ConfigServer Community Forum

I have the latest version of CSF and Everyone that trys to login to their cpanel is blocked until I put their IP in allowed list.
I have went over the settings and can't find out why.
I have checked everyone's IP and they are not on anyone's list.

I have install csf in my DIrectadmin server. It shows only few option in csf panel. How I can get all options as normal csf installation. Please find the screen short of my panel.
www. gyazo .com/416a3527735ebd25c0c330d43f66a131
thanks
Bineesh

Just (21:24 on Jan 1st 2015) had a warning that both CSF and LFD have failed the MD5 comparison.

I looked in /usr/sbin/lfd and noted that the copyright statement at the top mentions 2015 - is this an automatic copyright update causing the file change?

I also see this command in the file which concerns me:

umask(0177);

Should I chill out? Or fret?

Thank you!

Hi there,

We are trying to SCP a large file from one of our servers, however CSF appears to be killing the SCP process after around 55 minutes.

In /var/log/lfd.log we see the following messages:
------------------------------------------------------------------------------------------------------------------------------------------------------------------
/var/log/lfd.log-20141214:Dec 12...

Hi,

I changed the email address I use for ALL cPanel and CSF notifications to a different one, but CSF is still sending to the old address - anyone seen this or know how to get it to send to the right one?

Animo

Hi all,

I have CSF (7.57) running on a fresh Ubuntu Server 14.04 install. It's working fine, except that the Webmin module only loads up to the upgrade section, and then does nothing (it doesn't even try to actually check for an upgrade). I've tried uninstalling and reinstalling to no avail. Any advice?

I'm running a cPanel server that sits behind CloudFlare. I've been using csf for a while on another cPanel server and found it incredibly useful, but it's next to useless when all traffic is coming from a small range of already-known IPs. A script like Flarewall is a good start, but still requires csf to know the correct IP to block. Is there a way to get csf to pick up on X-Forwarded-For or...

Hi,

In the last month or so, my /var/log/messages becomes flooded with errors like this:

Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=04:01:07:8a:00:01:00:24:38:ab:b6:00:08:00 SRC=117.41.166.216 DST=82.196.0.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=105 ID=256 PROTO=TCP SPT=6000 DPT=9200 WINDOW=16384 RES=0x00 SYN URGP=0
Firewall: *TCP_IN Blocked* IN=eth0 OUT=...

I am seeing the same ip showing up in my httpd error_log for numerous mod_sec violations, yet its not being blocked by CSF. I have CSF set to block after 5 errors and it is watching the correct error_log path.

ModSecurity: XML parser error: XML: Failed parsing document.
ModSecurity: Warning. Match of eq 0 against REQBODY_ERROR required.
ModSecurity: Warning. Operator GE matched 5 at...

Hello,

I'm currently setup using CSF/LFD on a cPanel/WHM server. Tonight I was messing around with iptables adding some rules to open ports through SSH, encountered some issues so for troubleshooting reasons I went into CSF and clicked Firewall Configuration added the ports I needed opened then saved and restarted csf/iptables. It appeared some of the rules I had added earlier seemed to be gone....

If I block an IP range in csf/lfd for example 87.106.0.0/16 1&1 servers because I am fed up with the constant attacks by scripts from infected servers there
Will that also block emails being received by my mail server from 1& 1 customers, because unfortunately I do have some users who have a 1&1 (gmx) email address who do email me occasionally

From time to time, I'll get myself locked out because I've made a typo in a password or something like that; latest case was making a typo on the cPanel port. Then I'm blocked until I figure out what I did, and have to wait.

Meanwhile, to prevent this, since it's my effing server, I whitelist my ISP-provided public IP address. Which occasionally changes. Which means every few months, I go into a...

Hi, on my RHEL v6.5 server CSF logs only one line per firewall hit in the systems /var/log/messages logfile.

But for some reason on a new Centos 7 server I'm setting up all logs are reproduced two times.
One time with a timestamp before the Firewall: part, the other directly as-is like on my Centos 6.5 system:

Sep 23 13:57:19 localhost kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT=...

Will lfd deal with logs going away and new files being created, ie. how logrotate works?

Or do we need to tell logrotate to restart lfd?

HI there

I am trying to block

202.46.0.0. - 202.46.255.255

with

csf -d 202.46.0.0/16

However, my client is still complaining that these IP are trawling the site and I can still see them attached to the server

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
1 122.225.109.220
1 202.46.49.101
1 202.46.50.128

any ideas what I am doing wrong?

I currently run my own blocklist using fail2ban and a few parameters to catch Wordpress brute force.

fail2ban adds the entry to csf, and also populates a file that I keep as my own block list. This file is entered into csf.deny so it's reloaded upon csf restarts.

I'm looking to expand this list to mysql. Is it possible to have an ip block list using mysql?

Looking at your ip blocklist...

Is there any way currently to include additional ip blocklists into csf.deny via external files?

I know csf.blocklists can download lists, but I am talking about local files that csf would not touch other than to import them when csf.deny is loaded

Such lists would be treated as do not delete by default.

Wondering if I missed a feature somewhere or have to request it.

Is it recommended to run csf/lfd and cphulk at the same time or is that just redundant?

Thanks,
Eric

Is there any way of getting high load alerts cced to a separate email address?

Basiccally I need to be alerted when the server becomes unresponsive to a separate email address that opens a support ticket with the datacentre so needa;erts for high loads only.

In theory if LF_BLOCKINONLY is set to 1, shouldn't the server be able to make outgoing http requests to another ip listed in csf.deny?

Because it cannot.

If 1.2.3.4 is listed in csf.deny and LF_BLOCKINONLY is set to 1, a wget to 1.2.3.4 will fail (where 1.2.3.4 is just an example obviously)

Or does the iptables rules created only allow the connection to function in one direction, so the http...