Considering that nftables has been around a while and since then matured would it not be good to transition CSF accordingly? Supposedly it should make the life around netfilter easier
Tried to find something that allowed checking of IPs against AbuseIPDB and then if found then block, but couldn't find anything out there.
Hence writing this up.
We are using the csf RELAYHOSTS setting to prevent lfd from creating temporary firewall entries for customers who successfully check email. We are not on cPanel, so the setting isn't normally there, but it works perfectly once added. We have a separate daemon that maintains /etc/relayhosts with the IPs of recent successful connections.
The problem is that during a csf upgrade it seems to strip...
These are from exim_mainlog:
2020-02-26 17:50:18 dovecot_login authenticator failed for ( ) :49078: 535 Incorrect authentication data
2020-02-26 17:50:20 dovecot_login authenticator failed for ( ) :43772: 535 Incorrect authentication data
2020-02-26 17:50:24 dovecot_login authenticator failed for ( ) :19374: 535 Incorrect authentication data
2020-02-26...
It seems my server is getting a lot of failed SASL auth attempts via the maillog lately. This doesn't seem to be part of CSF's default configuration, so a lot of bad attempts got through!
I added a custom rule for LFD to ban these bad SASL people, but I highly suggest you make it part of the default csf.conf
Here is the tutorial I followed to implement the custom rules on my own...
The directadmin installation suggests that CSF config should be managed by the directadmin and we have to set some bruteforce settings to 0 or disable them. By doing this, the CSF will trigger few warning messages.
From what I've known, CSF use a special installation config file for directadmin called csf.directadmin.conf and it contains a generic variable DIRECTADMIN=1
After working av week trying to make CSF Messenger work in a usable manner, we must conlude that at current time it is not usable for us. Here is a list over problems and bugs we experienced:
Our system: We are running DirectAdmin and CSF 14.01. We have both CentOS 7 and CentOS 8 servers (the below list apply to both). We are using ipset:
- On DirectAdmin is it needed to change default path in...
Hi fan of the product and thanks for offering it for free !
I had just a question/suggestion is it posible to list the ports seperate from the config.
Its just a bit awkward to have to go into the whole config to open ports and the overvieuw is lost since there is no order.
Its not a biggie just wondering if it can be formated differently
Sometimes you need to make sure some client with dynamic IP will never be blocked by lfd.
However if you put the FQDN of the dyndns used by the client in csf.dyndns then you also allow this client to bypass the firewall completely, which is not the desired behaviour.
I suggest creating a new file, something like csf.dyndnsignore, that will have the behaviour of csf.ignore, but for dynamic dns.
This is probably a complete waste of time since none of the recent suggestions have had staff replies, which I find disappointing and would put me off of purchasing or donating anything to CSF...
Anyway, I have just set WHM to email me with alerts, and decided to add Pushbullet for more severe alerts. I thought it wasn't working when I didn't get login alerts but realised this is from CSF. I...
Cipher list []. Due to weaknesses in the SSLv2 cipher you should /etc/dovecot.conf and set ssl_cipher_list to explicitly exclude it. For example:
ssl_cipher_list = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
This ssl_cipher_list parameter is set in /usr/local/directadmin/custombuild/custom/dovecot/conf/ssl.conf
And via build dovecot finally also in...
Vesta CP - Support added in CSF v13.05 ( changelog )
Hestia CP - Support will be added in which CSF version?
I was able to get CSF working on Hestia CP using the following simple sed snippet (from within the install directory):
find . -type f -exec sed -i 's/VESTA/HESTIA/g' {} + && \
find . -type f -exec sed -i 's/Vesta/Hestia/g' {} + && \
find . -type f -exec...
Since 99% of our CSF use is to block IPs it would sure be nice if CSF would remember what tab we have chosen. We always select the CSF tag to keep the Block IP field at the top, otherwise we have to scroll down to get to it. When we block an IP and return to the main page our tab selection is lost.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum