Possible root compromise: File /lib64/libkeyutils.so.1.9 exists and /lib/libkeyutils.so.1.9 exists.

For more information see:

This file is part of keyutils, part of the Linux kernel. If lfd is not checking the hash of the file matches a compromised version (it doesn't), then don't report it. This library has been around and been installed for years. Only when I updated to the 1.9 so version of...

I have been receiving emails 2-3 daily with this subject / message:

Subject:: Cron /usr/local/bandmin/bandmin

Message: /bin/sh: /usr/local/bandmin/bandmin: No such file or directory

If I go to usr/local, there is no bandmin directory.

Is this a warning I should be concerned about? If so, is there an application I need to install? If not, is there a way to disable these emails?

The setting LF_MODSECIPDB_FILE suggests /var/cpanel/secdatadir/ip.pag, but there's no such file in that folder. I also checked all the suggested folders in the setting, like /tmp, couldn't find ip.pag anywhere. But I did find cpanelusername -ip.pag in the folder /var/cpanel/secdatadir/

Is that the file LF_MODSECIPDB_FILE is asking for? If it is, how do I handle this situation? It appears that...

Hi Guys,

Several of my fleet of VPS's has been performing weirdly lately. They're spread geographically and between different providers. All of my issues have gone away and server load has reduced as soon as CXSwatch and CXS were stopped. and they begin again after it is re-enabled.

I'm talking going from average 25% of 8 CPU cores and 8GB of ram to 98% for long periods of time across multiple...

I have been trying to get iOS Mail Push Notifications working. The first step was getting the expired certificate renewed.. After much work, that got done. But Push still wasn't working. I read here:

that I would have to ad port 2195 to TCP in CSF which I did, for both IN and OUT. But that hasn't helped. Is it possible there is another CSF configuration preventing Push Notifications?

/var/spool/MailScanner/quarantine/20190916/nonspam has 1,984 messages in the folder.

Anyone know how I can find out why they weren't delivered and what needs to be done to get them delivered?

I am running Mailscanner Front-End 8.27 on cpanel v82.0.15

I got an email with this message:

Scanning web upload script file...
Time : Mon, 16 Sep 2019 15:23:48 -0500
Web referer URL :
Local IP : 162.241.XXX.XXX
Web upload script user : nobody (99)
Web upload script owner: ()
Web upload script path : /home/FOLDERNAME/public_html/wp-content
Web upload script URL :
Remote IP : 202.104.9.163
Deleted : No
Quarantined : Yes

NOTE: does not exist on this...

Hello, last night WHM updated itself to v82 and I started getting emails that mailscanner is not working, a quick google search brought me to this:

I updated the scripts on the server via this: curl -sL | perl

but i am not still getting emails from WHM saying that mailscanner has failed, what can I do?

Hi,

I setup MAILX via gmail for notification alert sending.

How to use this to send CSF alerts too ?

I am seeing this on one of our installs:

Web upload script path : /home/csf/public_html/wp-content
Web upload script URL :
Remote IP : 111.111.111.111
Deleted : No
Quarantined : Yes

NOTE: does not exist on this server. However, ModSecurity is still triggering cxs to scan the attempted uploading of potentially malicious data

What is causing csf to populate instead of the username of the...

Edit : Please delete this post. I was not able to delete it myself. It is not a bug, the reason the IP is not blocked is because it is not within my setting of 300 sec.

We have SSHD running on default port 22. Control panel is DirectAdmin. Settings is as follows:

LF_SSHD = 5
LF_SSHD_PERM = 1
SSHD_LOG = /var/log/secure

Bruteforce attacks on port 22 is blocked correctly, however all bruteforce...

On v13.06 Search System Logs page, a javascript error is produced in all cases due to the lack of the timer pause button id= CSFpauseID . While the pause button is omitted, the rest of the timer code is running and cannot set the missing timer button.

csf.cgi:2284 Uncaught TypeError: Cannot set property 'innerHTML' of null
at CSFpausetimer (csf.cgi:2284)
at csf.cgi:2480

I was able to...

Hello, Sarah.
Could it be possible that when we try to block an IP with MailControl, the first POP UP show us if the IP is already blocked?

Until now, if I a see an spammer IP and I want to block it, I click on the red circle, it brings a POP UP with all the info about the IP and a line where I can modify the text of the block.

But some times it happens that the IP that I want to block is...

hello
he has a problem
The site does not send mail
But when you disable *ConfigServer Security & Firewall*
Mail works normal
I use Gmail SMTP

Hi,
I installed CSF Messenger. Everything seems fine. Recaptcha page is working too. When you validate with clicking i'm not a robot button, it says ok.

But when I click Unblock button after that it shows an error.

There has been a problem: Unable to verify with Google reCAPTCHA

I tried almost everything, but it doesn't validate somehow. What could be the problem?

Hello,

When cxs ModSecurity Scanning enabled on a directadmin server which has got openlitespeed with comodo waf, does cxs work?

Anyone knows that are compatible?

Thanks

Could someone kindly point me in the direction of more information regarding the MySQL Data Collection feature? It looks like an interesting feature, based on the description in the config, but it doesn't provide much detail and I'm having configuration challenges.

ST_MYSQL =
The following options are for authentication for MySQL data collection. If the password is left blank and the user set...

When the Watch System Logs page loads, the refresh function is automatically set to five seconds. I rarely find the auto-refresh helpful as I typically am scrolling up through the logs and lose my place when it refreshes.

I've been wanting a feature request for a switch to disable the auto-refresh either on the page or in the config. This could also include customization of the refresh...

I'm trying trying out CSF using vagrant to test out how it works and testing out the configuration I need to do before I apply to my actual VMs.

I deployed two sandbox VMs. 192.168.33.10 (with CSF) and 192.168.33.11 (VM that will try to brute force SSH to 192.168.33.10)

Given /etc/csf.allow

10.10.10.10
192.168.33.1
172.16.1.1/29
192.168.33.11

And /etc/csf.ignore

127.0.0.1
10.10.10.10...

I keep seeing dozens, sometimes hundreds of class B or C IP's coming to the server with 1 connection with no real performance impact. I never let them stay connected long enough (or they don't) to dig deep into what they are actually doing (I need to thought).

My question is, is there a setting in CSF to watch for a scenario like this and block that B or C class block. This latest one is from...