ConfigServer Community Forum

Good morning,

Is there a way to rate limit efficiently cPanel account with daily limits with ConfigServer Mail Queue ?

In csf.conf I have
LF_IPSET = 1
LF_IPSET_HASHSIZE = 1024
LF_IPSET_MAXELEM = 65536

I have several public blocklists enabled, namely ABDE, BDEALL, SPAMDROP, etc., all of which have been working correctly on csf with ipset for several years. At this point, I don't recall precisely what I had to do to set it up initially. I thought all I did was uncomment a line in /etc/csf/blocklists to enable...

I don't know if this is a CSF bug or something else so I post it here.

In Centos 7, it was enough to put these lines in the csf.pignore file:
exe:/usr/bin/spamc
exe:/usr/bin/spamd
cmd:spamd child
no problems with perl mails about spamd and spamd child anymore.

Since Centos 8 this is change, no clue as to why.
On is about a suspicious process, the other one about excessive resource usage....

Good morning,

Is there a way to check if From header matches authenticated user and block via MailScanner or OSM if it is not matching?

Thanks in advance.

For CSF messenger, the index.php file that handles unblocking, uses curly braces for array indexes/offsets and throws:

Array and string offset access syntax with curly braces is deprecated.

For example:

$lang{ warning };

Should be

$lang ;

-PHP: PHP 7.4.12
-OS: CentOS Linux release 7.9.2009 (Core)
-CSF: csf: v14.08 (cPanel)

I get a huge amount of e-mail notifications such as the ones below on a daily basis:

Time: Sun Nov 15 12:45:01 2020 +0000
IP: 191.239.XXX.XX (BR/Brazil/-)
Failures: 3 (sshd)
Interval: 3600 seconds
Blocked: Permanent Block

Log entries:

Nov 15 12:30:49 server sshd : Invalid user git from 191.239.XXX.XX port 45826
Nov 15 12:30:51 server sshd : Failed password for invalid user git from...

I have private custom ipset-managed blocklists on my system that get wiped out whenever csf is restarted,because, of course, csf is unaware of them. This poses a management problem.

Is there some way to inform csf of the existence of these ipsets? I am only aware of the support in /etc/csf/csf.blocklists, which is geared entirely to public lists dowloaded from external URLs.

The kind of...

Hello Everyone,
Does anyone know if CSF process is monitored by Cpanel server manager? As some mornings i find CSF randomly stopped i want to make sure that the service restarts should this happen?

Thanks

Rockyuk

Am I getting the error below after last update, anyone else?

UPGRADE:
Tue Nov 10 16:17:08 2020:
1605035828_pre_v14_08_upgrade

ERROR:
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Error: Error processing command for line (6 times): , at line 866

I enabled LF_IPSET and WAITLOCK, but it didn't work.

Hello,

my server provider blocked 25 port, and I use external SMTP service for all outgoing mails. is there someway to setup CSF to send mail notifications via external smtp with required autorization? Thanks!

I am trying to standardize my servers better with Puppet. Puppet is very good at building files with multiple lines like csf.allow, but it is more difficult to add multiple values to a single line like the TCP_IN list in csf.conf.

I attempted to add partial lines to csf.allow, but that didn't seem to work:
tcp|in|d=22 # puppet - from csf-global-allow-ssh
tcp|out|d=8140|d=192.168.118.31 # puppet...

Getting this on check:

Server Check
Check SUPERUSER accounts
You have accounts other than root set up with UID 0. This is a considerable security risk. You should use su, or best of all sudo for such access

How do I check what users have that permission and how do I correct that?

Hello,

Last couple days the LFD on some of my servers have gone a bit crazy. 60+ M/s sustain disk write.

If I turn off LFD Disk IO goes down to almost zero.

I start LFD and it spikes right back up.

I'm struggling to figure out what LFD is doing that's taking so much IO so I can try and fix the root problem.

Thanks.

Hello,
I have had a relatively serious problem for a few days. I have a VPS and I am suffering an attack, almost daily, which I think is DDOS, many connections from different IP's.
I have lowered the value of CT_LIMIT and this is mitigating the attack, but as I lower it, they lower the number of connections per ip and increase the ip's.
I had to get the CT-LIMIT value down to 5 (for a few...

Hi there

We have an server with

CT_SUBNET_LIMIT= 350

however, we do not want this to affect a particular subnet eg 192.168.1.0/24

Immediately, as expected 192.168.1.0/24 triggers

csf -t

A/D IP address Port Dir Time To Live Comment
DENY 192.168.1.0/24 * inout 29m 54s lfd - (CT) subnet 192.168.1.0/24 found to have 1405 connections

despite

cat /etc/csf/csf.ignore...

hi all,
I have wordpress on two web server nodes behind a loadbalancer server. and I log failed login IPs on web nodes in a file in order to use this custom regex on it:

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /^(\d+\.\d+\.\d+\.\d+)/)) {
return ( Failed Wordpress login from ,$1, wordpresslogin , 5 , 80,443 , 3600 , 0 );
}

this works on both servers. But I figured out this is...

Hi,
Our clients OFTEN get blocked by CSF/LFD due to mail bad login attempts, or stuff like that.

They are in offices with multiple email clients (outlook or other).
They always tell me that they did not change anything.
But it MIGHT be one of their employees with an iPhone misconfiguring their account.

So I would like to give them MORE information about WHICH device in their network is making...

Hi,

We are having a strange problem since about a couple of weeks now (nothing changed since it was working as it should)
csf is blocking udp in for port 123 when we use nl.pool.ntp.org , whenever we use another ntp server there is no problem at all.
Because ntp.org uses loads of different servers, it's no option whitelisting them (as they change as well: new servers added, old servers removed)...

Hi,
I have enabled SMTPAUTH_RESTRICT on csf and whitelist my country in CC_ALLOW_SMTPAUTH.
I intend to relay only clients from my country..
I works but i still have a few alerts like this:

Time: Sun Oct 18 23:54:13 2020 +0200
IP: XXXXXXXXXXXX (AU/Australia/-)
Temporary Blocks: 5
Temporary blocks that triggered the permanent block:
Sun Oct 18 19:37:31 2020 (smtpauth) Failed SMTP AUTH login from...

REMOVE THIS POST :D