Hello, how we can exclude cpanelsolr in pignore?

Thanks!

Time: Fri Nov 16 23:01:20 2018 +0100
Account: cpanelsolr
Resource: Process Time
Exceeded: 274648 > 1800 (seconds)
Executable: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.x86_64/jre/bin/java
Command Line: /usr/lib/jvm/jre-1.8.0/bin/java -server -Xms512m -Xmx512m -XX:NewRatio=3 -XX:SurvivorRatio=4 -XX:TargetSurvivorRatio=90

I know that the feature is listed as deprecated

I use it a lot to see traffic hitting the server

the link is now going to a blank page

Ive tried the update scripts
curl -sL | perl

Any other ideas to get this tool out of the dirt ?

thanks in advance

If i were to block all countries but the US, would this load all non-US IPs into the deny list (memory) in order to block? How is this handled, is it memory intensive?

Hi. I'm getting through a lot of `Suspicious File Alert` emails and wondered if you can shed some light for me. I'm not sure what is triggering the emails, whether its csx or the firewall or what but here's the email I get::

```
Time: Thu Nov 15 02:15:15 2018 +0000
File: /tmp/systemd-private-a6133d7fde4048eb9edfb67e9b7a5554-ea-php72-php-fpm.service-vNsXRF/tmp/error.htm.php4L36dP
Reason: Script,...

HI Eveyone,

We've just had an issue where csf was blocking remote backups to a server on my internal network. I ended up turning off the firewall so we could do backups.

Any idea?

Hi All,

I'm using CSF and LFD on one of my WHM servers and have been getting about 6 of these alerts every hour:

Time: Wed Nov 14 06:05:24 2018 -0400
File: /tmp/.xcloner-cc30b
Reason: Suspicious directory
Owner: : (538:538)
Action: No action taken

All 6 are always the same content with the exception of the 5 characters after .xcloner-

Anyone have any suggestions on how to stop these? The...

Hi,

I've recently noticed in my logs many of these:

Nov 14 01:50:48 server.fqdn phpMyAdmin : user denied: root (mysql-denied) from x.x.x.x

How can I get CSF /LFD to catch these and block the source IP attempts?

Thanks.

Michael.

Hey Guys,

Would anybody be able to assist with a regex rule for CSF that would block attempts on the SMTP gateway ASSP?
It create's lines like this in exim_mainlog : dovecot_plain authenticator failed for ( - 185.222.209.83 -) :60094: 535 Incorrect authentication data (set_id=user@domain.tld)

How can I have these ip's blocked after let's say 5 attempts?

Hi.

I recently enabled a couple of RBL's in CSF. I get reports via X_ARF enabling, and it seems that IP's listed in the RBL's defined in csf.rblconf are still getting through and hitting Brute Force, producing the X_ARF report where I can see 5 attempts.

Shouldn't the RBL match of the IP stop even 1 attempt? (assuming the RBL check is working)

Michael.

Hi.

Firstly just to let you know I'm new to CSF but really love it. Thank you for making this tool available.

I've installed it on a couple of CentOS 7 machines, running Virtualmin Pro and Webmin.

All installs and works fine and I install the csfwebmin.tgz into Webmin, however I like to have all iptables logs in a specific file, instead of the normal /var/log/messages file.

I configure...

I've decided to start a new thread because I haven't seen any current working solution, or activity on older threads regarding this issue.

I have spent countless hours over the last 3 months trying to solve this issue with email that is getting blocked which comes from Gmail:

DNS Error: 91335 DNS type 'mx' lookup of localinternetads.com responded with code SERVFAIL

I've read through 3 dozen...

I'm having a lot of problems with clients blocking themselves by signing in with the wrong email login details.

All my clients are in Ireland and I was wondering if I was to use CC_ALLOW_FILTER IE would it stop the problem.

2. If I was to do that would it create significant additional load on the server?

Hi Team,

I have added 177.0.0.0/8 # BR/Brazil/NA. do not delete to our deny list of IPs.

Normally when a range is blocked, then I don't continue to get e-mail notifications for that denied range... however recently I am getting notifications for repeated hacks for IP Addresses that are blocked on the deny list of IPs
Is there a way to ONLY get notifications of NEW IP Address hack attempts?...

Hi All,

I was wanting to permanently deny the following IPV6 IPs

QUESTIONS:-
1) Will the following work?
0:0:0:0:0:ffff:65fe:e68c/120/ # CN/China/Beijing, Xuanyu. do not delete
0:0:0:0:0:ffff:6f49:2e21/118 # CN/China/Nanchang. do not delete
0:0:0:0:0:ffff:7276:6175/120 # CN/China/Beijing. do not delete
0:0:0:0:0:ffff:7bf9:d28/119 # /Shenzhen. do not delete
0:0:0:0:0:ffff:d3da:7e8e # KR/Korea...

Under MSFE-Front End >> Bulk Actions.
Would it be possible to add a bulk action to add the offending IP addresses to CSF Firewall blocklist.

At the moment, you have to enter inside each message and choose block from within, which is time consuming.
It would be nice to highlight them in bulk and block from there.

I have a suggested patch as I have a cluster of 3000 servers and putting 3000 IP addresses in the csf.conf file seems to be a really ugly solution.
My suggestion is to include the possibility of an include file as follows:
1.) If you have only a few servers in your cluster, configure the CLUSTER_SENDTO and CLUSTER_RECVFROM as normal.
2.) If you have many, start the config of CLUSTER_SENDTO...

Howdy,

We've got an interesting issue with CSF on one customer's VPS only whereby the customer will log in to WHM in order to remove an IP block for a client of theirs only to find that CSF is showing up as disabled - with a button to reenable visible.

They're not disabling the firewall and neither are we, but the interesting part here is that the logs indicate that CSF is in fact functioning...

Hi,

How to configure CSF to allow CIFS mount?
Ive enabled TCP_IN and TCP_OUT ports 139. 445 (both for IPv4 and IPv6) and I still get errors:

Nov 3 20:26:13 kernel: Firewall: *TCP6OUT Blocked* IN= OUT=eth0 SRC=xxxx:xxxx:xxxx:xxxx:0000:0000:0000:0001 DST=2222:xxxx:xxxx:xxxx:0000:0000:0000:0001 LEN=80 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=54886 DPT=445 WINDOW=28800 RES=0x00 SYN URGP=0
Nov 3...

Hi all,

Came across a user who was blocked for portscan on 443, is this normal? As far as I can tell my CSF is configured correctly to allow connections on 443, and browsing HTTPS hosted sites works just fine.

/var/log/messages
# grep ::data-removed:: /var/log/messages
Oct 31 11:15:49 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:15:5d:64:7b:05:::data-removed::...

Hello,
after i have updated csf from v11.7 to latest version 12.08, some things on my server have stopped working (such as cronjob for udptscaper) so i desperately need the old working version and ask everyone who has it somewhere to send one such to me ...

thanks to all of you