ConfigServer Community Forum

Hi!

I found for make a graph with fail2ban stats. Works fine

Now, I addapt this for CSF, so, I am sharing with you

1 - Script

Save as you want

#!/bin/bash

PROGNAME=csf
STATEDIR=/var/lib/munin/plugin-state

CHAINLIST=$(iptables -L -n |grep Chain|awk {'print $2'})

if
then
echo 'system.type ABSOLUTE'
echo 'graph_title CSF'
echo 'graph_vlabel Number of ban'
echo 'graph_category...

smarty compiled cache files are tossing a ton of warnings for suspicious files

subject for email is: lfd on vulcan.xxxxxxxxhosting.com: Suspicious File Alert

Time: Wed Jan 14 22:28:45 2015 -0700
File: /tmp/%%0E^0E4^0E407559%%footer.tpl.php
Reason: Script, file extension
Owner: xxxx:xxxx (512:524)
Action: No action taken

how and what do i edit to disable the flag for tpl.php files ?...

Hi,

is there a way to ban users who are trying to bruteforce drupal / wordpress or other cms installations. For fail2ban you have options but does csf has options to counter this?

Hello,
i added following lines in /etc/csf/csf.pignore:

exe:/usr/local/lsws/fcgi-bin/lsphp-5.4.34

and restarted csf but i still receive email like this:

Time: Fri Oct 24 08:40:34 2014 +0200
PID: 591387 (Parent PID:591387)
Account: xxxxxxx
Uptime: 11623 seconds

Executable:

/usr/local/lsws/fcgi-bin/lsphp-5.4.34

Command Line (often faked in exploits):...

I just installed this firewall
Its awesome
I have a VPS
I have several websites each with its own IP on this server
Does one installation cover my entire VPS or do I have to enable shell and install on each domain?

hi,
i was able to limit concurrent connection per IP.
but this might cause problem and effect good traffic.

the problem i am facing is, when a client is requesting a page through GET, it's served from the cache, there is no PHP code involved. so i don't care even if i am even brute forced with this method.
but if the same page is requested with POST (regardless good or bad traffic), it's always...

My 15 days old server receiving port scanning attack almost every hour. I configured CSF and its doing great job in blocking those port scanning attack and sending me an alert email with the details.

Wondering if there is a way I can completely disable the port scanning feature on my dedicated server with help of csf......?

Below are few sample of blocked alerts

Time: Fri Jan 2 16:17:00 2015...

I've mostly gotten rid of excessive resource usage alerts by adding to csf.pignore. However, there are two processes left that I can't nail down: /usr/sbin/nginx and /usr/sbin/mysqld

I have exe:/usr/sbin/nginx and exe:/usr/sbin/mysqld lines in csf.pignore and csf has been restarted, but I'm still receiving alert emails about process time and suspicious processes.

Can anyone explain why ignoring...

Can anyone help me determine what causes a process called lfd - (child) Statistic to be spawned? We had a server go into high load today and there were over 800 of these processes. I'm not seeing anything obvious in the logs so I'd like more to go on. What causes the lfd - (child) Statistic process?

Thanks in advance,
Bob

I have the latest version of CSF and Everyone that trys to login to their cpanel is blocked until I put their IP in allowed list.
I have went over the settings and can't find out why.
I have checked everyone's IP and they are not on anyone's list.

I have install csf in my DIrectadmin server. It shows only few option in csf panel. How I can get all options as normal csf installation. Please find the screen short of my panel.
www. gyazo .com/416a3527735ebd25c0c330d43f66a131
thanks
Bineesh

Just (21:24 on Jan 1st 2015) had a warning that both CSF and LFD have failed the MD5 comparison.

I looked in /usr/sbin/lfd and noted that the copyright statement at the top mentions 2015 - is this an automatic copyright update causing the file change?

I also see this command in the file which concerns me:

umask(0177);

Should I chill out? Or fret?

Thank you!

Hi there,

We are trying to SCP a large file from one of our servers, however CSF appears to be killing the SCP process after around 55 minutes.

In /var/log/lfd.log we see the following messages:
------------------------------------------------------------------------------------------------------------------------------------------------------------------
/var/log/lfd.log-20141214:Dec 12...

Hi,

I changed the email address I use for ALL cPanel and CSF notifications to a different one, but CSF is still sending to the old address - anyone seen this or know how to get it to send to the right one?

Animo

Hi all,

I have CSF (7.57) running on a fresh Ubuntu Server 14.04 install. It's working fine, except that the Webmin module only loads up to the upgrade section, and then does nothing (it doesn't even try to actually check for an upgrade). I've tried uninstalling and reinstalling to no avail. Any advice?

I'm running a cPanel server that sits behind CloudFlare. I've been using csf for a while on another cPanel server and found it incredibly useful, but it's next to useless when all traffic is coming from a small range of already-known IPs. A script like Flarewall is a good start, but still requires csf to know the correct IP to block. Is there a way to get csf to pick up on X-Forwarded-For or...

Hi,

In the last month or so, my /var/log/messages becomes flooded with errors like this:

Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=04:01:07:8a:00:01:00:24:38:ab:b6:00:08:00 SRC=117.41.166.216 DST=82.196.0.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=105 ID=256 PROTO=TCP SPT=6000 DPT=9200 WINDOW=16384 RES=0x00 SYN URGP=0
Firewall: *TCP_IN Blocked* IN=eth0 OUT=...

I am seeing the same ip showing up in my httpd error_log for numerous mod_sec violations, yet its not being blocked by CSF. I have CSF set to block after 5 errors and it is watching the correct error_log path.

ModSecurity: XML parser error: XML: Failed parsing document.
ModSecurity: Warning. Match of eq 0 against REQBODY_ERROR required.
ModSecurity: Warning. Operator GE matched 5 at...

Hello,

I'm currently setup using CSF/LFD on a cPanel/WHM server. Tonight I was messing around with iptables adding some rules to open ports through SSH, encountered some issues so for troubleshooting reasons I went into CSF and clicked Firewall Configuration added the ports I needed opened then saved and restarted csf/iptables. It appeared some of the rules I had added earlier seemed to be gone....

If I block an IP range in csf/lfd for example 87.106.0.0/16 1&1 servers because I am fed up with the constant attacks by scripts from infected servers there
Will that also block emails being received by my mail server from 1& 1 customers, because unfortunately I do have some users who have a 1&1 (gmx) email address who do email me occasionally