Recently I noticed that doing a tempdeny (csf -td ) does also block ip's that are in csf.allow.

When I do a 'csf -d ' that is in csf.allow, then I get:
deny failed: is in the allow file /etc/csf/csf.allow

When I do 'csf -td ', then I get:
DROP all opt -- in !lo out * -> 0.0.0.0/0
csf: IPSET adding to set
csf: blocked on port * for 3600 seconds inbound

I believe this was not the case in...

Hi,

I install install.directadmin.sh and the perl test is successfully but the template not showing into DirectAdmin.
An uninstall and reinstall doesn't work. How i can fix his issue?

# csf -v
csf: v12.06 (DirectAdmin)

Greetings.

Hi, I enabled Messenger service, and it work OK, but I need help with reCapatcha option for unban, it is not clear how to setup this.

This feature requires the installation of the LWP::UserAgent perl module (see
option URLGET for more details)

How/what exactly I need to install on my cPanel/WHM server, what command use to install required module?

cPanel v 74.0.8
CentOS 7.5

Thank you for...

Getting regular emails saying LFD FAILED..

Return-Path:
Delivered-To: info@web-hosting-uk.com
Received: from aidy.web-hosting-uk.com
by aidy.web-hosting-uk.com with LMTP id SBR9DVgrolvoEwAAUKKfGg
for ; Wed, 19 Sep 2018 10:56:24 +0000
Return-path:
Envelope-to: info@web-hosting-uk.com
Delivery-date: Wed, 19 Sep 2018 10:56:24 +0000
Received: from (port=42130 helo=localhost.localdomain)
by...

Hi,

I have a little issue with a specific ignore rule in the process tracking file. It contains: cmd:php-cli /home/account/crons/cron.php > /dev/null 2>&1 ( php-cli is a symlink to /opt/cpanel/ea-php56/root/usr/bin/php )

And even with that, this script is killed: Time: Tue Sep 18 03:00:37 2018 +0200
Account: account
Resource: Virtual Memory Size
Exceeded: 511 > 400 (MB)
Executable:...

CSF is loading as a blank white page when attempting to load it in WHM. We have uninstalled and reinstalled it several times and that has not resolved the issue.

I have generated a custom blocklist that I'm trying to load into /etc/csf/csf.blocklists.

My entry is at the very bottom of that file, and looks like this:
DEVELOPCENTS|86400|0|

I have confirm that I can wget this file from the server in question (i.e. is a valid URL).

After I enter that in, and restart csf & lfd, I run a 'csf -l' to list the rules, and I see:
Chain DEVELOPCENTS (1...

How is it and configure X-Forwarded-For to work and be used in CSF to recognize the real ip behind another waf that delivers a single ip?

Thanks for the prompt response and solution

got a bayes medium detection today that is definitely an exploit but cannot submit via the CXS interface because it is in a zip
compressed file: revslider/V5rev.php ) Bayes exploit probability score
Original File md5sum d6365dfd71f0d2704f76330ab3b84765

Extracted PHP
MD5 827622aa39b891cb8d9c43f090efceae
SHA-1 91357d31683ce4c9a04ad86c8611cdbe0c6fd0b2

Error: File is not a script.You can only...

Hi

Is there a way with CSF/LFD to define a few URLs on our server or page name like xmlrpc.php... And as soon as you call this page and you are not on the white list, we ban your IP for 24 hours for the whole server.

We KNOW that if you try to call xmlrpc.php on our server, that you are a hacker. We don't want your business and we want you out of our neighbourhood and we don't want you to use...

Hi I'm having issues where CSF isn't blocking mod_security events.
I've setup a new server with latest version CSF/CPanel

csf.conf has
LF_MODSEC = 5
LF_MODSEC_PERM = 1

I can see multiple CRITICAL hits in the log /usr/local/apache/logs/modsec_audit.log from the same IP, however its not being blocked.

Any ideas?

Thanks!

I am getting over 800 emails a day about how CXSWATCH is failing to start.

If I stop the service, will the scans I am getting emailed about stop?

And will it make CXS useless?

Thank you.

We are using the Cloudflare CDN - both their firewall and for our DNS.

On our server, using csf, We would like to whitelist (allow) all the IP's from Cloudflare (they have a list) and a few sources like wordfence IP's and our own, and DROP ALL other IP's .

Can that be done with csf, and how?
Maybe I'm blind, but can not see a function to accomplish this, though it can be done by editing the...

Hello,
I have installed the MessengerV2 as described in the readme, with a csf user and files in /home/csf , but it didn't work.
The index.php file was being called with user nobody - confirmed with echo exec('id');

Turns out I had mod_suphp (not mod_suexec ) enabled, and the integration in /etc/apache2/conf.d/csf.messenger.conf doesn't seem to work.
I think, the line should be , but I haven't...

Does csf work well with Plesk? I see it integrates into cpanel, but we don't have that (currently Plesk parallels 12.5)

Any...difficulties on a Plsk 12.5 server - Centos 7

Sid

Hello,
I've installed CSF on my Ubuntu 18.04 VPS. I'm new to all this but learning fast!

CSF says it is running. However, on webmin dashboard it says STOPPED (in red) next to the words Firewall Version .

Going into the LFD tab of the CSF module and asking to see LFD status, I see this

● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service;...

We're converting some of our older servers using CXS to use the --smtp parameter. CXS is working properly and we can see that http uploads are getting blocked, but we never get the email copy. We can't see the SMTP connection in exim_mainlog and there is nothing in exim_reject or exim_panic logs.

Any thoughts on debugging this?

Thanks in advance.

Hi

I've seen similar threads posting about this issue but would appreciate some guidance before 'giving in' and allowing my hosting provider to kill long-running PHP scripts without understanding what is causing them to perpetually run.

I first started receiving these notifications about six weeks ago. Under guidance from my hosting provider, I increased the value of memory and time to disable...

IPs tagged do not delete in csf.allow are being removed from the file after a few hours. The IP isn't mentioned in any logs.

I have a lines csf.allow that looks like:

xxx.xxx.xxx.xxx # do not delete - Wed Aug 22 23:02:50 2018

to allow unfettered access to an ftp server at xxx.xxx.xxx.xxx yet it still seems to be getting cleared out after a few hours.

Any idea how this is happening? Other do not delete entries appear to be left alone.