ConfigServer Community Forum

We have found that if a user is in a screen or tmux session and they su or sudo su an alert is not fired. If the user exits their screen/tmux session, the alerts will fire just fine.

It seems to be poorly documented that who am i does not properly return a user when the session is in screen/tmux. However, logname and other env variable such as $SUDO_USER will return the base user.

Is lfd making...

Im getting 2 emails an hour about a maintenance process using wget

Ive tried adding the process to a ignore files a couple different ways and have not been successful

Any pointers would be helpful

Time: Mon Apr 11 07:01:44 2011 -0500
PID: 18054
Account: taccpount
Uptime: 102 seconds

Executable:
♦

Command Line (often faked in exploits):

wget -q -O /dev/null

this server has been...

I recently made a change in one of my firewall settings and was going to restart csf and lfd. However, there is an error regarding the CLUSTER_PORT that I don't understand. That's not a change that I made and it is saying:

CLUSTER_PORT sanity check. CLUSTER_PORT = . Recommended range: 1023-65535 (Default: 7777)

When I go and look at the Cluster port section of the firewall, it's not a field...

Run

/scripts/upcp --force

And try again

Hi, folks. I've seen a few posts around the web about this problem from other OVH customers, but sadly no solutions... I've gotten a bit further than previous posters, but now I'm stuck. Can anyone point me in the right direction?

I've set up csf on a dedicated CentOS server at OVH. It's using a 3.8.13 kernel that they've compiled, rather than the stock 2.6.X kernel. It works great except for...

The ? i have is:

Why are ip's that i have entered into the Quick Deny fnc still getting thru the Firewall attempting to login to my wp admin panel? I have set the security level to Medium.

:confused:

Hello

I have server with cpanel/WHM on board and 2 IP, 1 public and 1 private.

What need is to deny to user to ping private lan, because private lan must still to internal usage.

cpanel support reply us this:
I see CSF Firewall is installed so you may want to look at adding specific port and destination rules in /etc/csf/csf.deny and /etc/csf/csf.allow.

Any idea ? I don't know if this is...

hi

how can i allow specific port for specific ip using GUI web interface?

We are being hit hard by a botnet and hundreds of ip's are poring in requesting many requests , in order to mitigate attack we set

CONNLIMIT = 80;200

and
PORTFLOOD = 80;tcp;200;5

the original was to set those at 80/20 but Softlayer admin says that we should count how many links ( a href ) we have on the pages,

on each page we have no more than 15 images loading but we do have plenty of...

Hi
I wanted to ask since released software version CSF
I have full of people who can not get into my server
I wanted to ask with this new feature related to UDP packets
What should I name this feature set
I defined as:
UDPFLOOD = 1
UDPFLOOD_LIMIT = 70 / s
UDPFLOOD_BURST = 250

UDPFLOOD_ALLOWUSER = named

Is this a good bank or abnormal at all?
Still I get UDP attacks is not clear why it blocks...

Hi guys,

I am trying to allow a whole class C IP but the quaded IP I have entered doesn't work.
I wanna allow IPs that are 12.162.XXX.XXX

Here is the setting: 12.162.0/24.0/24

Am I missing something???

My Server is:
CENTOS 6.4 x86_64 vmware – server
WHM 11.38.1 (build 15)

CSF just upgrade to ConfigServer Security & Firewall - csf v6.26

Since then, I have a peculiar problem. In WHM CSF status is Enabled but Stopped
I can start it. It shows everything is fine. 5 minutes later it say Enabled but Stopped.

Before the upgrade, it was running fine. No new changes. No error messages. The best...

Hi

I have several hosting accounts on my cPanel server, however for one of the accounts I want to disable access to all connections apart from 1 specified IP and port (including disabling apache access).

The account has a dedicated IP address.

Is it possible to do this?

Thanks

Hallo,

I was wondering if CSF can keep up with 10gbit internet. Does anyone have experience with it?

Best Regards,

Laurens

I've problem to install csf in gentoo i'm getting this error Error: /sbin/ifconfig (ifconfig binary location) -v does not exist!, at line 2161

root@server# sh install.generic.sh
Installing generic csf and lfd

Check we're running as root

Checking Perl modules...mode of 'os.pl' changed from 0755 (rwxr-xr-x) to 0700 (rwx------)
Configuration modified for Debian/Ubuntu/Gentoo settings...

i have already ConfigServer Security & Firewall

but i i have installed the following plugin

http:// knowledgelayer.softlayer . com/procedure/install-and-configure-advanced-policy-firewall-apf

acutally its showing sucessful .. but not shown in plugins list ,..

After this

ConfigServer Security & Firewall is stopped .. when i click start its showing started then again automatically stopped...

Hello

i am using your csf service for 2 dedicated server where i got almost all next day attack report from different IP address on both server with same computer name:

1.
Time: Thu Aug 18 11:46:45 2011 -0500
IP: 183.1.164.118 (CN/China/-)
Failures: 5 (smtpauth)
Interval: 300 seconds
Blocked: Permanent Block
Log entries:

2011-08-18 11:46:24 dovecot_login authenticator failed for (ylmf-pc) :...

Hi, I'm new to starting using CSF. Using this in my WHM/Cpanel account. I've done a recent install and I experience my web site does not launch giving me This web page is not available ... If I disable CSF then the site loads ok and after it loads fine I re-enable CSF and site continues to load ok with out the error. Wondering to know why?

Also, a second issue I find is that when I initially...

Good Morning,
i had a trouble with CSF
i'm always have high DDOS Attack 50 M, 100 M .. etc
i'm always blocking all ips that making high connections but when i block it
it's non response before 20 mins !
i'm using csf -d IP , sure csf blocking them automatically and if i found these ips repeated more than 5 or 7 times
so how can i blocking these ips immediately ? btw there's no high load ..

Tnx now work. Another question,

Cluster member x.x.x.x (IT/Italy/xxx.xxx) said, DENY x.x.x.x (IR/Iran, Islamic Republic of/-) - *Blocked in csf* for 3600 secs

How can I increase the secs of ban ?