ConfigServer Community Forum

I use Centos 7 with directadmin on a VPS

Ever since I installed CSF+LFD and Fail2ban I see these incoming udp (which gets blocked) lines on port 33445 every 10 seconds in my /var/log/messages. All these have the same source aswel.

Jul 6 23:47:10 nlamswsp01 kernel: Firewall: *UDP6IN Blocked* IN=eth0 OUT= MAC=33:33:00:00:00:01:52:54:00:d5:04:93:86:dd SRC=fe80:0000:0000:0000:5054:00ff:fed5:0493...

Hi All,

We are seeing the below error on a few servers and I am wondering if it is related to the recent upgrade of csf - anyone else seeing this?

Jun 23 19:10:46 xxxxx lfd : *System Integrity* has detected modified file(s): /usr/sbin/csf /usr/sbin/lfd /sbin/csf /sbin/lfd
Jun 23 19:10:46 xxxxx lfd : Unable to send SMTP alert via : Invalid argument at /usr/sbin/lfd line 6381.

Jun 23 19:10:46...

I tried reinstalling and that didn't help, Any ideas what I need to do?
Ubuntu Server 15

● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: enabled)
Active: failed (Result: signal) since Sat 2016-07-02 00:30:24 PDT; 21min ago
Process: 4911 ExecStart=/usr/sbin/lfd (code=exited, status=0/SUCCESS)
Main PID: 4914...

Hi Sirs,

I recently uninstall and install the CSF+LFD Services in my VPS Server. It resolve my last problem ( but now all works fine except FTP Service that login fine but cant display directories -no matter what client I use (FTP_Lte, FileZilla, FTP_Pro). The only way to access and works fine is adding the IP to the .

Since it´s impossible to add all clients IPs I ask about some advising, I...

Hi Sirs,

Since the last restarted at 00:30 hours aprox, mys LFD status shows: Status of lfd:lfd dead but pid file exists . I restarted but nothing changed. I erase all IPs blocked in permanent area more than 120 and nothing.
Any idead what is the problem?

regards,

Fernando

I currently have the default cpdavd whitelist rule in place, but it's not working:

exe:/usr/local/cpanel/cpdavd

Here is the alert I am receiving:

Executable:
/usr/local/cpanel/3rdparty/perl/514/bin/perl

Command Line (often faked in exploits):
cpdavd - authenticated as someuser

Can someone suggest the best way to whitelist this one?

Thanks in advance.

- Scott

Hi,

I'm trying to install CSF on a very old server running RHEL 3 ES. I'm getting the following errors,

service lfd restart
Stopping lfd:
Starting lfd: import is not exported by the Exporter module
Can't continue after import errors at /usr/local/csf/lib/ConfigServer/Slurp.pm line 15
BEGIN failed--compilation aborted at /usr/local/csf/lib/ConfigServer/Slurp.pm line 15.
Compilation failed in...

Hello, i am new to linux i recently installed CSF on my server and i dont know what bad i configured after that i am not able to install any plugin through wordpress plugin directory it says couldn't connect to host
also copy function not working cannot copy anything from remote server using pHP.
When firewall is disabled everything works perfect
Thanks

Time: Sat Jun 25 18:16:39 2016 +0200
PID: 32341 (Parent PID:32341)
Account: rpc
Uptime: 62454 seconds
Executable: /usr/sbin/rpcbind
Command Line (often faked in exploits): /sbin/rpcbind -w

I tried to Add ignore rules here: nano /etc/csf/csf.pignore like this:

pcmd:/sbin/rpcbind -w

cmd:/sbin/rpcbind -w
user:rpc

This still did not stopped the emails to arrive? Anything I miss here? I also...

hello

regex.custom.pm has:

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /ModSecurity.*Warning. Operator GT matched 3 at IP/)) {
return ( mod_security wp_login triggered by ,$1, wplogin , 1 , 80,443 , 1 );
}
if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /ModSecurity: Warning. Pattern match 200 at RESPONSE_STATUS/)) {
return ( mod_security wp_login triggered by ,$1, wplogin , 3...

Hi, I've been using CSF for around 6 months with no issues, but in the last 48 hours, presumably an update, I now get the following response when trying to access the menu page (.../cgi/addon_csf.cgi) in WHM:

Internal Server Error: 500
No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/addon_csf.cgi) with exit signal: 9
cpsrvd/11.34.2.8 Server at ds197305-1.lcnservers.com

The...

Hi all
I've got a problem with csf cluster of my 3 servers: only one of them can succesfully ping others.
This is my cluster config:
server01 (192.168.10.141):
CLUSTER_SENDTO = 192.168.10.141,192.168.10.154,192.168.10.155
CLUSTER_RECVFROM = 192.168.10.141,192.168.10.154,192.168.10.155
CLUSTER_MASTER = 192.168.10.155
CLUSTER_NAT = xx.xx.xx.155

server02 (192.168.10.154):
CLUSTER_SENDTO =...

Hi,

How can enable remote connections to mysql database on port 3306

for example for the IP 192.100.172.192

Thanks.

Hello
Google keep changing smtp ip addresses, How to enable smtp.gmail.com and pop.gmail.com in the CSF as hostname?

Just installed a Comodo SSL and I've been having problems periodically with reaching the site.
- When I disable CSF, I get straight through.
- When I restart CSF, I get straight through ... until it happens again.

I've created a cron job to restart CSF every 2 hours, but this is not a permanent fix.

What setting in CSF could be causing this?

I've talked with Comodo support and they get the...

hello there,

I have a server with custom regexp, but the regexp seems not able to be applied.

Am I forget something ?

CUSTOM2_LOg = var/log/exim/reject.log

regex example:

#!/usr/bin/perl
###############################################################################
# Copyright 2006-2016, Way to the Web Limited
# URL:
# Email: sales@waytotheweb.com...

Hi,

Apologies if this has already been covered before, but my initial search in the forum was not very helpful.

What I am trying to achieve on my cpanel server is, If a user from an IP is making multiple requests to any URL on our website, I want that IP to be blocked for sometime. We have no clue how can this be achieved. Any help will be appreciated.

So if an (IP) is making (n) requests to a...

Because of OVH's bug with blocking download.configserver I need to manually upgrade our servers.

Just wanted to be certain the install.sh is smart and can determine upgrade vs install by itself.

Looking at the source in CSF, it appears so, but just wanted to double check I wasn't missing any environmental variables, etc. before I accidentally clobber something. And it looks like csf+lfd should...

Hello! I'm sorry if this has been covered elsewhere; I couldn't find more info on it.

I'm trying to set up advanced port+ip filtering using the following rule:
tcp/udp|in/out|s/d=port|s/d=ip

My first question is, what's the correct syntax for this? My initial thought was this:
tcp|in|d=993|s=123.456.0.1
OR
tcp|in|d=993|s=123.456.0.0/15

... But I'm not sure if this is correct.

My second...

Hello,

I have CXS configured in all my servers, but I am having an issue with one of my clients

He uses his website on a classroom and where he has more than 20 to 30 students on the same classroom the CSF blocks his IPS,

What is the variable where I configure this for a higher number of simultaniuos connections under the same IP?

Regards