ConfigServer Community Forum

Hi, can anybody clarify me will Cluster setup copy all settings from master server, or it is only for blocked/allowed IPs. Because I have large amount of servers and setup manual of CSF for every server and changing something is really slow ?

Is it possible to have different csf.conf files for different network interfaces? I can see in the csf file where i can specific what interfaces the csf.conf acts on, but what if i want different csf.conf rules and settings for different network interfaces?

Thanks.

After I installed csf (which comes with 115 deny rules) I was able to add only 2 additional ones of my own, for a total of 117.

You have an unresolved error when starting csf:
Error: The VPS iptables rule limit (numiptent) is too low (396/405) -
stopping firewall to prevent iptables blocking all connections, at line 3041 in /usr/sbin/csf

In theory, the solution seems to be straightforward:...

Hi People,

I have a webdesign Company working on one site on my server, they are currently working with Wordpress Admin tool.

They get dissconnected alot of times with the following message:
IP ADDRESS found to have 161 connections - *Blocked in csf* for 1800 secs

Is this a Wordpress error or have I configured something wrong?

My CT_LIMIT = 100 and CT_INTERVAL is set to 30

The webdesigners...

Hello,

So, I moved to a new server and install the CSF firewall.

So, im busy transferring all the domains to that server. So, now this morning i try to login in the WHM, cPanel. But it says The connection timed out. Please try again.
Even I can't visit websites.
So, that's so annoying that its even block myself on the firewall.

So, my question is. Is there any configuration how to set this to...

After a recent cPanel update, I'm not getting as many LOCALRELAY events in my lfd logs.. None of the thresholds have changed and I know of a few times the system should have tripped that alert. So, has anyone else experienced this?

Box : CentOS 6.8

I have noticed that my global allow rules are applying correctly to all CentOS 6 servers, but on CentOS 7 servers global allow rules are being applied partially.

By partially, I mean that /var/lib/csf/csf.gallow contains only between 30% or 60% of rules (rules are chopped off at random lines on each affected server) and in /var/log/lfd.log I regularly see iptables appears to have been flushed -...

Hi,

I found my csf error and its unable to start, everytime i try to start it from whm or console, it always failed. even i have turned off the faststart function,

Here is the error message :
You have an unresolved error when starting csf:
Error: iptables command failed, you appear to be missing a required iptables module, at line 1508 in /usr/sbin/csf

Does anyone ever had the same issue.?
I...

I have the following rules:

# vpn ip to specific server ip
iptables -t nat -A POSTROUTING -s 10.8.0.5/32 -j SNAT --to-source XXX.XXX.XXX.2
iptables -t nat -A POSTROUTING -s 10.8.0.9/32 -j SNAT --to-source XXX.XXX.XXX.3
iptables -t nat -A POSTROUTING -s 10.8.0.13/32 -j SNAT --to-source XXX.XXX.XXX.4
iptables -t nat -A POSTROUTING -s 10.8.0.17/32 -j SNAT --to-source XXX.XXX.XXX.5
iptables -t nat...

Why CSF is showing these as errors?

/usr/local/cpanel/logs/error_log:
==> cpsrvd 11.48.0.11 started
==> cpsrvd: loading security policy....Done
==> cpsrvd: Setting up native SSL support ... Done
==> cpsrvd: transferred port bindings
==> cpsrvd: bound to ports
==> cpsrvd 11.48.0.11 started
==> cpsrvd: loading security policy....Done
==> cpsrvd: Setting up native SSL support ... Done
==> cpsrvd:...

I recently discovered csf and am very pleasantly surprised. It is a jewel.

My questions are not related to any problem, it is just simple curiosity. The system is unusual in two respects:

(1) Who owns csf? It seems to be in the middle between Open Source Software and commercial. The package seems to be distributed in binary form, and only in this site. I guess they get an income by selling and...

I recently RE installed cPanel and CSF, and although my country blocking seems to be doing great, LFD is not working 100% of the time.

The way it used to work for me was I would get emails from LFD telling me that there were blocks, but now I get 3 from cPanel Hulk and then 1 from LFD, whereas once I initially started using CSF, LFD would almost never let cPanel Hulk even do it's job, as it was...

Hi, I installed this tool to protect a mail server with postfix but I can not get work alerts POP3 - IMAP. Do not send emails even with well-made configurations. Could you help me?

My system statistics over the last 7 days shows a load spike of 4 million% and during the same period 60 trillion (!) apache connections...

This is certainly because cPanel auto-backup hit a snag and stopped deleting my rolling server backups. After a while this meant that I had completely run out of space on the server disks and things started to go wrong quickly.

On getting everything...

Hello, im tired of trying everything, i have allowed my ip into:
csf.conf
ui.allow

I have set port to 6666 (default)
I have set UI_ENABLED = 1

everything set already

and i still get: ERR_CONNECTION_RESET from any browser....

Please help! :(

Hi,

Because firewall is blocking some unwanted IPs that is trying to access for example port 8080:

Nov 11 18:19:25 srv1 kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=XXX SRC=XXX DST=XXX LEN=48 TOS=0x00 PREC=0x00 TTL=115 ID=26111 DF PROTO=TCP SPT=63838 DPT=8080 WINDOW=8192 RES=0x00 SYN URGP=0

Nov 11 17:37:24 srv1 lfd : *Port Scan* detected from XXX (GB/United Kingdom/XXX). 11 hits in the...

I have users that are blocked from the system.

When I search csf.deny the IP address isn't in there.

But when I add them to csf.allow, they are able to get e-mail OK.

So my question is, is there another place to look for IP addresses or is there another method that IPs get blacklisted that isn't through csf.deny?

Thanks,

Lawrence

Hello

we have a problem with the SMTP_BLOCK feature on some CentOS 7 servers.
Our SMTP_BLOCK config:

SMTP_BLOCK = 1
SMTP_ALLOWLOCAL = 1
SMTP_REDIRECT = 0
SMTP_PORTS = 25
SMTP_ALLOWUSER = cpanel
SMTP_ALLOWGROUP = mail,mailman

This works like expected:
2 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25 owner GID match 206
3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0...

Hi for the last few days i keep getting a cron email saying it can't update with the following message

# /usr/sbin/csf -u
Oops: Unable to download: Can't connect to download.configserver com:443 (connect: Connection timed out)

also when downloading the csf.tgz its currupted
h**ps://download.configserver com/csf.tgz

hi every one

i add the IP address in /etc/csf/csf.deny same as below

37.0.0.0/8 # (do not delete) Manually denied by admin

but when i type the command below in SSH i still see some IP connected to the server

# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
109 37.190.224.5
214 37.170.213.4
312 37.170.104.55

is there any way to deny the any IP start with 37?...