How to maintain and deploy configurations for CSF firewall for several Ubuntu Linux servers?

Currently I maintain configurations for each server separately on my PC. If and when I make a change or improvement I manually ripple it across all the configurations and upload to my servers. This is error prone and tedious. (A configuration is a set of files such as csf.conf, csf.allow, csf.ignore,...

Hi,

I have latest csf/lfd running on CloudLinux 6 with cPanel. The problem I started experiencing is that without any reason csf blocks all ipv4 access to the server. This repeated 2 times already. When it happens I can see the following in the lfd logs:
May 23 23:53:36 wp03 lfd : Global DynDNS - update IP addresses
May 23 23:53:36 wp03 lfd : Global DynDNS: Lookup for failed
May 24 00:00:03...

I have set up the following which someone may find useful:

2 x CSF Master in HA with 1 virtual IP - the master config has ALL slave server IP addresses and cluster key
100 CSF slave servers with ONLY the master ip in the clsuter settings + cluster key
A Master script which runs as a daemon and monitors the LFD log to rebroadcast only APPROVED commands to all slaves.

The advantage is that you...

Hello,
i have new vps server with centos 7 and webmin.

i would block tried login to webmin panel...

my csf.conf have this settings:
LF_WEBMIN = 4
LF_WEBMIN_PERM = 1

WEBMIN_LOG = /var/log/secure
as default.
but csf dont block ip on webmin (ssh works fine)

so i try to change
WEBMIN_LOG = /var/webmin/miniserv.error

but not works...

can you help me with this configuration?

thank you

Would it be possible to specify the period over which the number of failures occurs PER REGEX. Currently, the LF_INTERVAL is used and applies to ALL regexes.

Hello!

I have enabled all email alerts that CSF generates and when a customer asks why they're been blocked i search the IP in my emails and i can give them a report like this one:

Time: Tue May 14 15:17:20 2019 -0300
IP: 51.38.133.58 (PL/Poland/58.ip-51-38-133.eu)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked: Temporary Block for 3600 seconds

Log entries:

May 14 15:11:22 dallas sshd :...

Is there any reason why the csf dev team have not added an md5sum for the csf.tgz download file to enable integrity checking?

So I'm running the owasp modsecurity rules, but for some reason I cannot get CSF to block those IP's triggering the rules anymore.

I have LF_MODSEC set to 5, and I've even tried setting LF_CXS to 1, but the IP's just aren't getting blocked. Am I possibly missing something?

What are main differences between Microservices and Monolithic Architecture?

Hi,

csf.conf is using maxmind geolite2 country, but this is not available anymore from 2 Jan 2019.

Any fix?
(using it for CC_ALLOW/CC_DENY)

Thank you.

Been using CSF for a few months, I had made no changes to my server but all of a sudden i no longer get alerts to my mail from the firewall.

Is there a log I can check to see where csf/lfd is attempting this so i can find out why its not sending, all the mail is local to the server and is generally instant.

It would be nice to have an option to be able to exclude a specific TCP or UDP port so that it is not affected by the CC_DENY filter

Hi,

We are getting alerts about suspicious file alert However we know they are legitimate files. Is there any way we can ignore anything to do with this user?

The error is as below.

Time: Wed Apr 24 18:16:39 2019 +0100 File: /tmp/wprss/twig-cache/2f/2f760a05665d1006ee76f2ad692f7e97b3ab25f069a74669a4c995e10502486a.php Reason: Script, file extension Owner: thechallengesgro:thechallengesgro...

Hello everybody,

for everyone who uses portscan tracking and blocking, check your messages logfile in /var/log/messages. If you find a large number of blocked IPs with port 443 here you will get the reason what it is caused by.

The reason is Google Chrome. If a Chrome user visits a webpage, Chrome uses the UDP protocol for a port scan and checks to see if port 443 is open, not just once, but up...

Hello,
I changed the value of LF_CPANEL to reduce the chance of banned IPs
due to bad password mistakes but I still don't understand the
purpose of the LF_CPANEL_PERM variable.

Can somebody explain me it better?

PS: Is it possible to attach pictures to posts of this forum?

Hi,
I am using my VPS under CentOS 7.10 with CPanel/WHM, and everything work well, but I've got this message from LogScanner, I've check the ifconfig and found three adapters installed
eth0 >> primary one with 10.x.x.x configuration
eth0:1 >> External IP
lop01 >> 127.0.0.1
is there any recommended thing to do in this case?
warn detects system IP as 64.202.186.216 and system local IP detected as...

There is always a spam folder usually, from Spamassassin or assp deluxe.

Is there a way to automate this:
:
We recommend filtering the email in your email client and placing it in a separate folder so that you can check through it in your own time.

And filter {Spam?} and {definitely Spam?} in the ./spam folder for all old and new users ?

Most users, don't know how to do it, And if a...

Hello,
I have noticed several errors like the following line
xxx.yyy.zzz.xxx # lfd: (eximsyntax) Exim syntax errors from xxx.yyy.zzz.xxx (PE/Peru/-): 10 in the last 3600 secs - Tue Apr 23 22:16:45 2019
and some of them are false positives so I was wondering if it is possible
to disable any rule to avoid IP blocking for this reason.

Just setup docker with csf, rules arent working, i still cant build containers (docker cant connect to outside world)

maybe there are some settings in csf blocking it? or more rules need to happen?

Running Amazon EC2 (Amazon Linux) with a load balancer.

CSF has been running fine until today (some 1.5 years).
I logged in via SSH and ran the latest update for EC2.
Then restarted CSF - and https and sftp stop working worldwide.

Disable CSF - all good.

Turn CSF TEST MODE on - all fails.
- My understanding is LFD does not run when in test mode. So LFD not the issue.
I have flushed iptables,...