ConfigServer Community Forum

Hi,

I have the LF_SSH_EMAIL_ALERT = 1 and I was wondering if it is possible to be alerted ONLY at root user login, and not when hosting account users connect SFPT.

Of maybe if I can whitelist certain users to be ignored.

Thanks!

Has this stopped working for anyone else? I don't think I changed any settings that would affect this, and I confirmed that the explicit settings for this feature are enabled, but for the last week or so I haven't been receiving emails for cpanel/root access.

Hello Everybody,

I am new to all this so have one query, How can i enable email alerts of Enable ConfigServer Security & Firewall Alerts to get each process, warnings, alerts via email ?

Thanks In advance for your help.

On March 7th, for the first time, some of the email notifications from lfd started showing up with no IP address. In place of the IP, they have this:

Time: Fri Mar 7 15:15:53 2014 -0800
IP: fe80:0000:0000:0000:0230:48ff:febc:7f1e (-/-/-)
Hits: 11
Blocked: Temporary Block

I'm letting you know this because it appears that someone has found a way around the port blocking (since there's no IP to...

I recently changed a few things on my server to require all ftp logins be 'ftp with tls/ssl (auth tls explicit)'... I noticed that the only way I can connect now is if I whitelist my IP address. What would cause this behavior in CSF and how can I correct the issue?

If memory is correct the only reason I whitelisted my ip was to prevent blocking myself during development/testing and the above...

hi all

i istalled csf and everything is normal but when i turn media proxy on for voip then the sound not passing and dead air hear i even opened all the ports but still the same

waiting for reply

Hi,

I set rules on CSF v6.47 and close ports on a dedicated running CENTOS 5.10 and WHM 11.40.1 with mod_security configured, all was working normally until lfd crashed and started sending notifications every 5 minutes attempting the automagicaly restarts and failures.

Actual Situation:

CSF is running on this machine
Do NOT flush the firewall

root@server #
root@server # /etc/init.d/lfd...

Hi,

it seems proftpd auth fails are not recognized. I've

LF_FTPD = 10
LF_FTPD_PERM = 3600

and ip are not blocked:

ProFTPd 175.44.6.117 USER xxxxx 331
ProFTPd 175.44.6.117 PASS (hidden) 530
ProFTPd 175.44.6.117 USER admin 331
ProFTPd 175.44.6.117 PASS (hidden) 530
ProFTPd 175.44.6.117 USER xxxx 331
ProFTPd 175.44.6.117 PASS (hidden) 530
ProFTPd 175.44.6.117 USER administrator 331
ProFTPd...

Those emails are not from lfd.

I have CSF, the latest version installed. At times I received a notice of an IP is being blocked but with this notification:

Blocked: Permanent Block (IP match in csf.allow, block may not work). However the IP address is not listed in the csf.allow file and they are not blocked. What might be causing this issue?

Brian

I'm receiving 100s of mails from my server containing the below error messages
lfd on server: SYSLOG Check Failed
Time: Mon Feb 24 14:10:51 2014 +0700
Error: Failed to detect code in SYSLOG_LOG

SYSLOG may not be running correctly

I've been in contact with cpanel support, and they suggested that I should consult ConfigServer because lfd is their product.

I'd like to solve the problems and...

I've got everything in place it seems...

UI = 1
UI_PORT = 6666 (left default)
ui.allow contains my IP
username and password set @ csf.conf
crt, csr, and key @ /etc/csf/ui

but still getting This webpage is not available when trying to access via I've even verified via SSH that CSF is listening on port 6666. Any suggestions of configs or logs to check? This is a CentOS 6.5 (final) x86_64 box....

Hi,

SMTP Port 465 Open/Enable in IPv4 & IPv6 Firewall configuration but still it is not allowing to connect Gmail,
Error : SMTP -> ERROR: Failed to connect to server: Connection timed out (110).

When i Disable ConfigServer Firewall, it get successful connect & send email via Gmail/Hotmail(Outlook . com) SMTP.

Hi,
Can anyone help me with this. My server provider have granted themselves root access with the username 'tagsupport'. I have no problem with this, but CSF alerts me of the fact literally every couple of minutes. Is there some way I can whitelist this user and/or suppress the alert?

Hi,

not sure if this happens only to me.
I tried to install csf in WHM 11.42.0 (build 21).

The installation is succesful, but i cant see the CSF icon in the plugins list in WHM.

other plugins like softaculous, clamav, are present.

Is it something to do with the new cpanel version ?

thank you

Hi,
in prior versions of CSF, I declared that any IP that makes eximsyntax errors were permanent blocked after 10 errors but now it is blocked only for 3600 secs without being modified CSF. Tried to find the option on where to set this again to permanent but there is no option.

How may I can set eximsyntax to block the IP permanently, I am using CSF 6.47

Regards,

Sergio

I have a new VPS hosted on an openvz node. I'm getting loads of Excessive resource usage / CPU time emails. E.g.

Time: Mon Mar 10 15:44:59 2014 -0400
Account: syslog
Resource: Process Time
Exceeded: 273300 > 1800 (seconds)

Executable: /sbin/syslogd
Command Line: /sbin/syslogd -u syslog
PID: 410 (Parent PID:410)
Killed: No

I know how to cancel these messages, but the CPU time is a little...

Can CSF be setup to block a HTTP post attack? We are getting tons of these requests:

178.239.58.59 - - POST /wordpress/xmlrpc.php HTTP/1.0 404 20531 - Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)
93.174.93.102 - - POST /wordpress/xmlrpc.php HTTP/1.0 404 19918 - Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)
80.82.64.177 - - POST /wordpress/xmlrpc.php HTTP/1.0 404 19918 - Mozilla/4.0...

Hi,
Let me start with this is a single usage server with one thing on it, an up to date WHMCS install.

All of the sudden for the past 2 days I have been getting variations of this:

Time: Sat Mar 1 21:08:17 2014 -0500
Account: mailman
Resource: Process Time
Exceeded: 29752 > 1800 (seconds)
Executable: /usr/bin/python
Command Line: /usr/local/cpanel/3rdparty/bin/python...

Using the variable CC_DENY I've blocked this range of countries

AL,AM,AZ,BA,BD,BG,BN,BY,CN,CZ,DZ,EE,GE,HK,HU,ID,IQ,IR,JP,KG,KH,KR,KZ,LA,LT,MA,MD,MM,MN,MO,MY,NG,OM,PH,PK,PL,RS,SG,SY,TH,TN,TR,TW,UA,VN,YE,ZA,ZM

Now I have a problem, a client can not connect to your provider, he uses the IP: 74.91.18.20

BUT, ip 74.91.18.20 is of USA , and that country is NOT blocked in my range

when I do a search...