ConfigServer Community Forum

Hi,

Following investigation there is a change in Perl 5.38 which breaks LFD (see Debian 12 LFD issues by me in General Discussions).

As soon as one of the log files causes an error (e.g. is simply not present), all future log file reads on any file will fail until the error is cleared.

I solved this by adding a clearerr call before each log read, which is in the LFD file and the function...

Hi

Repeated maillog entries of the following form were not detected when they should have been (obfuscated):

Jun 6 13:28:17 vps dovecot: pop3-login: Disconnected: Connection closed: read(size=984) failed: Connection reset by peer (auth failed, 1 attempts in 2 secs): user= , method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, session=

Log entries like this are rare.

CentOS Linux release 7.9.2009
cPanel...

Adding the following rules to /etc/csf/csf.allow:

tcp|out|u=0
udp|out|u=0

Adds the following rules to iptables:

# iptables-save | grep 'ALLOWOUT .*uid-owner'
-A ALLOWOUT ! -o lo -p udp -m owner --uid-owner 0 -j ACCEPT
-A ALLOWOUT ! -o lo -p tcp -m owner --uid-owner 0 -j ACCEPT

But does not add the same rules to ip6tables:

# ip6tables-save | grep 'ALLOWOUT .*uid-owner'

There is no...

For some reason its seems that cluster members do not always respond properly when denying an IP address.

Cluster Ping (They all respond fine):

csf --cping
Sent request to 10.0.0.10, replied:
Sent request to 10.0.0.20, replied:
Sent request to 10.0.0.30, replied:
Sent request to 10.0.0.40, replied:
Sent request to 10.0.0.50, replied:
Sent request to 10.0.0.60, replied:
Sent request to...

csf: v14.17
MESSENGER config by default with MESSENGER v2 enabled

I'm receiving these mail alerts from the Messenger recaptcha:

Subject: lfd on server.domain.com: recaptcha ?ôЄÿê/¶7Ô³Æ >ßv¬£þlÄ ¡ƒÃƒà¤õ-qJ7L-°¤Úwyµ#w@/V{Õ[7ÀTÀKÕˆ=RN”¯c?‘æø˝5Ô¬Œ•šñ+é>þGãïo&ŽÌÒoskäÊcìƒÙnePü[|š§AñÂDõ¯|¤ð¸£ãº7 (Unknown)

Time: Mon Aug 21 11:50:34 2022 +0200
IP: ?ôЄÿê/¶7Ô³Æ >ßv¬£þlÄ...

Hello,

since one of the last updates, I suspect the very last one 2 days ago, LF_SU_EMAIL_ALERT is not working anymore.
This would be very important as working on a prod server.
LF_SSH_EMAIL_ALERT is working normally, but both LF_SU_EMAIL_ALERT as also LF_SUDO_EMAIL_ALERT (which I never use but enabled shortly for testing) do no send or even try to send an email at all. I followed the postfix...

Since upgrading to cPanel/WHM version 100, some (all?) dovecot login failures are no longer being caught by lfd. It appears that the log entries have changed eg

vps dovecot: imap-login: Aborted login (auth failed, 2 attempts in 17 secs):

has become:

vps dovecot: imap-login: Disconnected: Aborted login by logging out (auth failed, 2 attempts in 11 secs):

There is a reference to this in...

In my testing I wasn't able to get the LF_BIND login failure trigger to work. After checking some Centos7 and Centos 8 servers it looks like the BIND trigger in RegexMain.pm doesn't account for the hex value e.g. (@0x7f18041004f0) that is logged in Bind 9+ servers.

Broken (Currently used):

Fixed (I just added the (?: \S+)? to add a non-capturing group that is optional):

I hope this helps!

In my testing I wasn't able to get the MESSENGERV3 to work correctly on Debian/Ubuntu servers (It can't find the SSL certificates). It looks like there is a bug in the Messenger.pm conftree function because it can't process the relative includes used by default on Debian/Ubuntu.

The config used in /etc/csf/csf.conf :

MESSENGERV3 = 1
MESSENGERV3LOCATION = /etc/apache2/conf-enabled/...

Hi guys,
When you search for an IP using the Search for IP / Search iptables for IP address function and it picks up an IP that is blocked, an Unblock button appears below the search results.

However, when the same IP is inside the temporary or full Allow IP list, the Unblock button not only removes the IP from the blocked list, but from the allow list as well.
Please make it so that the Unblock...

In my testing I wasn't able to get the LF_APACHE_404 login failure trigger to work. I'm not sure if this is just a Plesk server issue or if this bug applies to Cpanel servers too.

From the stackoverflow post below it looks like in Apache 2.4.1 the 404 error code was demoted from the core:error to core:info log level as 404 errors are not logged to the error_log by default unless you set LogLevel...

Hi,

It seems that after installing CSF (using install.sh) script and then installing as Webmin module from /usr/local/csf/csfwebmin.tgz the link to csfimages is broken. The target ( /usr/local/csf/lib/webmin/csf/images ) NEVER there, and thus UI looks broken - no stylesheets are loaded, no images (errors are well seen in browser's console). It seems that generic install.sh script isn't copying...

Hi,

My CSF UI is broken. Try to inspect element on my chrome and get error on index line 168

There is no error on lfd log. And i just set TESTING=0, enable UI, fill username password and allow my ip for UI_PORT on csf.allow.

After enabling MESSENGERV3 on a Plesk server apache logs are full of these errors:

(13)Permission denied: AH00686: cannot read directory for multi: /home/csf/public_html/
(13)Permission denied: AH00686: cannot read directory for multi: /home/csf/public_html/
(13)Permission denied: AH00686: cannot read directory for multi: /home/csf/public_html/
(13)Permission denied: AH00686: cannot read...

After installing CSF on a CentOS 8 server with DirectAdmin, it is not running after setting Testing mode to Off .

In control panel it says Firewall Status: Enabled but Stopped , when clicking Start it does not really start.

Then in shell when I do systemctl start csf.service , it still does not start:

# systemctl status csf.service
? csf.service - ConfigServer Firewall & Security - csf...

On v13.06 Search System Logs page, a javascript error is produced in all cases due to the lack of the timer pause button id= CSFpauseID . While the pause button is omitted, the rest of the timer code is running and cannot set the missing timer button.

csf.cgi:2284 Uncaught TypeError: Cannot set property 'innerHTML' of null
at CSFpausetimer (csf.cgi:2284)
at csf.cgi:2480

I was able to...