ConfigServer Community Forum

Hello,

There are hackers trying to find vulnerabilities by testing every 2 seconds.
Response is 404 or 301. Sometimes also 403
Shouldn't CSF block that?

Hi all,
Is there a way to exclude one user (or few) from blocks in CSF?

How can we disable the passive mode that we had previously enabled as well as activate the SPI that we had disabled.
Thank you very much in advance for your help

Hello,
i try to use csf firewall with docker
i read some tutorial, and i create a working solutions but i have a small problem...

m S.O. is almalinux 9

of course i try to enable
DOCKER = 1
in csf.conf but doesn't work.

so i use this setings and work
nano /etc/docker/daemon.json

{
iptables : false
}

nano /etc/csf/csfpost.sh

#!/bin/bash...

Viewing in WHM> ConfigServer Security & Firewall - csf v14.20 and it says enabled and also confirmed in lfd.log but it references mod_cloudflare which is no longer supported, so I'm using mod_remoteip. Is this integration still working? If so, how to verify?

Hi
I have a very bad problem , i put some ip in csf.allow and even in csf.ignore but they still blocked by firewwall.
can anyone help me?

Hi all,
Where does csf keep the list of blocked emails that are associated with IP address?
I remember on one of my previous csf installations I had the ability to see blocked emails and from which IP addresses these emails tried to connect but now I can't find it on this new server.

Hello, every 5 minutes I receive this email. What I can do ? You never did this before and the configuration is the same as when you did it several years ago, I have not modified anything since then

Time: Wed Jul 10 10:31:06 2024 -0400
Type: LOCALHOSTRELAY, IPv4 localhost - 127.0.0.1
Count: 101 emails relayed
Blocked: No

Sample of the first 10 emails:
******

What I can do ?

Below is a sample of these recent attacks:
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- PCCz
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- zFlw...

I have this problem, maybe you can help me. I am not able to upload files via FTP with CSF active. If I deactivate it I can upload without problems.

My FTP client is very old and has no options. It is part of custom software. It only connects without SSL and uploads files in ACTIVE mode. That's why I can't put it in PASSIVE mode, which surely works. I already have the range of ports open for...

I am attempting to lower my signal to noise ratio on LFD notices so they don't start getting ignored when I get them. For the most part I have done a decent job with the csf.pignore file for weeding out legitimate processes. However, I just got one for LiteSpeed Enterprise web server process itself, and I think it is too generic. If I ignore it as provided in the notice, I would be allowing...

lfd warns me daily about a process i simply cannot teach csf to ignore:
Time: Wed Nov 1 20:08:44 2023 +0100
Account: www-data
Resource: Process Time
Exceeded: 146435 > 1800 (seconds)
Executable: /tmp/appimage_extracted_a3ed3648c2d4a42fcd239937c53130a2/usr/bin/coolwsd
Command Line: coolwsd --config-file=/tmp/appimage_extracted_a3ed3648c2d4a42fcd239937c53130a2/etc/coolwsd/coolwsd.xml...

Hey guys,

I'm currently trying to block all incoming traffic to my server that does NOT come from my CDN IP addresses, and I'm hoping to do that with some kind of Allowlist, while denying all others.

My only concern is that I use Atomic Secured Linux (Atomic Protector) for my mod_security rules, and I don't want to create any kind of conflicts that might exist when running two different...

Hello,

In CSF, SMTP AUTH FAILURE block the IP of user instead of USER LOGIN.

For example, a company with 10 users, if 1 of them do wrong auth failure, the IP of company is blocked.

I would like to block only the user and not the company.

I have validate an old server and a new server where will be installed update CSF.
It seems CSF regex.custom.pm almost completely blank.

An example:
# SECTION:OS Specific Settings
# Note: File globs are only evaluated when lfd is started
Is it automatic added settings when it is installed and restarted system like Linux and CloudLinux 8?

We followed suggested steps to install CSF:

wget
tar -xzf csf.tgz
./install.cpanel.sh
I see it should be cd csf if you like t install.
/etc/init.d/csf restart is not executed. Which command should be set inside root access for cPanel?

The last steps is not working. How to manage this?

Hi,

I’m looking for some advice on how to achieve a specific configuration using CSF.

I have a server that is currently getting hammered by junk web traffic from a whole load of IP addresses all beginning 18.xxx.0.0/16 (where xxx can be any of about 20 values).

I had initially just blocked those ranges entirely in CSF but with it being such a wide block that’s not really feasible - we have...

Since our servers upgraded to Alma Linux 8.9, each time the servers reboot, CSF does not operate as normal until after its restarted via WHM.

On one server that uses PHPMailer and Office 365 SMTP, any emails that are sent by the cPanel account will fail due to network is unreachable and in the /var/log/messages it shows outgoing connection attempts to port 587 being blocked. This is happening...

Hello,

For some reason on one of our servers the following test of a PCI scan fails:

TCP Source Port Pass Firewall

PCI Severity Level: The vulnerability is not included in the NVD.

VULNERABILITY DETAILS
CVSS Base Score: 5
CVSS Temporal Score: 3.6
Severity: 3
QID:34000
Category: Firewall
Last Update: 2017-07-10 17:52:41.0

THREAT:
Your firewall policy seems to let TCP packets with a...

Hello,

I have MESSENGER v1 working on the server with Directadmin but doesn't work with SSL. So, I configured v3. The website to offer the unblock it is show, the captcha too, but when I click to unblock, the IP isn't removed on the deny list, so the IP isn't blocked. What it could be?

Thank you.