ConfigServer Community Forum

Hello,

Has the idea of a rule cluster been explored?

I think it would great if we could use cPanel API tokens to have servers share their deny/allow rules or deny IP list with others servers in a cluster of servers since attacks often travel along IP ranges and what not.

Maybe a caching system that you can set the frequency of deny IP sharing.

And to stack on top of the idea of clustering,...

I think it will be a long time before counties are assigned IP blocks :) so you may want to change the spelling to 'Country's' on the config file for CSF:
An example would be to list port 21 here then counties listed in
CC_DENY_PORTS cannot access FTP

on cpanel I can set LF_CPANEL_ALERT to get a mail if a user login into cpanel. On the DA version I can't find such an option.

can this function also be made available for DA? would be very practical.

thanks

This option can mask a users real IP address and hinder security. You should disable WHM > Tweak Settings > Proxy subdomains

This option does not find out in cPanel v86.0.18

DSHIELD blocklist is now secured (http s ) at:

/etc/csf/csf.blocklists
# DShield.org Recommended Block List
# Details:
#DSHIELD|86400|0|

Apr 8 11:27:50 server lfd : Unable to retrieve blocklist DSHIELD - Unable to download: Can't connect to www.dshield.org:80 (Connection timed out)
Apr 8 11:32:50 server lfd : Unable to retrieve blocklist DSHIELD - Unable to download: Can't connect to...

Tried to find something that allowed checking of IPs against AbuseIPDB and then if found then block, but couldn't find anything out there.
Hence writing this up.

Hello.

We suggest to add to the csf.blacklist.

Thank you!

We are using the csf RELAYHOSTS setting to prevent lfd from creating temporary firewall entries for customers who successfully check email. We are not on cPanel, so the setting isn't normally there, but it works perfectly once added. We have a separate daemon that maintains /etc/relayhosts with the IPs of recent successful connections.

The problem is that during a csf upgrade it seems to strip...

Hello,

I report the option:

LF_SU_EMAIL_ALERT

does not send email when user run the command sudo with -i option:

sudo -i

Could you please let me know why? If it' s a bug, is it possible to fix it?

Thank you.

Best Regards,

V R

Hey guys,

It seems my server is getting a lot of failed SASL auth attempts via the maillog lately. This doesn't seem to be part of CSF's default configuration, so a lot of bad attempts got through!

I added a custom rule for LFD to ban these bad SASL people, but I highly suggest you make it part of the default csf.conf

Here is the tutorial I followed to implement the custom rules on my own...

The directadmin installation suggests that CSF config should be managed by the directadmin and we have to set some bruteforce settings to 0 or disable them. By doing this, the CSF will trigger few warning messages.

From what I've known, CSF use a special installation config file for directadmin called csf.directadmin.conf and it contains a generic variable DIRECTADMIN=1

If we can use this...

Cyberpanel is a new and amazing opensource Control panel that supports Ubuntu and Centos.

Github:

It uses Postfix/dovecot for email.

Openlitespeed/Litespeed for the webserver.

Overview of log files and differences.

Cyberpanel Control Panel Accesslog
/usr/local/lscp/cyberpanel/logs/access.log

Cyberpanel Control Panel errorlog
/usr/local/lscp/cyberpanel/logs/error.log

Cyberpanel Control...

Sometimes you need to make sure some client with dynamic IP will never be blocked by lfd.
However if you put the FQDN of the dyndns used by the client in csf.dyndns then you also allow this client to bypass the firewall completely, which is not the desired behaviour.
I suggest creating a new file, something like csf.dyndnsignore, that will have the behaviour of csf.ignore, but for dynamic dns.

This is probably a complete waste of time since none of the recent suggestions have had staff replies, which I find disappointing and would put me off of purchasing or donating anything to CSF...

Anyway, I have just set WHM to email me with alerts, and decided to add Pushbullet for more severe alerts. I thought it wasn't working when I didn't get login alerts but realised this is from CSF. I...

Always after patching Dovecot CSF gives:

Cipher list []. Due to weaknesses in the SSLv2 cipher you should /etc/dovecot.conf and set ssl_cipher_list to explicitly exclude it. For example:
ssl_cipher_list = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP

This ssl_cipher_list parameter is set in /usr/local/directadmin/custombuild/custom/dovecot/conf/ssl.conf
And via build dovecot finally also in...

Hello,

I'd like to request that the automated abuse reports produced contain the destination (attacked) IP address in their opening line.

The reason for this is that CSF only takes the hostname as written in /etc/hostname , which is not an FQDN on many Linux distributions.

There is plenty of (unrelated) discussion about as to whether this file should contain an FQDN or only system name, but...

Since 99% of our CSF use is to block IPs it would sure be nice if CSF would remember what tab we have chosen. We always select the CSF tag to keep the Block IP field at the top, otherwise we have to scroll down to get to it. When we block an IP and return to the main page our tab selection is lost.

Thanks for an amazing product!

Dana

Currently, it is a pain to add custom port allow rules as they have to be crafted by hand.

I just noticed that the -ta, --tempallow option has this functionality. but the main -a add ip does not.

-ta, --tempallow ip ttl
Add an IP to the temp IP allow list (default:inout)

root@ols:~# csf -a 1.2.3.4 -p 1812 Allow Radius
iptables: No chain/target/match by that name.
ACCEPT tcp opt -- in !lo out...

Possible root compromise: File /lib64/libkeyutils.so.1.9 exists and /lib/libkeyutils.so.1.9 exists.

For more information see:

This file is part of keyutils, part of the Linux kernel. If lfd is not checking the hash of the file matches a compromised version (it doesn't), then don't report it. This library has been around and been installed for years. Only when I updated to the 1.9 so version of...