ConfigServer Community Forum

Hello

I have a simple question.

If I allow few countries through cc_allow_filter is my csf.allow whitelisting still works?

For example, if I allow thiese countries: HR, BA, ME and I still try to whitelist a US IP address, is it possible to exclude that IP address, even US is not on the list of allowed countries?

Thanks in advance

This post can be deleted - We found a bug in the way Imunify360 integrates with CSF whereby it removes the iptables entry but fails to add the IP to its own greylist ipset list.

Guys, I'm getting an error like this. Csf is installed on the server and it's blocking push notifications. The problem is caused by csf, but I couldn't find where it is blocking the port. What is preventing push notifications? I will be glad if you help.

ErrorException: Push notification failure: cURL error 7: Failed to connect to fcm.googleapis.com port 443 after 1011

Hello,

I come to you because I received several notification emails from my VPS server entitled: LFD - Suspicious process running under user postgres

Here is the content of the email

Time: Sun May 29 11:00:57 2022 +0200
PID: 12692 (Parent PID:12686)
Account: postgres
Uptime: 801371 seconds

Executable:

/usr/pgsql-10/bin/postgres

Command Line (often faked in exploits):

postgres: wal...

Hello Support.

I am using ConfigServer Security & Firewall - csf v14.16

Within CSF Country Blocks the list of country codes that I save are dynamically disappearing , so that the text field is left empty.

This phenomena has occurred 5 times .

And it usually happens somewhere between 3 to 24 hours.

======

My country code list is . . .

AF, BD, BR, CN, CZ, GR, HK, HU, IT, KR, RO, RU, TR,...

Hi,

I have been going blind on trying to debug why I cannot accept incoming connections on any services via IPv6, even though I can ping fine.

After checking the ip6tables configuration I noticed that the rules are not being added, well at least in Webmin. I am very confused, let me explain why:

- In Webmin -> Linux Firewall I can see all sort of rules being added which reflects what's in...

Running Ubuntu 20.04.4 and found that even though I have a valid csfpost.sh it is not run on server reboots.
root@mybox:/etc/csf# ls -l csfpost.sh
-rwx------ 1 root root 529 Jun 16 13:22 csfpost.sh

If I manually csf -r then it does get executed. I can't find anything in documentation to indicate I have something wrong.

As a workaround I created a line into the cron /etc/cron.d/csf-cron...

I have a vps with cpanel and csf.
I add my ip, as a test, in Deny IP and I can continue browsing without problems.
It is worth clarifying that the IP is not added to Allow IPs.
CSF latest version.

Any suggestion?
Thanks

Hello

I have one question about CSF and WHMCS. We are using a free addon for WHMCS for clients to allow clients to unblock an IP that has been blocked on a cPanel server that is using CSF., without needed to open ticket etc.

On WHMCS for security reasons we have create API Tokens through WHM, so WHMCS would be able to create, suspend, terminate, delete accounts etc.

If we would like to have...

Lately I've been getting heaps of these
GET /.env HTTP/1.1

generally 20 or 30 from a single IP address at a time (not the same IP address all the time or I'd block it).

Is there a way to immediately blacklist an IP that calls this GET request or to block all GET requests to /.env

Main Process: Unmatched [ in regex; marked by line 12

Get this error not sure what it is.

Keep having to restart lfd every hour on one server

Hey,

Just wondering if anyone knows where csf downloads the geoip databases to when it refreshes? Or is it just loaded into a memory stream?

I would like to reference it for another purpose if possible.

Hello

I have had CFS installed on one of my servers and it's been working great, but I keep running into problems where by if a client tries to access their email accounts from an IP other than the one they have been using normally, the IP address get blocked and they cannot access either their website or emails until I allow it on the server.

This has been happening for some time and I'm not...

Hi!,

I would like to open a port just for a user.

For example i have port 993 closed from outside to not permit users do access imap.

But i need to give permission to one user.

So, can i add this line to csf.allow to permit this?
tcp|in|s=993||u=1018

I already tried but doesn't work.

I there a way to do this?

Thanks

I have a bunch of DirectAdmin servers that have modsecurity installed through custombuild 2.0. I can't get CSF to block the denials by modsecurity and would appreciate some help with this. Modsecurity is working according to the audit log but some of the attacks are rather heavy and blocking in the firewall is preferred.

Specs:

Centos 6.8
Apache 2.4.23
PHP 5.4.45
Modsecurity 2.9.1...

I have some blocking rules set up in csf.blocklists including a paid API key for IPDB with a limit set to 100000 (one hundred thousand). Can you give me some general guidance on other blocks to allow for my server? it is a fairly large VPS with 8 GB of Ram.

Hi,
Refer to above matter,
Recently our server have kernel panic.
We notice it is related with LFD.

CPU: 28 PID: 12607 Comm: lfd - (child) c Kdump: loaded Not tainted 3.10.0-1160.62.1.el7.x86_64 #1
RIP __list_del_entry+0x29/0xd0
RAX: 0000000000000000 RBX: ffff8a929d9712a0 RCX: dead000000000200

MEMORY: 64 GB
PANIC: BUG: unable to handle kernel NULL pointer dereference at (null)
PID:...

I am running a server to provide DNS to my public IP subnet. I want the server to be able to get NTP, OS updates, send email, etc, but only allow incoming tcp/udp/53 from my public subnet. My goal is to block all incoming requests and only allow DNS requests incoming from my subnet 1.2.3.0/24.

Since by default it blocks all and only allows ports I open, I believe it have the ports configured...

Message: CSF unable to detect disable_functions correctly inside Directadmin?

Hi, I still get this message after i installed CSF on my DirectAdmin based Almalinux8 server :-(

Were can i find more info te solve this asap?

Gr. Leo aka MacLeod

I have really weird issue i installed csf to a new server. when user run pm2 to run node app. it runs successfully as soon as the user logout of the cpanel the process disappear.

kindly note that this only happen with cpanel user if i run the command with the root and log out it will work fine