ConfigServer Community Forum

I'm currently evaluating several firewalls. My goal is to block all traffics from VPN providers. We have the VPN IP address list from the IP2Proxy in the following format with IP address ranges in decimal format.

17496733 , 17496733 , VPN , TH , Thailand
17496784 , 17496784 , VPN , TH , Thailand
17543533 , 17543533 , VPN , KR , Korea (Republic of)
17544563 , 17544563 , VPN , KR , Korea...

Hi there,

Firstly thanks for CMM. I think this is a neat add-on to WHM and you've done a good job with its feature set. I'll definitely be keeping this as standard across our WHM servers.

My only suggestion is that when setting a mailbox quota (for both new and existing mailboxes) the account mailbox quota limit should be ignorable. I suggest this because larger mailboxes (larger than a host's...

At the time of an attack on SSH, a lot of CSF processes are created, sometimes I reach even 60 blocking processes.
This saturates CPU time, what can you do about it?

Hi,

I'm upgrading my Cpanel server in-place from Centos 6 -> 7, and need to know if MailScanner will just work w/o needing reinstalllation. Anyone have insight into this? Thanks!

Mike

I've searched and read many posts on this topics before but I still don't find it clear what specific syntax to use in the csf.pignore file. These is the type of warning I'm trying to ignore.

lfd : *Suspicious Process* PID:3792 PPID:3788 User:username Uptime:121 secs EXE:/home/virtfs/elemcms/opt/cpanel/ea-php73/root/usr/bin/php CMD:/opt/cpanel/ea-php73/root/usr/bin/php -f cron.php

Right now I...

Hello,
which directive would be enabled or disabled so that connections to remote services are made without having to whitelist the ip of this service?For example if a client must connect to an API from his website with the IP address: 192.168.2.3 we need to whitelist this IP on the firewall

Best Regards

Hello,

I'm using csf and have the follow config:
LF_SSHD = 15
LF_SSHD_PERM = 1

Even so ssh logins are being blocked on single login attempt

IP: X.X.X.X (GB/United Kingdom/-)
Failures: 1 (sshd)
Interval: 600 seconds
Blocked: Permanent Block

Log entries:
Sep 20 08:16:34 web7 sshd : Invalid user ubuntu from X.X.X.X port 45160

Cant understand why this is happening. Checking the logs i only...

I installed a new Centos 7 server, the same as my old server.
On my old server I could connect to FTP servers with PASV no problem.
But on my new server it blocks the connection.
SPI is on, Connection tracking is on.

Kernel: 4.18.0-147.8.1.el7h.lve.1.x86_64
CSF: 14.05
cPanel: 90.0.9

I am seeing quite a few new files in the messenger directory along with an index.php which references invalid files. I understand what the .text file is for, can we get an up to date breakdown on what files are used for what now?

Thank you.

Hello,

we have csf - ConfigServer lfd Cluster on 6 servers. On master server we have problems with that and lfd stop working because of that.

service lfd status
Redirecting to /bin/systemctl status lfd.service
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: disabled)
Active: inactive (dead) since Wed...

I think I already know the answer to this but I'm running a half dozen Wordpress sites and I'm tired of seeing the gobs of traffic being blocked at the Wordpress security plugin level originating from China. I would consider putting a country block on China in CSF but frankly there is a small chance there could be some legitimate visitors from China (like 1 in 1000) to some of the websites. So a...

So if I whitelist some IP's from a country in the Firewall Allow IPs list and then add thata country code to the CC_DENY settings, will those whitelisted IP's be allowed access to the server?

hi guy

Currently, I receive reports from CXS, same as this screen :

I want to customize the report

Remove some changes, and reorder the order of the fields

Is it possible to modify or customize this report? How ? where?? which file to edit?

Hello everybody,

What is autodiscover.cgi up to?

How on earth can autodiscover.cgi upload a web file?

Scanning web upload script file...
Time : Fri, 11 Sep 2020 19:30:11 +0100
Web referer URL :
Local IP : 127.0.0.1
Web upload script user : nobody (99)
Web upload script owner: root (0)
Web upload script path : /usr/local/cpanel/cgi-sys/autodiscover.cgi
Web upload script URL :
Remote IP :...

Hello,

after my site was attacked I installed CSF v14.05 and it work great.Except that users with ipv6 started getting (connection time out) and very slow browsing to my site. if I disable CSF the problem goes away.

here is my setting in CSF for ipv6:

IPV6 = OFF

IPV6_ICMP_STRICT = OFF

IPV6_SPI = OFF

Allow incoming IPv6 TCP ports:...

Can CMC be used with Imunify360 to disable modsec rules for specific domain(s) and also server-wide?

Thanks.

Just recently the CSF/LFD Server Check emails from one of my servers started including the following:

----------------
Server Services Check

On most servers the following services are not needed and should be stopped and disabled from starting unless used:

abrtd

Each service can usually be disabled using:

/sbin/service stop
/sbin/chkconfig off
-----------------

The odd thing is that...

Hi guys,

Is there an opposite option of csf.rignore list?
I mean, I want to block some reverse dns.
How to do it?

Thanks!

Is there any way (looks like not through CSF - so has to be Linux/IPSET/IPTABLES command I assume?) to display blocking activity history?

Hello,

I migrate my WHM Cpanel to another server. Is there any instruction on how to install cxs on WHM Cpanel and how to backup and and restore CXS ?

Thank you !