ConfigServer Community Forum

Hello, it's possible to read the country code in a the customer regex? In my case, I want to block xmlrpc attacks on all countries except spain. Something like this will run? if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) and ($cc != ES) \/xmlrpc\.php.*" /))...

Same issue here on servers running AlmaLinux 8

Subject: lfd on hostnamet: SYSLOG Check Failed

Message:

Time: Wed Oct 12 09:50:21 2022 +0200
Error: Failed to detect code [EboXrlKqf8S7cU5sxI1y8gPEsp] in SYSLOG_LOG [/var/log/messages]

SYSLOG may not be running correctly on hostname

Hi, I would like to run my own script when an LFD alert is generated.

Is this possible?

Thank you!

Hello, we have a server that needs to be able to access mysql with the root user. We have blocked port 3306 globally. And allowed the authorized IP in csf.allow with the following format: tcp|in|d=3306|s=x.x.x.x We check that it works fine, but we have found a strange log: cat /var/log/mysqld.log | ...

Hello, in csf.pignore instead of this: exe:/opt/cpanel/ea-php56/root/usr/bin/lsphp exe:/opt/cpanel/ea-php70/root/usr/bin/lsphp exe:/opt/cpanel/ea-php71/root/usr/bin/lsphp exe:/opt/cpanel/ea-php72/root/usr/bin/lsphp exe:/opt/cpanel/ea-php73/root/usr/bin/lsphp exe:/opt/cpanel/ea-php74/root/usr/bin/lsp...

Hello, I have configured this regex.custom.pm # setup-config if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) \/wp-admin\/setup-config\.php.*" /)) { return ("setup-config attack",$1,"setup-config","20","80,443","360...

All the twentyfourteen in my server are detected as exploit. Is true? Content of the file cxs[163898]: ['/home/xxx/public_html/wp-content/themes/twentyfourteen/js/featured-content-admin.js'] - Suspected exploit file /** * Twenty Fourteen Featured Content admin behavior: add a tag suggestion * when c...

Hello, is possible to install CXS on a non-cPanel server? Just to scan files on a CentOS (or any Linux) server via shell. No need interface.

+1 Time: Wed Feb 18 21:08:29 2015 +0100 PID: 7905 (Parent PID:7904) Account: cpanellogaholic Uptime: 119 seconds Executable: /usr/local/cpanel/3rdparty/php/54/bin/php-cgi Command Line (often faked in exploits): /usr/local/cpanel/3rdparty/php/54/bin/php-cgi -d display_errors=0 -d log_errors=1 -d erro...