ConfigServer Community Forum

Hello,

On one of our servers we received an email like:

Reported Modifications:

New account has been created with uid: gid: login: shell:

But nothing was changed for the root user.

grep '0:0' /etc/passwd
root:x:0:0:root:/root:/bin/bash

chage -l root
Last password change : , 2019
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between...

Hi Everyone,

I'm setup SoftetherVPN server on Linux Server, and create a local Tap Device, bound DHCP server on Tap (tap0) device.
If I disable CSF, client user can get IP by DHCP normal. But when enable CSF, client can't request an IP.

So, how do i allow DHCP on CSF? I have also allow dhcp IP range on csf.allow but nothing change.

Thanks for your help, guys.

Where there are no log lines to report, is it possible to have CSF not notify me of such.
Every morning I check my CSF logs.
It would be good if I didn't have to open an email log entry to find that there is nothing in there.

Basically, I only want to be notified when there is something that I need to see.

Not getting a response when trying to ping downloads.configserver or download. to update to a newer version than 13.07. Is possible my server IP is blocked for any reason?

Thanks

Hello,

sorry if i disturb you.

I have a problem when I order: csf -r in SSH. This error appears at finnaly: ERROR*: Country Code Lookups setting MM_LICENSE_KEY must be set in /etc/csf/csf.conf to continue using the MaxMind databases

Why does this error occur? It has not appeared so far.

Picture:

How can I fix this error? Please?

Thank you very much. Sincerely, Marius-Catalin.

Hello,

Could you help me, I see that lately the country of ip no longer comes.

Before..

I would like to know how to fix it, because I use this information to release ips automatically on my firewall.

An IP from China got caught by lfd trying to access a cpanel account. However, China is country blocked (CC_DENY), and the IP is in the blocked range, as confirmed by csf (csf -g output below). Can someone explain how the IP managed to access cpanel even though it is in iptables? Thanks.

csf -g 203.2.xxx.xxx

Table Chain num pkts bytes target prot opt in out source destination
No matches found...

Hey guys,
I'm trying to block all access to the server except from US and Canada, but it's not working.

My confiig is:
CC_ALLOW: US,CA
LF_IPSET: on
FASTSTART: off

Server is: CENTOS 7.7 kvm

I can still access domains using proxysite.com (EU), it should be blocking it.

Appreciate your help! :)

Cheers,
C.

I guess you are aware of this, or soon will be when you get back from your holidays, but an account is now required to use the free MaxMind GeoLite2 databases.

You will see errors like the following in lfd.log

CCL Error: Unable to retrieve GeoLite2 Country database - Unable to download: Can't connect to geolite.maxmind.com:80 (Name or service not known)

Hello all -

Looking for some input on how to allow PPTP / GRE connections. Allowing TCP port 1723 in the config is easy to do - but PPTP also requires a GRE packet type. How can this ben allowed?

Is it normal with active both:

CC_ALLOW_FILTER = UK, US

AND regex.custom.pm:

if (($globlogs{CUSTOM3_LOG}{$lgfile}) and ($line =~ /^.*\ .*(wp-login|xmlrpc).*/)) {
return ( WP whacker ,$1, WP_whacker , 1 , , 172800 );

to continue to receive alerts from non UK, US actors?

ps CC_ALLOW_FILTER = UK, US is active and working as ipset list shows both countries block lists active.

A recent post here on 31st December 2019 by Chirpy states:

Due to MaxMind changing their free download policy to require signup and a license key, a new option MUST be configured to continue to use Country Code lookups (CC_LOOKUPS). The option MM_LICENSE_KEY must be set to the key obtained from the MaxMind site. See:

I see no MM_LICENSE_KEY place holder in my csf install.

Can someone elaborate...

Hi to all of you,
I would like to wish you a Happy New Year 2020.
I am new here and I just installed a new CentOS 7 Plesk Server and I obviously installed CSF Firewall as recommended.
Installation went well and I also configured the csf.conf file.
Nevertheless I have an issue as on my other CentOS7 Plesk Server when I get the LFD Email Alerts (SSH Blocking) the country of the IP shows us as you...

Hey guys .
I just searched in forum and didn't find any thing related to my question so would you please help my to how configure CSF to watching any changed file in specific directory?
I gave FTP access to a freelancer and he's trying to develop some script but I don't trust him so I wanna to watch that directory .

I just edited /etc/csf/csf.dirwatch
and here is my code :...

Hi Team,

i'm looking for the best way to implement CSF. Currently my requirement is to have port 25,80,443 can be access from all over the world. However, certain ports like 465,587,110,143,995,993 only allow from malaysia.

currently i have set TCP_IN for 25,80,443
and CC_ALLOW_FILTER= MY CC_ALLOW_PORTS= 465,587,110,143,995,993

However, i notice that port 587 and 465 still able to be access...

Hi guys,

I have two servers, one fully configured by ConfigServer and the other a small local one with configfirewall set up.

The small local one I have configfirewall set up on: Now over the weekend, this email has been sent to me over and over again for different accounts. I honestly don't know what to make of it, i've tried everything to stop them. A common denominator of the users is that...

I'd like to allow 149.154.167.197-233 on port 443, but haven't been able to figure out how to do this in csf.allow

For one ip address I have:
tcp|in|d=443|s=149.154.167.197

But how do i get the whole range without having to specify each ip address on a single line?

Ever since the 28th November, the majority of lfd alerts i receive via email no longer have any body text.
This started off with the occasional alert not having body text (about 1 in 10) to now ALL of them not having body text.
It doesn't matter which alert: Excessive resource usage, Suspicious process, root access alert, blocked etc. are all affected.
The email headers are populated correctly....

Hi, we have a server on IBM CLOUD and we have installed CSF.

Yesterday we did two procedures by ssh:

cd /var/spool/exim/db
rm -f retry retry.lockfile
rm -f wait-remote_smtp wait-remote_smtp.lockfile
service exim restart

And:

/usr/sbin/exim_tidydb -t 1d /var/spool/exim retry > /dev/null
/usr/sbin/exim_tidydb -t 1d /var/spool/exim reject > /dev/null
/usr/sbin/exim_tidydb -t 1d /var/spool/exim...

Hi, I always install CSF on CloudLinux 7 + cPanel (Centos 7 + cPanel + Cloud Linux) and it works perfectly. But today I was setting up a new server and found that after installing CSF, the lfd service is failing to start.

I've tried restarting CSF and LFD trough SSH and WHM and no success.

When checking LFD status I get this:

lfd.service - ConfigServer Firewall & Security - lfd
Loaded:...