ConfigServer Community Forum

Hey All,

Not sure whats causing this but none of our cpanel accounts are receiving emails. Sending works fine. All the correct ports are open in config and receive fine if CSF is disabled. Removed and reinstalled and same issue. Any idea?

Thanks

AlmaLinux: v8.9.0 Standard KVM
cPanel: 120.0.8
CSF: 14.20
Perl: 5 v26

Hi, this may not be anything to do with csf/lfd per se; just checking.

Just elevated from CentOS, and am getting lfd notification emails every 10 minutes:
Error: Failed to detect code in SYSLOG_LOG

And cron messages being sent every hour:
logger: socket /dev/log: Connection refused

Manually sending messages via logger...

Hi Team,
I am using ubuntu 24.04 server minimal using virtualmin pro
Replaced fail2ban with CSF. i keep getting bruteforce attacks or unsure what it is from mail logs please see below assist me with regex codes. apologies just a beginner

warning: unknown : SASL LOGIN authentication failed: authentication failure, sasl_username=shosabu
May 23 15:08:23 server.com postfix/smtpd : disconnect from...

Hi,
Someone can be able to explain me why port 465 works on my CSF Firewall ? I don't have set this port in TCP_OUT and TCP6_OUT. When I use below command, it works.

openssl s_client -connect smtp.gmail.com:465

In CSF I found in Firewall Configuration these parameters but I don't know how they compare to TCP_OUT

SMTP_BLOCK = ON
SMTP_ALLOWLOCAL = ON
SMTP_PORTS = 25,465,587

Blocking countries in CC_DENY from Country Code Lists and Settings blocks access to some domains and their websites on the VPS.
We have to restart CSF to gain access, and so every time we are unable to access without making any changes to CC_DENY, we have to restart CSF again.

Using ConfigServer Security & Firewall 14.24

For some reason CSF/LFD isn't sending out emails notifications for Webmin logins.

SSH notifications work fine.
Se do email test from the CLI.

The option to send alerts is set to Enable: LF_WEBMIN_EMAIL_ALERT = 1

RESTRICT_SYSLOG is set to 3.

Any suggestion would help.

Hello all,

I have been grappling with understanding why some of my sites on my server are always sending me these suspicious process emails (via CSF) related to php-cgi and php-fpm. It appears to me that the issue most of the time is related to an outbound network connection the script has opened. In this specific instance, the remote connection is to 172.64.145.91:443 which is a CloudFlare...

Recently we've added the UptimeRobot IPs from to our CSF allow list (using Include of a separate file).

For each IP, we've added icmp|in|d=ping|s= and tcp|in|d=80,443|s= .

On some servers running CloudLinux 8 with cPanel, we've got this error after restarting CSF:
csf: IPSET creating set chain_ALLOW
csf: IPSET creating set chain_6_ALLOW
csf: FASTSTART loading csf.allow (IPv4)
csf: FASTSTART...

We are trying to block access to a web server when there is no user agent and not referrer. Example log lines look like this;

40.##.##.## - - GET /wp-admin/css/colors/Admin-Author.php HTTP/1.1 500 17551 - -

The code we put in regex.custom.pm is like this:

if (($globlogs{CUSTOM2_LOG}{$lgfile}) and ($line =~ / - - $/)) {
return ( No User Agent ,$1, UserAgent , 20 , 80,443 , 3600 );
}...

Hello,

We'd like to use the LF_APACHE_404 option to block IP's getting multiple 404 errors. The issue is it appears to be based on HTACCESS_LOG and that is set to /usr/local/apache/logs/error_log. Even if that was pointing at the access log, it's the main Apache log, not the hosted site logs. What would the side effects be if we change that to be /var/log/apache2/domlogs/*/* ?

Thanks in advance

Hello,

I'm experiencing an issue where the custom firewall script csfpost.sh is no longer executed automatically, likely after the recent cPanel or CSF update on March 19, 2025.

Environment:

cPanel servers running CloudLinux 8 & 9
Imunify360 installed
ConfigServer Firewall (CSF) / LFD enabled
The script (/etc/csf/csfpost.sh) contains custom iptables rules, for example, to allow outgoing...

We have recently been having an issue with JetBackup restoration processes getting kill by CSF. If we disable CSF the restoration process goes off without a hitch. Troubleshooting with CPanel and Jetbackup we narrowed this down to CSF killing the mongod process for JetBackup.

So per JetBackup support we placed exe:/usr/local/jetapps/usr/bin/mongod in the pignore file. This worked for a while but...

Hello,

I'd like to test a custom rule in regex.custom.pm, whats the best way to test this manually, so I can debug it?
I added a print statement in there, however it's not being shown if I run /etc/csf/lfd.pl -f .

Thanks

Hello,

To spot some hacked websites and some virus, I'd like to have a log of all outgoing traffic on a list of specific ports. Is this achievable on CSF or I have to manipulate directly iptables?

Thanks in advance.

I have an AlmaLinux 8 server running CSF + LFD, using ipset for a larger corpus. Load looked very, very high, and I noted in the web server logs that IPs which were blocked in CSF were hammering some of my domains. So I did a systemctl status on iptables. It responded that iptables was dead . systemctl status csf showed that CSF was running.

I did a systemctl iptables start , and load plummeted...