ConfigServer Community Forum

Hi, I'm using Mandrill's SMTP sending method, which works OK but periodically (sometimes 1 day, sometimes 5 days) stops working. At that point if I go into the CSF configuration and simply click Change without changing anything, after it reloads CSF and LFD the mail sends again.

The error message that shows when it stops working is smtp error: could not authenticate.

The SMTP is set to send...

I have done a look through the forum and (amazingly) didn't find anything that matched - so, I guess I used the wrong search term!

I am testing (hence the seemingly strange restrictive values) my SSH Configuration and have these settings:

LF_TRIGGER = 1 (I don't care what service you try to access)
LF_TRIGGER_PERM = 1 (permanently block)
LF_SELECT = 0 (complete block)
LF_SSHD = 1 (active)...

What does this mean?

Excessive resource usage: lotusm (549 (Parent PID:23184))

Time: Fri Nov 15 10:09:15 2013 -0800
Account: lotusm
Resource: Process Time
Exceeded: 3261 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/perl/514/bin/perl
Command Line: spamd child
PID: 549 (Parent PID:23184)
Killed: No

Hi,

It appears that after an upgrade from CSF/LFD v7.58 to 7.59 (01/27/15) the System integrity check e-mail is no longer being send on one of our servers.

I've already tried to solve this by restarting the firewall and changing LF_INTEGRITY from 3600 to 0 and then back to 3600 again, but this did not fix it.

Any ideas would be appreciated!

The server is running CentOS 6.6, WHM 11.48.0 build...

Hello,

This is happening on a brand new server. (I.e. which was setup recently running latest cP with mod_security and CSF + CXS setup)

I have white listed Google bot, pingdom and Cloudflare IPs in csf.allow but they keep getting blocked due to mod_security (cPanel's new mod_sec rules are messy)

See the example.
root@server # csf -g 188.138.118.144
Chain num pkts bytes target prot opt in out...

Hi @ all,

how can I enable full access to a IP address? With full access I mean on any port range TCP and UDP, without having to add this port to the TCP_IN.

I've tried it with csf.allow but looks like it's not opening all ports.

Thank you very much in advance.

Regards
Andreas

I currently have LFD configured for 400 Ip blocks, which is filling up fast.
I understand that once the table has reached 400, they will fall off the end.
What's a reasonable upper limit without causing too much overhead ?

Hello, i'm new here. I have 2 vps and i have installed CSF. Can someone help me to configure corectly? I was attacked several times. Thank you.

Hi there,

I have used CSF for a number of years and never had an issue with it. All of a suden I have lost ALL access to the server. Thankfully it is running as a VPS and I can reboot it and its fine for approx 10 mins then locks again.

The ONLY way to fix this is to disable CSF and then the server is fine.

I have tried getting support but got told to ask her so I am kindly asking for some...

Hello

We have set max ip csf.deny 1000

Is it possible auto flush all blocks when csf.deny reached on 1000 entries?

Regards

I keep getting blocked if I use more thna a couple options in WHM. Yet the block doesn't show in the CSF block table. maybe a temp block or something with iptables.

Basically I logged into the WHM saw CSF was off, started it and I was blocked shortly after.

So I flushed csf -f and I had access again.

But within minutes csf stopped running and I was blocked.

I see this in the messages log a...

Hi since cPanel has upgraded, we are now using cpanel logaholic (which looks really good) we are getting Suspicious process running under user cpanellogaholic, I dont want to ignore the executable /usr/local/cpanel/3rdparty/php/53/bin/php-cgi
is there any other way to stop the warnings?

thanks in advance,

Executable:

/usr/local/cpanel/3rdparty/php/53/bin/php-cgi

Command Line (often faked...

I would like to aggregate logs from multiple servers to some service like FluentD or Logstash + Kibana + Elasticsearch.

I know that CSF (LFD actually) can log everything to syslog, but there is a huge difference between information in syslog and e-mails which are sent to some mailbox. So the question is - is there a way to enable e-mail like logging to disk (where e-mail like equals all...

Hi,

I'm trying to setup csf firewall on hostgator vps. I'v setup csf firewall on multiple servers before and never had an issue with it .

Unfortunately on this server each time I enable csf firewall, all traffic is beeing dropped.
e.g.
Feb 14 02:08:25 hostname kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=Macaddres SRC=UserIP DST=ServerIP LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=52420 DF...

Could someone point me in the right direction because I feel quite lost.
I have tried to search for an example or clue on this forum and Google. But I can't find a working custom regex.

I'm on a Debian server with DirectAdmin

The following is found in /var/log/proftpd/auth.log
ProFTPd 123.123.123.123 PASS (hidden) 530

Since this format is not caught by default I have tried to create a custom...

I have a question about using IPSet with CSF. I'm fairly familiar with IPset but I'm not sure how it works with CSF. For example:

# ipset create bruteforcers hash:ip hashsize 4096
# iptables -I INPUT -m set --match-set bruteforcers src -j DROP
# ipset add bruteforcers 128.230.193.152
# ipset test bruteforcers 128.230.193.152
128.230.193.152 is in set bruteforcers.
# iptables -L | grep...

Hi all,

Need some advice.

LF_MODSEC = 5
LF_MODSEC_PERM = 300

LF_CXS = 1
LF_CXS_PERM = 300

I have the following settings and have Modsecurity, CXS and CSF installed though IPs are not being blocked after 5 ModSec hits:

ModSecurity: Warning. Pattern match 200 at RESPONSE_STATUS.
ModSecurity: Warning. Pattern match 200 at RESPONSE_STATUS.
ModSecurity: Warning. Pattern match 200 at...

i have ConfigServer Security & Firewall - csf v6.43 installed on my cpanel server

iam getting too many email alerts as the most of them are like
SSH login alert for user root from XXXXXX

XXX is my ip address. can i exclude my ip adress from the watch list? so i dont recieve such emails alerts if it come from my ip, but still check other ip addresses?

Back when accessed the whm, was receiving an email alerting access to IP, I'm not getting the message, since version 7.54

Hi.
Our VPS provider has its own account on our servers with UID 0.
LFD is alerting me to a possible root compromise on this account constantly.
Is there a way to turn off the alerting for a single account?
eg tell lfd to ignore account with name VPS-provider .

I know how to turn off the system exploit checking completely but for security reasons i dont want to do that.

Thanks