ConfigServer Community Forum

Hi,

How to allow ossec agent to communicate? Which place do need to allow udp port in csf?

Thanks./

Since I re-installed CSF on my new server I get continual emails every few minutes.

They are about blocking access to IP's, port scanning, etc.

How can I stop them from sending emails every few minutes?

Thanks,

Greetings,

How to block IP with authentication failure to Samba service just like or similar to SSH service.

Thanks,

Hi,
I really like the CSF tool but am getting lots of alerts for suspicious process and excessive resource usage . These are for processes I know about and am ok with the resource usage.
I've got them filtered to go into a special mail folder, but the constant alerting obscures when I get an email I want to read. Similarly, I'll never know if I really DO have something problematic because the...

Hello,

I'm trying to create custom regex in CSF to block failed logins for SoftEther VPN .

Here is part of the log file :

2017-04-03 18:22:28.210 OpenVPN Session 124 (55.55.55.55:49490 -> 192.168.0.19:1194) Channel 0: Failed to connect a channel.
2017-04-03 18:22:28.246 Connection CID-114 terminated by the cause User authentication failed. (code 9).
2017-04-03 18:22:28.246 Connection CID-114...

Hi there,

I have tried using different paths and regular expressions pointing to the executable that is causing me constant excessive resource emails but I can't seem to find the right one. I am currently getting that the executable is the following:

Executable: /opt/cpanel/ea-php56/root/usr/bin/lsphp.cagefs

I tried doing

pexe:/opt/cpanel/ea-*/root/usr/bin/lsphp...

I'm recently not getting the end of the daily log scanner reports as it's being truncated to some maximum number of lines setting.

Is there a way to either increase the maximum number of lines - or choose to exclude some sections entirely?

My report is dominated by firewall block events - which I guess I'm not really that interested in as they were successfully blocked.

TY!

Had this message in the rkhunter log this morning for the first time.

Is it a worry?

TY!

what can i do ? i have changed all account passwords but somwthing continue to create this process.
This is a joomla website (updated) . I need exploit scanner?

Time: Thu Mar 31 16:03:56 2016 +0200
PID: 11550 (Parent PID:9249)
Account: archeage
Uptime: 97 seconds

Executable:

/opt/cpanel/ea-php55/root/usr/bin/php-cgi

Command Line (often faked in exploits):...

Hi,

Is is possible to configure Configserver to block IPs which are hammer a site's wordpress wp-login ?

I'm getting loads across different sites on the same server and would like to block at server level.

I already have all wp-admin pages blocked by http auth but robots are still hammering at wp-login, which creates load on server.

Thanks.

Tom.

Hello!

Since the last week my CSF install stops in the morning. I cannot find why and it does not restart by itself. I run start manually and runs all day without problem.

In the Logs i see this:

Nov 27 03:25:20 emma lfd : iptables appears to have been flushed - running *csf startup*...
Nov 27 03:25:25 emma lfd : csf startup completed
Nov 27 03:25:25 emma lfd : *Error* csf reported an error...

For the last week or so a server has had a very high load. The server has 4G of RAM and only has 6 websites on it and they are very low usage. When viewing the top processes LFD is always the top process and throughout the day, I get email notices from the server that it is out of memory and has killed and restarted lfd. Here is the top process on the server currently showing it using 60% of...

Hi,

This has started happening since 10.04 as far as we can tell. We'll reload CSF (csf -r) and all is good, 5 minute later the v6 rules have gone. We have some rules:

tcp|out|d=1234|d=host.example.org

Where host.example.org has a single v4 and single v6 address.

The v4 rules get created, the v6 rules are created, but then when the dyndns timer expires and the rules should be re-created, they...

What file do I edit to whitelist or safely ignore the lfd alert for wp-cron.php?

• csf.ignore
• csf.pignore
• maybe a different one?

I edit /etc/csf/csf.pignore and put this inside of it:

exe:/home/userXYZ/public_html/wp-cron.php

I even restart CSF from SSH PuTTY and WHM control panel

Why do I still receive email from LFD service?

Executable:

/usr/selector/php

Command Line (often...

Good morning,

I'm looking to whitelist process ONLY when it have specific command line
Is that possible?

Thanks,

Ed

Hello All,

I have a Centos 6 cPanel server, which has only recently been setup (within the last month).
I have installed and configured CSF, and it works very well for the most part. However, I noticed that the server's time has started running slow. At first, when I tried to re-sync manually, CSF blocked the Time Server, but I resolved this, and now manual syncing works well. However, I have...

ConfigServer Security & Firewall - csf v10.02

it takes ages before I get access to Config Server Security and Firewall settings.

My Mail Queue Administration remains flooded.
Finally after much searching, I had to suddenly enter an email address to LF_ALERT_FROM = mymail@new.us

Now I'm not getting emails in on Mail Queue Administration, but in my private mail box.

The information stated...

If you disable LFD in the CSF configuration (LF_DAEMON = 0 ) it will still be enabled in systemd. This means that systemd will try to start LFD on boot. That will fail because if LFD is disabled in the configuration the lfd binary will immediately kill it's own process.

root@server:~/csf# lfd
Killed

This is caused by line 6704 in /usr/sbin/lfd (version 10.00).

kill (9, -$$);...

I don't know what I'm doing wrong. Messenger works and it gives me the screen when I get blocked, but when I pass the reCAPTCHA (and I get the confirmation message) it doesn't unblock the IP, temp block or perm block.

How could I debug this? Is it the user that I created for it to run? I created it like this: useradd -rUM -s /sbin/nologin csf

Everything works fine, except the unblock.

Running...

Hi security guys,
Blocking ports doesn't seem to be working for me in CSF. I am also using csf from webmin console.
Have removed port 80 from TCP_IN, UDP_IN, TCP6_IN, UDP6_IN and restarted it through csf -r
still i can see 80 is not blocked yet from outside.
=======================
# ./csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK...