ConfigServer Community Forum

Hi, I have a lot of Wordpress sites.
One of those attracts a lot of comment spam, which I can deal with okay.
What happens though is that the commenters tie up resources - often I get a notice like the following

Resource: Virtual Memory Size
Exceeded: 300 > 300 (MB)
Executable: /usr/bin/php
Command Line: /usr/bin/php /home/thedomain/public_html/wp-comments-post.php
PID: 1193 (Parent PID:32606)...

greetings...

starting at midnight Oct 30, and on the hour... my server running CSF is unable to download the country code database. I have removed all firewall entries over the last 2 days without a change in the problem.

Oct 30 10:40:04 eis1 lfd : CCL Error: Unable to retrieve GeoLite Country database - Unable to download: 599 - Could not connect to 'geolite . maxmind . com:80':...

I've installed CSF on many servers, but today, I installed it on a new Cloud VPS at OVH.

Running csftest, I get OK on all points except xt_connlimit.

I see the link in WHM, and when I click it, I see the CSF logo and the heading text ConfigServer Security & Firewall - csf v7.56

But that's it -- blank beneath that.

Thinking that a bit abnormal, I uninstalled, restarted VPS, reinstalled CSF...

Hi.

I have a deployment using CENTOS, WEBMIN, POSTFIX and CSF firewall.

I use to manage CSF through the WEBMIN interface. Everything perfect, all the rules working fine.

Some time Ago, I started using the CSF feature: CC_ALLOW_FILTER, which looks like it is working fine too. However, I got a weird issue with POSTFIX mailing.

I used to limit the access to my server only to USA and Canada, so...

Hi,

Got this today and I was thinking it was worth investigating;

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/bin/crontab: FAILED
/bin/passwd: FAILED

How would I go about to check how these files...

Hi all!

I am come from Hong Kong. After I install the csf, it show that many ip from China try to login to my sever by ssh. How can I block the ip from China to login to my SSH but they can visit my website?( but don't block Hong Kong, otherwise I cannot login :eek: )

122.225.109.208 # lfd: (sshd) Failed SSH login from 122.225.109.208 (CN/China/-): 5 in the last 3600 secs - Mon Oct 20 18:46:28...

Hi all,
I search some information from internet about how to prevent DDOS attack by CSF firewall and find out the CSF setting and Preventing DDOS aplification open resolver attack:

First, I would like to ask how can I prevent DDOS aplification open resolver attack? Becasue I think that my sever was used by other to attack. ( The hosting company told me and stopped my sever about 2 weeks >. 1,...

On one server I get this like always as I remember it;

root@server1 # csf -r
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `ALLOWIN'
Flushing chain `ALLOWOUT'
Flushing chain `DENYIN'
Flushing chain `DENYOUT'
Flushing chain `DSHIELD'
...

On another server, it's totally silent;

root@server2 # csf -r
root@server2 #

Same goes for if I restart csf from...

I vaguely remember not being able to enable TLS despite the UI_SSL_VERSION setting being added.

Do you know if there are perl libraries we use to allow TLS instead of SSLv3 which is now unsafe because of POODLE ?

Update: nevermind, I just realized I have SSLv3 in my browser disabled and I am connecting to the UI with TLS, so it does work

you'll just have to change the default setting now...

I've just installed CSF on CentOS 6.5. It says in the install.txt to enable klogd within /etc/init.d/syslog.

Unfortunately, that is not installed in my system. It seems that my system is using rsyslog, but when I searched that file I could not find and lines referencing klogd. From there I searched for klogd in /etc/init.d but it is not there either.

Do I need this enabled?

The cron jobs on all accounts other than root have stopped working on my VPS. The cpanel people say it is due to the change made to CSF back in February...

I understand that this change would prevent the log being written (if I am understanding it correctly) but would this change also prevent other users from executing their crons completely? In some cases it seems to be filtering certain...

Hi all,

I see that my csf blocks a lot of IP that are just trying to ping my server.
I understand that a lot of people ping before they attack.. but a lot ping just to check the latency.

Is it possible to block ICMP/8 in csf, but NOT block an IP address who is trying to ping ? (Basically, the server will not answer anything, but will not block the IP neither).

Thank you.

Using Litespeed 4.2.16. Excerpts of our /usr/local/apache/logs/error_log:

ModSecurity: Access denied with code 403,
ModSecurity: Access denied with code 403,
ModSecurity: Access denied with code 403,
ModSecurity: Access denied with code 403,
ModSecurity: Access denied with code 403,
ModSecurity: Access denied with code 403,
ModSecurity: Access denied with code 403,
ModSecurity:...

Hi all, I've been running CSF for years and I don't think I've ever seen this one... tonight I got an email saying 0.0.0.1 was blocked permanently. Checked the lfd logs and see entries like:

(CT) IP 0.0.0.1 (-/-/-) found to have 80 connections - *Blocked in csf* for 1800 secs

This appears to have started on Oct 5 (it's the first entry in the gzipped LFD log). I didn't think 0.0.0.1 was a...

I just installed csf on a cPanel vServer (OpenVZ).
I can't access the WHM CSF/LFD GUI.

WHM --> ConfigServer Security & Firewall (click on)

I see
ConfigServer Security & Firewall - csf v7.50

and nothing else. Configuration over GUI is impossible.

/var/log/lfd.log is not available.

csftest.(pl)
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing...

/var/log/messages:
Oct 3 14:57:01 mail auditd : Audit daemon rotating log files

ignore rule: ^(\S+|\S+\s+\d+\s+\S+) + mail auditd\ :

Still reporting though?

I am on cloudlinux + cpanel

Time: Mon Oct 6 22:30:11 2014 -0500
Error: Failed to detect code in SYSLOG_LOG

SYSLOG may not be running correctly

How I can fix this?
Bless

Hello,

I'm been receiving this e-mail from all my web hosting accounts. I have researched the web and can't find a solution. I'm aware of being able add this script to the ignore file. However, I'd like to make sure this is not a problem and hopefully find the cause.
Thank you for your help!

I'm using the stable version of cPanel with Cloud Linux.

Email Subject: lfd on server-domain-name:...

Hi all,

I am trying to find a way to add logs (iptables -A INPUT -J LOG) at the end of the default INPUT, so when a rule is not matched, it shows up in /var/log/messages (centos).

Anyone know how to do that ?

Thank you

--

Never mind, I found out and it is working now.

Hola, alguien puede explicarme que es este mensaje que me indica CFS

Time: Thu Oct 2 08:59:37 2014 -0500
Type: LOCALRELAY, Local Account - securema
Count: 101 emails relayed
Blocked: No

Sample of the first 10 emails:

2014-10-02 08:49:55 1XZglX-0004bu-Jk for locke41@XXXXXXXX
2014-10-02 08:49:55 1XZglX-0004c1-Mv for mmoore21@XXXXXXXX
2014-10-02 08:49:56 1XZglX-0004cA-Qp for...