ConfigServer Community Forum

On 6.05 running csf -r observe the end of output. I copied back csf [dot] pl from version 6.03 and the bug is gone, at the point where it stops not sure how much if working or not, however, have verified that csf.redirect is not working on 6.05:

ALLOWIN all opt -- in !lo out * 0.0.0.0/0 -> 0.0.0.0/0
INVDROP all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 state INVALID
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x3F/0x00
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x3F/0x3F
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x03/0x03
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x06/0x06
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x05/0x05
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x11/0x01
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x18/0x08
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x30/0x20
INVDROP tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW
DROP all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0
INVALID tcp opt -- in !lo out * 0.0.0.0/0 -> 0.0.0.0/0
INVALID tcp opt -- in * out !lo 0.0.0.0/0 -> 0.0.0.0/0
Undefined subroutine &main::cleanup called at /usr/sbin/csf line 3520.

Hi there,

CSF updated on a few servers at 12am this morning (AEST), the following was in /var/log/lfd.log

Mar 25 00:00:01 server lfd[5973]: TERM
Mar 25 00:00:01 server lfd[5973]: daemon stopped
Mar 25 00:00:04 server lfd[31501]: daemon started on server.hostname - csf v6.03 (cPanel)

It started back up, blocked some IP's doing port scans for a while, then just 3 hours later:

Mar 25 03:00:14 server lfd[31501]: TERM
Mar 25 03:00:14 server lfd[31501]: daemon stopped
Mar 25 03:00:15 server lfd[1816]: Enable to read /etc/csf/csf.ignore: , at line 8386
Mar 25 03:00:15 server lfd[1816]: daemon stopped

Basically every 5 minutes, the last two lines appear - "Enable to read /etc/csf/csf.ignore: , at line 8386" etc. The csf.ignore file is 0 bytes and has not been used previously.

# service lfd status
Status of lfd:lfd is stopped

The instant I try to restart it, it says it started ok and then the above messages appear in the logs again and it does not run successfully.

I can confirm that I am currently on v6.04 for the last 9 hours. The problem has been happening for the last 6 hours.

I saw that v6.05 was out when I checked the changelog so I updated to this, however same problem.

These issues should be resolved in v6.06 which has just been released:
http://blog.configserver.com/index.php?itemid=734

check your /etc/csf/csf [dot] ignore, it should not have 8386 lines unless you are aware of it needing to be that way. I understand you say that the csf.ignore file is 0 bytes, are you sure it is /etc/csf/csf [dot] ignore you are checking? The default should include localhost as follows:

###############################################################################
# Copyright 2006, Way to the Web Limited
# URL: http://www [dot] waytotheweb [dot] com
# Email: sales@waytotheweb [dot] com
###############################################################################
# The following IP addresses will be ignored by all lfd checks
# One IP address per line
# CIDR addressing allowed with a quaded IP (e.g. 192.168.254.0/24)
# Only list IP addresses, not domain names (they will be ignored)
#

127.0.0.1

The line BobTatus is referring to is the line in the code for lfd.pl, not the number of lines in csf.ignore

Both of these issues should now be fixed in v6.06 as mentioned.

I can confirm that v6.06 has fixed my issue, thanks for that.

Fixed here, that was quick! Thanks much!