ConfigServer Community Forum

Hi,
I have received too many lfd alert mails.I have added the ip(116.31.116.47) in csf.deny but still receiving the alert mails regarding this IP. The mail states as :--

Time: Wed Jun 8 11:01:04 2016 +0100
PID: 26038 (Parent PID:26037)
Account: sshd
Uptime: 95 seconds

Executable:

/usr/local/sbin/sshd

Command Line (often faked in exploits):

sshd:

Network connections by the process (if...

When i send email from hotmail, gmail o any other corporate domain i cant recieve email, but if i disable the firewall i able to recieve.

What is missconfigurated on the firewall that restricts incoming mails?

Thanks

Hello,

I have a same problem with csf, i try all option to open port 43 buy still have a status close.

I do all what need.

Login with ssh to server , edit nano etc/csf/csf.conf

Found line
# Allow incoming TCP ports
TCP_IN = 20,21,22,25,26,37,43,53,80,110,113,443,465,873,2087,2089,2703

# Allow outgoing TCP ports
TCP_OUT = 20,21,22,25,26,37,43,53,80,110,113,443,465,873,2087,2089,2703

#...

Hi,

After i installed CSF i can't use wordpress admin panel - sometimes i can't save a page to be correct.
So i can login to admin panel but when i fill the page with date and on save i loose connection.
If i quick add my IP to the CSF it's good.

CSF is on default settings. Maybe (i am total noob) that hi is blocking a lot of PHP request for example, that may cause this. Maybe some rule is set...

Hi,

I'm having issue connecting to the UI, I've added my IP to the /etc/csf/csf.allow and /etc/csf/ui/ui.allow these were enabled by default UI = 1
UI_PORT = 6666

There is a server key and crt present,
SSL Key goes into /etc/csf/ui/server.key
SSL Certificate goes into /etc/csf/ui/server.crt

Tried all browsers still getting a time out, help would be appreciated. I need to put csf on 4...

Hello Guys,

We're seeing an increasing number of IP's getting blocked for 'aborted' logins. The messages look like:

May 17 12:52:25 ### dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user= , method=PLAIN, rip=###, lip=###, TLS, session=
May 17 12:52:31 ### dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user= , method=PLAIN, rip=###, lip=###,...

Hi,

I have two servers:
1) CentOS 6, CLOUDLINUX 6.7, x86_64, xenhvm, WHM 56.0 (build 18), CSF v8.25
2) CentOS 7, CLOUDLINUX 7.2, x86_64 kvm, WHM 56.0 (build 18), CSF v8.25

In both servers I have a added a regex in /etc/csf/csf.fignore for emails from JetBackupManager. They provide the regex themselves:

regex:
/tmp/tmp +/virtualenv\- +/.*

The problem is that in CentOS 6, this works just...

Is it possible to have the Distributed DOS to work for Custom LFD?

I apologize if this is already answered or possible..

We occasionally see phished/hacked accounts sending spam via authenticated SMTP, and they typically come from a large number of different IPs.

I know we can block based on failed SMTP failed but I'd like to block *successful* SMTP authentications when they come from too many different IPs (or better yet, when they come from too many different countries).

Any way to do this currently?

Last few days my server is unable to update CSF. I got the error: Oops: Unable to download: Can't connect to download.configserver.com:443

When I try to do a telnet to download.configserver.com on port 443 it is unable to connect.

# telnet download.configserver.com 443
Trying 85.10.199.177...
telnet: Unable to connect to remote host: Connection timed out

I've verified my firewall and this IP...

I have read through the forum's and can't figure out why my Custom Trigger isn't firing...

So, I have a web application which is writing the following to a log file upon Failed Login Attempt.

I am using PHP Error Log Function to write the Failed Attempt
error_log( {$x} {$_POST } {$y} {$z} {$zz} , 0);
This Generates a Log Entry in the /var/log/httpd/error_log as such:
Failed Login for User:...

I get this error every day

You have an unresolved error when starting csf:
Error: FASTSTART: (Packet Filter IPv4) [] . Try restarting csf with FASTSTART disabled, at line 4800 in /usr/sbin/csf

You need to restart csf successfully to remove this warning, or delete /etc/csf/csf.error

if I disable faststart csf is very slow to restart why there are too many rules

Getting an error:

No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/csf.cgi): The subprocess reported error number 13 when it ended.

Cpanel told me to ask CSF :)

All other servers are OK. Tried force update didn't help. Server seems to be working fine otherwise.

Hello,

I installed CSF on Cloudlinux 7 + cpanel server. I disabled firewalld and installed iptables instead. However, the LFD service keep failing after about 30 mins.

# cat /etc/csf/csf.error
Error: FASTSTART: (DROP no logging IPv4) [] . Try restarting csf with FASTSTART disabled, at line 4738 in /usr/sbin/csf

The startup log shows the lfd.service was killed, but I have no idea why it was...

I'm trying to get this regex working properly and having no luck at doing so.

The logfile looks like this:

2016-01-26 15:33:19 Authentication failed for user mrfakeuser from 126.16.117.42

In /etc/csf/csf.conf I've set:

CUSTOM1_LOG = /var/log/pmta/log

In /etc/csf/regex.custom.pm my code looks like this:

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\S+\s+\S+\s+Authentication...

I got an email from the server with this line:
'admin@DOMAIN.COM' to access service 'mail' from IP '155.133.82.177': 31 Time(s)
dovecot: auth: Error: Cpanel::MailAuth: cphulk incremented the failure count for user

However, I have this in my deny list:
155.133.0.0/16 # Error: Cpanel::MailAuth: cphulk Poland Thu Apr 28 13:00:00 2025 DO NOT DELETE

So pray tell me how the user from the IP...

These are our settings on a number of mixed centos installations (Centos 6, and 7) running latest Cloudlinux kernels. We have dozens of servers for which csf.pignore is just not working

csf:v8.22

PT_LIMIT = 600
PT_INTERVAL = 60
PT_SKIP_HTTP = 0
PT_ALL_USERS = 1
PT_DELETED = 0
PT_DELETED_ACTION =
PT_USERPROC = 50
PT_USERMEM = 0
PT_USERTIME = 3600
PT_USERKILL = 0
PT_USERKILL_ALERT = 0...

Hi. I am running CSF on a VPS

In openvz config file, I have the following:

IPTABLES=”ip_tables iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ipt_state iptable_nat ip_nat_ftp ipt_recent ipt_owner ipt_conntrack ipt_helper ipt_REDIRECT”

when entering container, I get this error:...

Getting these errors in my CSF log.

Unable to retrieve blocklist RBN - Unable to download: Not Found

I have installed what I believe to be the correct version of CSF for Cpanel on my VPS / CENTOS 6.7 / WHM 11.52.1 (build 2):

csf -v
csf: v8.08 (cPanel)

It does seem to be enabled and working, however it will not show up in my Plugins list in WHM. I have uninstalled and re-installed with no luck.