ConfigServer Community Forum

Hello CS Team,

I've activated a new server yesterday and installed with success the CSF yesterday.

Today i was trying to install the CMQ, CMM etc.. however when i try wget to the configserver it does not connect to the server

--2014-04-30 12:30:43-- configserveraddress/free/cme.tgz
Resolving configserveraddress... 85.13.195.235
Connecting to configserveraddress|85.13.195.235|:80...

Tested...

hi all -

i am attempting to use Node.js for the first time. when i try to run the script, it triggers this firewall blockage:

Apr 29 12:21:41 edwardsmarkf kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=52:54:00:63:76:ee:00:03:fe:a0:b8:00:08:00
SRC=54.219.207.198
DST=199.231.184.26
LEN=52
blah blah blah
DF PROTO=TCP
SPT=2460
DPT= 8080
WINDOW=8192
RES=0x00
SYN URGP=0

it does not...

Hello

An ip is blocked due to pop3 login failed

Is it possible to find it was related to which email account ? (We know the domain name of the account, we need to know about account name)

Regards

I used to use CSF with cPanel and there was an option with the CSF plug-in to run a security scan. It would give a score and list suggestions on improvements.

Is this same feature available from the command line (as I no longer use cPanel) ? - I've had a look through the documentation and couldn't find it, but I may have overlooked the details.

Thanks in advance,

Daniel

hi ihave a linux server CENTOS 5.5 i686 standard with
WHM 11.26.20
the firewall is csf v6.26
but is enabled but stopped

when i try to upgrade or restart it

thi is the error

Restarting csf...

Missing right curly or square bracket at /usr/sbin/csf line 73, at end of line
syntax error at /usr/sbin/csf line 73, at EOF
Execution of /usr/sbin/csf aborted due to compilation errors.

...Done.

how to...

I'm also experiencing this issue, although this is my own server in my own datacenter.

Installed minimal install of CentOS 6.5, then continued by installing OpenVZ. Created a container, installed cPanel, followed by csf. All default settings, no changes. Tried this on 2 separate servers, both with the same result. All that I changed was disabling testing mode.

CSF does work, but blocks ALL...

Hello
daily i have report to my email like below information, for all user,
=======
Time: Sun Jan 26 05:52:00 2014 +0430
Account: user
Resource: Virtual Memory Size
Exceeded: 206 > 200 (MB)
Executable: /usr/local/cpanel/3rdparty/perl/514/bin/perl
Command Line: pkgacct - user - av: 3
PID: 451695 (Parent PID:451617)
Killed: No
=======
Time: Sun Jan 26 05:40:59 2014 +0430
Account: user2
Resource:...

hi, I'm using cpanel , is there anyone having a pignore cmd or path to ignore this process ?

I already added the following into pignore but it is not working
exe:/usr/local/cpanel/bin/pkgacct
exe:/scripts/pkgacct

Time: Tue Apr 22 03:50:35 2014 +0800
Account: touchtr
Resource: Process Time
Exceeded: 5001 > 5000 (seconds)
Executable: /usr/local/cpanel/3rdparty/perl/514/bin/perl
Command Line:...

Hi,
there is an issue with CONNLIMIT and PS_LIMIT.

I have set:
CONNLIMIT = 80;20,2095;10

and under PORT SCAN TRACKING:
PS_LIMIT = 10

But blocks for CONNLIMIT are done at 10 and not at 20 on port 80 as specified, this is what LFD reports:

Time: Mon Apr 21 12:12:15 2014 -0500
IP: xx.xx.xx.xx (xx)
Hits: 11
Blocked: Temporary Block

Sample of block hits:
Apr 21 12:11:58 server1 kernel: Firewall:...

I got few emails last week like this,

Sample Email:
crawl-66-249-79-170.googlebot.c0m) blocked for port scanning

IP: 66.249.79.170 (US/United States/California/Mountain View/crawl-66-249-79-170.googlebot.c0m)
Hits: 6
Blocked: Temporary Block

(i use 0 for com's o, because of not auth for post url links)

1-why googlebot portscan my server?
2-Can a hacker use this ip to fool me?(how to be sure...

This really needs to be addressed here.
It appears that there is absolutely no reference to LF_MODSEC_PERM in code at all.
One would expect (rightly so) that if an option is set (LF_MODSEC_PERM) it would be utilized properly, but not so much here.

There needs to be a way to temporarily ban these individuals, without actually banning them entirely.

LF_PERMBLOCK is set to 0 as well, so the...

My vps always shutdown and I received many alert like below:

Time: Thu Apr 17 23:39:47 2014 +0800
Account: bestjob
Process Count: 45 (Killed)

Process Information:

User:bestjob PID:725 PPID:22011 Run Time:260(secs) Memory:175488(kb) exe:/usr/bin/php cmd:/usr/bin/php /home/bestjob/public_html/jobsbay/admin/index.php
User:bestjob PID:2995 PPID:30373 Run Time:62(secs) Memory:161788(kb)...

Hi,
First of all: let me thank the developers of CSF for their excellent product.
I use CSF/LFD to allow only certain countries to have access to my IP (website and all other actions)
I would love to have a (custom) message to show all other visitors.
Is that a standard function in CSF/LFD or do I have to develop it myself?
Thank you and best regards. :D

Hi !

I have a server with CSF Installed and configured (Like others dozens), with port 80 open:

# Allow incoming TCP ports
TCP_IN = 80,443,8080,1935,8083,514,465,123

# Allow outgoing TCP ports
TCP_OUT = 80,20,21,22,25,53,110,113,443,8080,1935,8083,512,465,123

# Allow incoming UDP ports
UDP_IN = 53,1935,465,123

# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to...

I have several VPS's and even a dedicated server all working fine with CSF. Some with Webmin, some with DA.

I have one VPS though without CSF. In the past I installed CSF on it but it was'nt working. After working with CSF for some time now I decided to try again.

Unfortunately after disabling testing mode the VPS frooze (locked up). With the help of the service desk I regained control again...

We have just received a brand new server from singlehop, and when attempting to install CSF etc, we apparently are blocked by the configserver's actual firewall. Our IP range includes 198.20.70.XXX

I have had to edit my evidence below due to:
You are not currently authorized to post url links, please remove or rename:

traceroute to configserver.XXX (85.13.195.235), 30 hops max, 60 byte...

After we upgraded to 6.47 we no longer get email alerts for permblocks and the comments after the IP address in csf.deny are missing now (seel below). We do however still get alerts for temp blocks. Anyone else having this problem?

92.87.5.14 # lfd: (PERMBLOCK) 92.87.5.14 (RO/Romania/-) has had more than 4 temp blocks in the last 86400 secs - Tue Jan 14 11:08:32 2014
200.77.249.162 # lfd:...

The IP's have been changed to dummy IP's but what I have going on is the following.

I have a cpanel server 10.10.10.10 and a web site builder server at 9.9.9.9. The site builder software compiles the web site on 9.9.9.9 and then FTP's it to 10.10.10.10. I have explicitly allowed 9.9.9.9 via csf -a 9.9.9.9 on the cpanel server. However I noticed when publishing some of the ftp activity works but...

Hello,

It seems every time CSF upgrades to the latest version csfpre .sh is not run after the upgrade when csf restarts.

I have some extra rules and have to manually restart the firewall after an upgrade to re-enable these rules. This happens on 2 systems with Centos 5.10 (+ cPanel VPS) & Centos 6.5 (+ cPanel DNS only).

Thanks,

Chris