ConfigServer Community Forum

Since upgrading to WHM 11.40.0 (Build 6), LFD is sending me regular alerts about excessive resource usage:

Time: Mon Oct 14 07:16:29 2013 -0700
Account: dovecot
Resource: Process Time
Exceeded: 31883 > 1800 (seconds)
Executable: /usr/libexec/dovecot/auth
Command Line: dovecot/auth
PID: 30873 (Parent PID:30861)
Killed: No

and

Time: Mon Oct 14 07:16:29 2013 -0700
Account: dovecot
Resource:...

The update package does not work.
Csf-u command to get the following answer:
Oops: Unable to download: Can not connect to (timeout)
Ping the site works correctly

The X between letters were placed to prevent the post appears to contain links

root @ server1 # csf-u
Oops: Unable to download: Can not connect to (timeout)
root @ server1 # ping-c5
Configserver.coxm PING (85.13.195.235) 56 (84) bytes...

I have got alert form csf regarding suspicious file bc. pl on the server with the following content.

#!/usr/bin/perl
use Socket;
$iaddr=inet_aton($ARGV ) || die( Error: $!\n );
$paddr=sockaddr_in($ARGV , $iaddr) || die( Error: $!\n );
$proto=getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die( Error: $!\n );
connect(SOCKET, $paddr) || die( Error: $!\n );
open(STDIN,...

I am would like to use CSF to block all traffic from all ports from all ips except for ours and a client's.

There are a couple of threads that are close to this but not exactly the same. I want to do this correctly because I am concerned about locking myself out.

If there is anyone out there that could help me out I would appreciate it.

Thanks
Alex

Hi,

I have installed and used csf for a while now, and am thankful it worked so well from the get go. I just stumbled upon a problem that is stumping me.

My Virtuozzo based VPS server has 3 IPs, each on its own adapter: venet0:0, venet0:1 and venet0:2.

Any blocking action has effects on one of the IPs (the initially installed IP on venet0:0), but has no effect whatsoever on any of the 2...

Hi now and then i get an email saying Please use the following links to add to the black list: and says single IP then 24 and 16 can someone tell me where to add them please.

Hello,

We have ConFigServer firewall installed on our server but since 3 days we are having lot of attack and server is going down often. Also our lfd is showing down. Can someone please help?

Regards,
Jay Kay

Hi,

I have CSF 6.37 Installed on two servers, i have noticed today that when an IP is blocked permanently, its logged under (permanent IP bans)) but the number stays the same.

for example:

before some IP is perm. banned : Currently: 552 permanent IP bans)

After few IP's get's banned permanently: Currently: 552 permanent IP bans)

so what Can I do? or its a bug?

thanks

Hi there, I use csf in some servers and VPSs, but this time we're using it to protect one proxmox debian node, but for any reason, csf doesn't load the country tables so there's no block and nothing in the iptables.

We tried exactly the same in another system (a couple of external VPSs, one openvz and another KVM) and this worked without any problem.

We didn't see anything weird in the logs....

Hi!
I have a eth0 with ADSL conection and two aliases for public ips and the eth1 is my lan.
I can't configure the csf for my system.
Anyone have something like that? may have or provide your experience?
Thanks!!!

OK, so I recently uninstall Configservers mailscanner solution as my email scanning is now external. Incoming email is working perfectly, though i do have port 25 disabled for incoming connections except for connections from my anti-spam gateway. Outgoing 25 is open though. For some reason I have no problem emailing anyone on any other servers (even my zimbra servers), but i cant seem to be able...

Hello,
I am not able to send email when I turn on my firewall and the message is SMTP -> ERROR: DATA not accepted from server : please Help me for troubleshooting my problem.

Thank You

Hello!

I've been looking everywhere but I have not been able or unwilling to help. The problem is I want to enable the messenger to take them to index.html but I could not make it work.

I can give you the exact steps that I condifigurar to make it work?

Excuse me, is that I'm new to these Linux. :(

Hi guys

I am a newbie to CSF as you will see very soon...

I am using DirectAdmin, managing my new VPS which is running Centos. My site is using only MySQL and PHP.
CSF v5.09 is installed.

Since I am not sure what is the best way to configure the firewall, I thought about using one of the Firewall Security Levels provided in CSF (which I access from DirectAdmin).

I thought about trying the...

Hi,

Last night, I got an email alert saying that someone logged in to root from an IP in the Netherland (I'm in Canada). Two mins later, I get another alert email saying someone logged in as root from USA.

I was lucky enough I was infront of my PC. I quickly logged in, blocked both IPs and changed my password.

I am baffled as to how the 2 ips were able to login as root in whm.. We keep our...

csf -ca 82.83.84.85
Can't locate object method new via package Crypt::CBC (perhaps you forgot to load Crypt::CBC ?) at /usr/sbin/csf line 443.

I'm getting excessive resource usage for sftp and ssh connections (which is fine as I'm pretty confident they are legitimate users), but the client would like confirmation that it is their IP that is connecting.

Is there a way to find that.

I can view the logs but they only show the process and resource, not the IP.

Hello,

Ruby on Rails under cpanel uses the mongrel server, and so is a long running process that needs to be ignored by lfd.

The process is:

/usr/bin/ruby /usr/bin/mongrel_rails start -p xxx -d -e production -P log/mongrel.pid

I don't want to ignore all long running ruby processes, so I'd like to be able to include the parameter in the csf.pignore match:

pexe:/usr/bin/ruby...

I've noticed lately I'm getting a lot of attacks via FTP. I've checked the CSF configuration, and I've found this:

FTPD_LOG = /var/log/secure (restricted UI item)

Obviously, this can't be right, because /var/log/secure doesn't exist. Should I change this value to /var/log/proftpd/auth.log?

I'm using DirectAdmin for a control panel. It's unknown to me if DA uses a different log file format....

HOWDY,
I set the watch dir to monitor a dir with 100 of files ...
I want it to notify me when a file changed and with the changed file name ...

Its always sending me all file name in the dir ... advise plz ...