...FAILED - Required for MESSENGER feature
Testing...

HI guys,

Hoping someone can help here. I have a client server that when I enable UDP FLOOD OUT I get this error after running csf -r:

iptables: Unknown error 18446744073709551615
RETURN udp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 OWNER UID match 25
Error: iptables command failed, at line 1787

I've tried tweaking the settings as outlined in the conf file but nothing seems to change this. In...

showed up today in the logs

Retrieved and blocking blocklist XYZ IP address ranges
IPSET: loading set new_XYZ with 167 entries
IPSET: switching set new_XYZ to bl_XYZ
*Error* IPSET:

(btw on another server not using IPSET the blocklist was applied but that is probably obvious)

I ran into a potential bug with my new cloudlinux + Cpanel + CSF setup.

Recently I've setup a new Virtual Machine on a VMware platform with cloudlinux 7, after activation I proceeded to install WHM/Cpanel on this machine (without problem).

As per security conventions I then proceeded to install the configserver (CSF) plugin, which installed without error. I've followed the installation...

Hi Guys,

Just tried using this new UI on Webmin, it work's great, however the email never arrives :(

Should there not be a cron or something setup for it, as it does not seem like it.

See screenshots:

1) Webmin:
2) SSH:

Any ideas?

Cheers,
Dara

We are new to CSF but have been on cPanel for a good amount of time now.

We are receiving a lot of notifications that we wouldn't expect and I'm not quite sure what to make of them and I was hoping someone might be able to explain a bit.

The Notifications are:

Time: Thu Sep 24 10:40:45 2015 -0500
Account: main
Resource: Process Time
Exceeded: 5446 > 1800 (seconds)
Executable:...

Hi,

I'm having trouble getting CSF firewall to work...

My understanding is that the default behaviour is block/deny all. However this doesn't seem to be happening.

In csf.allow I have:

my.ip.address.here

And then I want to Block all other access to port 22 / ssh

I would have expected this to work by default if the default is deny all but nope.

I added the following to csf.deny:...

I have blocked several countries in csf.conf file. Restarted CSF/LFD.

CC_DENY = CN,BR,CA,HK,TW,RO,RU,UA,MD,KZ,TH
IWhen I check the Nginx logfile it shows the following:

61.135.190.69 - - GET /s5.css HTTP/1.1 403 198 - Mozilla/4.0 (comptible; MSIE 8.0; Windows NT 6.0)
158.69.27.74 - - GET / HTTP/1.1 403 570 - Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko)...

Hello

i was trying to loging to my server via ssh but i cannot so i login to whm so i can disable firewall and have able access again to ssh

i search for error messages logs and i found this

Sep 23 13:41:51 3390cc-xeon kernel: Firewall: *TCP_IN Blocked* IN=bond0 OUT= MAC=00:25:90:e8:32:ce:cc:4e:24:67:c7:00:08:00 SRC=192.168.1.1 DST=10.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=8754 DF...

hi team,

Here is the regx i made but its not working. I have to block the ip and the logs line is

NOTICE chan_sip.c: Call from '' (37.8.5.217:12242) to extension '011972547851891' rejected because extension not found in context 'my_context'.

IP i have to block is 37.8.5.217

The regx i have written is

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /\ NOTICE\ chan_sip\.c\: Call from...