ConfigServer Community Forum

I'm seeing this every time I restart lfd:

● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2020-03-28 09:47:35 EDT; 3ms ago
Process: 21413 ExecStart=/usr/sbin/lfd (code=exited, status=0/SUCCESS)
Main PID: 21426 (lfd - starting)
CGroup: /system.slice/lfd.service...

Hi guys,

i have a problem. When CSF activated i encounter cloudflare 522 error. I also added the cloudflare ip addresses to CSF whitelist but my problem isnt solved yet. By the way, for example, you get this error when you are surfing on the web site. When you refresh the page, the error is dissappear and then you continue to the website from where you left off.

When i deactivated CSF, i never...

I installed successfully. I have not yet turned off testing. I don't want to turn it off until I see that it's working but I don't know if not turning it off could be the cause of the errors.
I am getting these errors when Restarting CSF:

Job for lfd.service failed because a fatal signal was delivered to the control process. See systemctl status lfd.service and journalctl -xe for details....

I try combine Firewall and Laravel. Is it possible to install Firewall as a separate installation and not as a cPanel installation?

I try to control Firewall settings within one application.

Is this technically possible?

Hello,

21 port is enabled on my server but when I run the command:

# nmap -p 21,22,80,443 x.x.x.x

Starting Nmap 6.40 ( ) at 2020-03-22 12:22 +0530
Nmap scan report for server1.xxxxxxxxxx.com (x.x.x.x)
Host is up (0.000079s latency).
PORT STATE SERVICE
21/tcp closed ftp
22/tcp open ssh
80/tcp open http
443/tcp open https

Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds
#

Anyone...

About a year ago, I had an issue where file attachments were being received as winmail.dat files.
Restarting Mailscanner resolved the issue.

Fast forward to last week, and the problem re-occured, so I restarted mailscanner, which again seemed to fix the issue.
However, it's happening again today.

Any ideas what might cause this please ?

Hi CSF Team and Friends,

I'm using ConfigServer Security & Firewall - csf v14.02 , and using CENTOS 7.6 Linux and WHM/cPanel.

I've manually added some hacking IPs and IP ranges in /etc/csf/csf.deny but later I've found that the added IPs and IP ranges are not blocked. Those IPs can still directly go to my website. Why? What is the most possible cause(s)?

Really need help here.

Thank you very...

Hi Everyone,

I'm trying to configure CSF to cluster 3 servers, I want server 1 to be the master and then the other two servers to share information.

###############################################################################
# lfd Clustering. This allows the configuration of an lfd cluster environment
# where a group of servers can share blocks and configuration option changes.
# Included...

Hello,
LFD do NOT recognize matching mod_security rules from Imunify.

We tested with many imunify rules with LF_MODSEC directive and DEBUG directive enabled in csf.conf.

Imunify mod_security rules are not counted neither ignored.

Tested with:

Imunify 4.5.6-1
CloudLinux 7.7
cPanel 11.84
CSF 14.02

Example.
In csf.conf
LF_TRIGGER= 0
LF_MODSEC= 10
LF_MODSEC_PERM= 1

Our custom rule matched:...

We are using the csf RELAYHOSTS setting to prevent lfd from creating temporary firewall entries for customers who successfully check email. We are not on cPanel, so the setting isn't normally there, but it works perfectly once added. We have a separate daemon that maintains /etc/relayhosts with the IPs of recent successful connections.

The problem is that during a csf upgrade it seems to strip...

Hi,

I installed a docker on my machine, running a Discourse instance.

On the host machine, lfd coninues to call out Excessive Resource usage for some commands that I really think are coming from the docker.

Examples:

Executable: /usr/local/bin/ruby
Command Line: unicorn worker -E production -c config/unicorn.conf.rb
---
Executable: /usr/local/bin/ruby
Command Line: unicorn master -E...

We are using the csf RELAYHOSTS setting to prevent lfd from creating temporary firewall entries for customers who successfully check email. We are not on cPanel, so the setting isn't normally there, but it works well. We have a separate daemon that maintains /etc/relayhosts with the IPs of recent successful connections.

The problem is that during a csf upgrade it seems to strip the RELAYHOSTS...

I have a sandbox server that mimics my live site. We have some CRM systems that make outbound connections to smtp servers on port 995. And since our sandbox is sync'd/refreshed regularly with our live site, I've blocked outbound port 995 on our sandbox to prevent the sandbox copy of the live servers from accidentally ever retrieving customer email from our POP servers. I can't disable the cron...

I'm seeking ideas for the most native way to create a configuration to make LFD ignore all IP addresses within a specific Autonomous System Number.

The use case is this: I don't want to block legitimate web crawlers on my server which may trigger failure logs due to HTTP 403's and HTTP 404's. This is frequently a common behavior for websites I host with many pages, which are crawled by search...

Hello,

Receiving the following:

Time: Thu Mar 5 09:02:42 2020 -0500
Account: openvpn_as
Resource: Process Time
Exceeded: 1832 > 1800 (seconds)
Executable: /usr/bin/python2.7
Command Line: /usr/bin/python2 -c from pyovpn.cserv.wserv_entry import start ; start() -no -u openvpn_as -g openvpn_as --pidfile /usr/local/openvpn_as/etc/tmp/wserv.pid -r epoll
PID: 7125 (Parent PID:7104)
Killed: No

Do I...

Hi,
I am using the Config server firewall on CentOS. My question is how to configure csf to allow IPv6 connection(FTP,SSH)??
(If i connect through ipv4 it is working but incase of IPv6 it is not working)

Hi,

Is it possible to exclude to scan any file extension? For example, my server has tons of pictures .png, .jpg,etc and that takes TBs of space and the things that get hacked are mostly .php and .ico files, can I exclude some extensions so the process take quite less time?

Hello i have many e-mail with this alert, i didnt find nothing about it. How can i solve?

Time: Sat Feb 29 11:17:48 2020 +0100
File: /dev/shm/\i360_blamer_reducer423.u1025
Reason: Suspicious file name
Owner: user:user (1025:1028)
Action: No action taken

I have been using IPSET and the MaxMind database to block a handful of countries with CC_DENY. It was working flawlessly, and in January, with the change in MaxMind's licensing, I signed up for a license key and entered it in CSF. I can see that the MaxMind GeoLite database is successfully downloaded and processed in /var/log/lfd.log:

Jan 10 18:00:43 host lfd : CC: Retrieving MaxMind Country...

Good morning,
I apologize in advance if there is already a topic like this, I have searched but have not found it.

I use csf on an AZURE servers, they blocks outgoing mail on port 25.
Is there a way to use notifications and alert with user logged in on another server?

thanks for helping.

Davide Sanryu