ConfigServer Community Forum

Hi Guys, My question is for clarification really.

1. To block by CIDR addressing do you enter it manually in to the csf.deny
2. I need to block a country / district.
180.254.50.81
180.254.24.22

180.246.47.79
180.246.55.220

There are a many more for each range but the format i'm looking at blocking is

180.254.x.x
180.246.x.x

Would this be the correct format at enter in to the csf.deny...

Hi,

CSF is not running on vps server. Trying to restart gives this :

Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
Restarting bandmin acctboth chains for cPanel

Upgrading csf gives:
Oops: Unable to download: 599 - Could not...

OK so we decided to block some well known exploit and spam IPs and countries (mainly China and similar) using BOTH csf (CC_Deny setting) on the server and htaccess on specific domains.. Now here's the kicker and problem.
These blocked IPs are still getting thru to Apache and other services and generating page requests, email login hack attempts, etc..

here is a couple of examples:
Apache hits:...

Hi guys,
fantastic product. And like so many my first post is a query to ask for your help.
Basically im looking for what used to be listed as the csf.tempban file.
previously the temp ban information was kept in this file which i would get its contents and send it as daily log an e-mail.

I can see from the change log that it had caused problems in the change log back in version 4 but i'm now...

Hi all,

When clicking View System Logs , and any of the dropdown boxes, the following error shows immediately (not after a 30 second timeout)

TIMEOUT: tail command took too long. Timed out after 30 seconds

Doing a Search system logs shows the following error also:

TIMEOUT: grep command took too long. Timed out after 30 seconds

Any ideas on what to check regarding this? I have already...

Hello,

In WHM I see a blank page with the title ConfigServer Security & Firewall .
I cannot uninstall CSF as well. I get the error sh: uninstall. sh: Too many levels of symbolic links .

Any idea to solve it?

Thanks in advance.

I get this error message in console after installing:

Failed to write /var/cpanel/apps/csf.conf: Not a directory
/usr/local/cpanel/bin/register_appconfig: Summary
This tool allows you to install an appconfig file an ensures that it is
registered with the system and available for use. For more information
please see the documentation for this system:
http:// go. cpanel. net /appconfig (I am not...

Dear users
i was wondering if some one can make a small script/daemon for me to get the live status of the lfd blocking per 28 days

after some looking on the script does it seems that the images get generated after you visit the page
the thing i like to have is that the images are updated every 15 min so i can show them on my public/private status page

in short
i was wondering if it could be...

Dear Team

i have vps with Xeon 4 cores and 3GB ram with Shared hosting environment

Some users giving lot of load to server with many https connections .. some are trying Dos attacks on server

I need prevent all these

Any one please suggest Generic settings for CONNLIMIT and PORTFLOOD to Stop Dos and some other attacks ..

Please suggest these settings ..

thamks

My IP table is Good. No Error.

TCP_IN = 20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,2095,2096,30000:35000

But still my FTP has the same problem. Connection error or Try PASSV mode this kind of error!

100Times I Restart CFS and FTPD.

I also try to reinstall csf! :(

But same.. Plz Help me!

I have created /etc/csfuibuttondisable and CSF button colors continue the same.

Sergio

Is there an instruction on how to add this to /etc/csfuibuttondisable - is at a file? a selection in the firewall configuration?

I am trying to allow a particular IP address to access port 3306. I have removed 3306 from the TCP_IN list in csf configuration, and am trying to add the IP address to the csf.allow file. I have tried the following:

d=3306:s=11.22.33.44
d=3306|s=11.22.33.44
tcp:in:d=3306:s=11.22.33.44
tcp|in|d=3306|s=11.22.33.44

...where 11.22.33.44 is the IP address I want to allow, but after restarting the...

Is it possible to refresh the Dyndns allow list using a URL?

The reason is my firewalls will check every 15 minutes if my IP has changed, but in emergencies this is quite bad, but its rare, so I dont want to set it to refresh every 1 minute.

So I wondered if I can kick start this refresh externally, like from a URL or something? So in an emergency I update my IP, then I call this URL to...

Hi,

I'm running csf 6.30 on Cloudlinux and having issues with some css files not loading.

Log:

Failed to load resource: the server responded with a status of 503 (Service Unavailable) file.css

When I turn off csf this error disappears. Any ideas what can cause this?

EDIT: Not only CSS files are affected, seems to be all random, can it be because of to low CT_LIMIT?

For the last several months I've spent several hours a day battling with dictionary attackers and various hacker attempts on my server, and most of that time was busy inputting IP's to block through the firewall. But your last upgrade has been a godsend! Now you automatically detect and block 99% of the cretins who were causing my server overloads just a month ago. I hardly know what to do with...

Is there some way that CSF can be used to effectively prevent the attack described in CVE-2010-5107? I'm not overly concerned about this issue (it *has* existed for 11 years, after-all) but the third-party company that does security scans for PCI compliance wants it resolved. The suggested solution is to upgrade OpenSSH to 6.2 to use new feature that mitigate this risk but 6.2 is very new and...

Hello everyone,

Does anybody experiences this particualr issue? When I have csf enabled, my server shows a very bad ping, up to 70% packet loss in my ping report. But when I disabled it, ping goes back to 100%.

Can anybody help?

Thanks n advance.

We have found that if a user is in a screen or tmux session and they su or sudo su an alert is not fired. If the user exits their screen/tmux session, the alerts will fire just fine.

It seems to be poorly documented that who am i does not properly return a user when the session is in screen/tmux. However, logname and other env variable such as $SUDO_USER will return the base user.

Is lfd making...

Im getting 2 emails an hour about a maintenance process using wget

Ive tried adding the process to a ignore files a couple different ways and have not been successful

Any pointers would be helpful

Time: Mon Apr 11 07:01:44 2011 -0500
PID: 18054
Account: taccpount
Uptime: 102 seconds

Executable:
♦

Command Line (often faked in exploits):

wget -q -O /dev/null

this server has been...