ConfigServer Community Forum

Hi,
I'm the VP engineering at CrowdSec.

I was wondering if CSF could get an option to send its signals to CrowdSec, and in return, the user would get the community blocklist associated with those signals.

CrowdSec supports custom signals, and by using CrowdSec, all CSF users would benefit from a tailor-made blocklist on signals from other CSF users and a global blocklist for global signals they...

Hello,

I'd like to provide some feedback on the Server Check feature.

I've gotten scores up to around 95+ on all our WHM servers but I feel there are some items on there that aren't really bad conditionally. Obviously I've just been ignoring them so far as I understand why they can be ignored, though they could mislead other people.

Server Check

Check for cxs: You should consider using...

Hello,

For the last 24 hours or so, I've been getting e-mails saying that lfd failed to started due to a CHAIN_ADD failed (Device or resource busy) error. When I run the test iptables check in CSF inside WHM, it reports the following:

Testing ip_tables/iptable_filter...FAILED - Required for csf to function
Testing ipt_LOG...FAILED - Required for csf to function
Testing...

This started recently and I can't figure out what is causing it.

Hotmail, outlook, gmail, yahoo, client domains, configserver.com - with CSF enabled no mail is being received, but it appears all outbound email is working fine. If I disabled CSF all the mail starts coming in again.

I made no changes to CSF that would have caused this.

TCP_IN ports:...

I have a GoDaddy dedicated VPS. At least 6 weeks ago, if not longer, GoDaddy began changing all server host name formats and retired the original format on Sept 15th.

Old format: ip-72-167-111.222-ip.secureserver.net
New format: 222.111.167.72.host.secureserver.net

And about 6 weeks ago I began experiencing problems where my server could no longer connect to outbound services like automated...

Hi there,

Recently we've started getting refused connections to other hosts from multiple servers, nothing is set to block these on the outbound server and a traceroute will follow the whole route bar the destination machine itself. As soon as CSF is turned off, connection can be established and traceroute completes; which would imply the server is blocking something this end thats necessary for...

Hello,
When messenger service is active, and specific subnet is blocked (in csf.deny), but one IP address of this subnet is whitelisted (in csf.allow), the user (whitelisted IP) is still being redirected to messenger service.
I think it because of IPSET chains order, messenger chain before allow chain.

for example:
csf.deny
192.168.1.0/24

csf.allow
192.168.1.100

csf -g 192.168.1.100...

hello, please advice
i have default settings, all working and 99% of clients can use ftp, but always i have 1% of clients who cannot login to ftp, no logs.
how i fix that> i add their ip to csf allow and to brute whitelist, then they able to login.
for example now clients from russia cannot login from different ips

Status: Finding an IP address for ftp.test.ee
Status: Connecting to...

hi,

i wish i could use the LF_NETBLOCK function of csf in directadmin. this function would allow me to have a list of really malicious ip while avoiding false positives. BFM works very well, but many users are blocked very often because they are unable to configure an email client. the function of CSF would help me to better manage the problem. afterwards, the generated list of csf.deny is sent...

For few days i have been receiving errors from users trying sending email to Gmail accounts that spf/dkim is not showing
than another domain that ptr is not working.
I have Assp Running so i tought that was the issue but after disabling ASSP Services the error Continued.

Than i Turn Off CSF and all emails started going trough so was happy but than 2 hrs later it started getting block again.......

Hello, we want exclude a spesific user or spesific process for mail notification with csf.pignore.

Mail Notifications:
1
Excessive resource usage: username

Time: Tue Jun 29 15:59:06 2021 +0300
Account: username
Resource: Process Time
Exceeded: 1818 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/php/73/sbin/php-fpm
Command Line: php-fpm: pool user_username
PID: 6898 (Parent...

How to create firewall group inside CSF and block all IP's using shodan.io?
An example:

The include option in /etc/csf/csf.allow no longer loads the rules

Hi guys

Is there any special requirements for running CSF on cPanel / AWS EC2?

I installed CSF using the default installation instructions and once installed, I no longer had access to the server, cPanel urls or SSH. I had to manually uninstall csf through the AWS console.

Has anyone had experience running CSF on an AWS server?

Thanks

Infusedhosting

We have monitoring set up to monitor /var/log/httpd/domains/*.log right now, but we would actually like to exclude one specific something.log file from that pattern. Is that possible somehow with the GLOB functionality that CSF is using here?

Hi all,

I installed csf on a fresh server, without cpanel or webmin, and I'm using it correectly. LFD seems to work fine, and the SMTP login failures part of csf too.

The problem is when activating the option:
LF_APACHE_404 = 100
LF_APACHE_404_PERM = 600

I receive a lot of 404 errors (maybe a DoS attack) but csf doesn't ban the ip.

How does csf blocks the ip? What criteria does csf...

I am getting these lfd emails constantly lately. Can anyone tell me what I need to do to fix this please?

Time: Mon Aug 15 08:00:23 2022 -0400
Error: Failed to detect code in SYSLOG_LOG

Emails are the same except the code is different each time.

Gunstra

Whenever csf updates it produces an output like:

‘csf.blocklists’ -> ‘/etc/csf/csf.blocklists.new’

this is totally confusing. If it's new that would imply it is replacing the old file. Yet, how can it be new AND functional if it's labelled something like csf.blocklists.new

Are we to assume the old (not new ) is still in use?

Or, is .new the new new ?

Totally confusing and without any...

Hi, I would like to run my own script when an LFD alert is generated.

Is this possible?

Thank you!

So we have had an issue with some updates coming down for WHM - and in the process we discovered that the server was blocking a specific range of IP adresses.

If you search for the IP via the WHM gui you get this return

Table Chain num pkts bytes target prot opt in out source destination

filter CC_DENY 93147 1686 80924 DROP all -- * * 162.55.0.0/16 0.0.0.0/0

But if we try to unblock that...