ConfigServer Community Forum

Connection Tracking set to 100 connections, exclude time_wait. The same IP was blocked twice, got 2 separate emails, 2 seconds apart:

20:37:39
20:37:41

How come the blocked IP doesn't appear in Firewall Deny IPs?

It seems that cpanel has changed the contents of the login_log file and therefore csf cannot detect attempt with login failure.

cpanel: has been changed to cpaneld:

whm: has been changed to vhostmgrd:

Can you check that and maybe report these change to regex.pm

Thanks.

Marc

Hi,

CSF is configured to block IP after 5 attempts to POP3 with these values :
LF_POP3D = 5
LF_POP3D_PERM = 900

This works fine when using the POP standard port 110

When i switch to POP3-SSL using port 995, CSF doesn't detect POP failed login.

Here the content of maillog file :
Aug 13 16:45:36 looping pop3d-ssl: LOGIN FAILED, user=xxx-yyy@domain_name.info, ip=
Aug 13 16:45:41 looping...

# Check the PT_LOAD_AVG minute Load Average (can be set to 1 5 or 15 and
# defaults to 5 if set otherwise) on the server every PT_LOAD seconds. If the
# load average is greater than or equal to PT_LOAD_LEVEL then an email alert is
# sent. lfd then does not report subsequent high load until PT_LOAD_SKIP
# seconds has passed to prevent email floods.
#
# Set LF_LOAD to 0 to disable this feature...

Hi,
I´m getting this error when i try to restart csf.
I get:
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Restarting bandmin acctboth chains for cPanel
ACCEPT all opt -- in lo out * 0.0.0.0/0 -> 0.0.0.0/0
ACCEPT all opt -- in * out lo 0.0.0.0/0 -> 0.0.0.0/0
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `acctboth'
Deleting chain...

This is on a CentOS and in Generic mode:

> /etc/init.d/csf restart
Stopping csf:Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Error: Setting LF_SSHD is repeated in /etc/csf/csf.conf - you must remove the duplicates and then restart csf and lfd., at line 68

Starting csf:Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Error: Setting LF_SSHD is...

Hello,
I trying to use your firewall but I have very big problem, from my server I connecting to external MySQL server and your firewall blocking this connection with error blocked with too many connections but OK (I thinked) I added IP for my MySQL server on white list (Firewall Allow IPs) and restarted firewall/lfd but after 60 seconds firewall AGAIN blocking this IP!!! Why??? How I can disable...

Hey I got Debian Sarge and I installed csf, I also hava Webmin and I added module for csf, when I click on icon in Wemin -> System -> ConfigServer Security & Firewall I got this message:

Error - Perl execution failed

Undefined subroutine &main::init_config called at /usr/local/share/webmin/csf/index.cgi line 14.

Anyone can help me?

I got:

Apache/2.0.54 (Debian GNU/Linux) mod_jk2/2.0.4...

I just downloaded / installed New csf v2.84 (released just this morning) and I've noticed something very odd.

Instead of actually putting the ip address of a brute forcer in the Deny list (like it normally would), LFD just keeps sending me alerts s every 4 minutes saying it's denying the user, but it never adds their IP to the Deny list and I have to go in and do it manually to stop them.

For...

Since 7/3 one of my servers has reported the same error when tryingto update

Unable to connect to configserver.com at this time: Died

Now running ConfigServer Security & Firewall - csf v2.79 - so its a ways behind

I wasnt worried about one or 2 errors - figured they were timeouts - but 5 times in a row...

Any ideas ?

I just noticed that the Web Disk feature in CPanel 11 ports aren't supported in CSF as the use 2078 (SSL) and 2077 (Non-SSL) :) .

Hi Guys,

I've come across an interesting issue on a number of Centos 4.5, cPanel 11 and CSF installations.

For some reason when running Check Server Security, it starts to render the screen and then just stops with this error at the top of the screen. It gets to the Check Shell Limits line and then dies.

I've tried on Release and Current branches of cPanel 11, to no avail.

Anyone have any...

Just getting an error when trying to access the CSF interface in WHM :

Unable to connect to configserver.com at this time: Unrecognized character \x1B

Upgrading through SSH to the newest version did not change this.

Cheers
Graham

Is it only me or are people beginning to have some trouble with cfd? I have three dedicated hosting servers (US, Hong Kong, Japan) and all of them only recently started having the slowness. My friends have sent me traceroutes from their machines, and I have used traceroute.org to test it myself -- the problem is always with the last hop. From my bandwidth provider to my own server. Then, just to...

Hello

What's the problem if the both security on same server CSF+APF ?

and why it show me :

Remove APF from the server. You must not run both APF with csf on the same server

Thank you

When ever i have the security settings set to MED or High, i cannot update cpanel, but i can when i set it to low, why?

SMTP_block also doesnt work, if i set to med or high i need to go in and disable this because i get an iptables error.

any idea's on how to fix this?

Just updated to v2.69 and did see the changelog:

When upgrading the new setting will be set to whatever you have LF_FTPD set to

This is not happening, just wanted let you know. I had LF_FTPD to 8 and after update the smtp value is 1.

Thanx!

I read in another thread that the IP Allow overrides the IP Deny. I had a range of IP addresses in the IP DENY and a single IP address in the ALLOW. The single IP was still denied.

Example

DENY FILE

26.132.12.0/24 # Deny
ALLOW FILE

d=1111:s=26.132.12.200 # Allow

The IP 26.132.12.200 was still not able to log in until I removed the deny entry.

hi,
I've few IP's of customer which are in the allowed IP List still i get the Lfd blocked notification mail for those failed logins as :-

Failures: 8 (ftpd)
Interval: 135 seconds
Blocked: Yes

Blocked: Yes confuses and needs to re-check it from csf menu.

shouldn't this have something like which reminds that you've already allowed the IP in question and is not blocked

see ya,
prabudh