ConfigServer Community Forum

Hello,

I see everyday similar action. How can I block with CSF firewall ? For example more than 50 packet per IP blocked. CT_LIMIT not help this problem.

From 205.209.159.201 - 1548 packets

Regards,

Hi guys,

I'm running Postfix on a generic Centos 8 server and I'm trying to lock it down with CSF. I've done a fresh install, reviewed the conf, set testing = 0 and restarted the service.

The postfix maillog (/var/log/maillog) is showing a lot of SASL authentication failures like this:

May 5 09:21:38 myserver postfix/smtps/smtpd : connect from unknown
May 5 09:21:39 myserver...

Hello,

This is only few lines. We have a maybe tousend of line. And CSF didn't stop this. Which config missing our CSF ?

Regards,

139.880043136 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.882366931 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.884717429 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.887074679 43.239.141.121...

I get this alert every 5 minutes:

File: /tmp/systemd-private-c187857224034146b6d5778aa1a95646-ea-php73-php-fpm.service-Va0Oin/tmp/config.tmp.phlT82
Reason: Script, file extension
Owner: x:x (1009:1011)
Action: No action taken

What should I do about it?

Hello All,

I got all of the settings double checked to setup the CSF Cluster, I have all nodes sharing both send and receive and the firewalls are open on each, so when I cping test it comes back with pong, so communications is happening.

My test was to add an ip on a deny list and then check if that IP is on the deny list on all the servers in the cluster.
I added a comment as well, so I was...

Hello,

I have a 6 domain on me server. I need to block all icmp and ping one IP on my server. I tried this way.

icmp|in|d=ping|d=xxx.xxx.xxx.xxx

But not blocked ping, any idea ?

Regards,

Hello,

Everyday I can see a lot of bad IP in logwatch list like that. How can I block that IP automaticly ?

From 139.162.225.221 - 1256 packets
To xxx.xxx.xxx.xxx - 126 packets
Service: echo (tcp/7) (Firewall: *TCP_IN Blocked*) - 1 packet
Service: echo (udp/7) (Firewall: *UDP_IN Blocked*) - 1 packet
Service: discard (tcp/9) (Firewall: *TCP_IN Blocked*) - 1 packet
Service: discard (udp/9)...

Hi,

Currently the ModSecurity Log page doesn't update automatically, it would be nice to have a way to auto refresh the page just like the Watch Logs feature within ConfigServer Security & Firewall.

The next improvement that would make a huge difference is simply adding a column for Status to tell us if it's a 200, 403... etc. The same way how cPanel's Mod Security Hits list has the column...

Hello. It can be done to configure Mailscanner to send email to server administrator of the Other Bad Content Detected emails but configure it to each domain?. Thanks.

Kind regards.

Hello,

I've been receiving the following nightly errors.

ERROR: getpatch: Can't download daily-26096.cdiff from database.clamav.net
ERROR: Can't download daily.cvd from database.clamav.net

Any guidance would be greatly appreciated.

Thank you,
Tim

Hi,

I tried first installing CSF from the guideline provided on your website: but this created a huge problem for us. Our server was filled up with 60k+ processes like this:

root 2398 0.0 0.0 124500 1620 ? Ss Apr27 0:01 /usr/sbin/crond -n
root 13451 0.0 0.0 222996 3648 ? S 00:00 0:00 \_ /usr/sbin/CROND -n
root 13468 0.0 0.0 113280 1200 ? Ss 00:00 0:00 | \_ /bin/sh -c /usr/sbin/csf --lfd...

Hello,

For some reason i’m getting the digest email twice each time it runs (to the same email address0. Where can i check to see how/why this happens and correct it.

Thanks in advance.

hello -

i am having trouble being able to UNblock by a specific port, in this case, 3306.

in my csf.allow file, when i have just the following:

123.123.123.123

i can certainly access port 3306 as expected.

HOWEVER when i only have the following: ( i included ALL i could think of just to see if that helped)

tcp|in|d=3306|s=123.123.123.123
tcp|out|d=3306|s=123.123.123.123...

Hello,

Please add csf.deny.bak function when we press `Flush All Block` button. Because no any warning for faulty pressing. Today I lost more than 4000 bad IP address.

Regards

Hello,

My server has a 8 domain and one mail IP. I need block all connection to this IP exept mail ports 587,993 etc. Not need whole server.

Regards,

Hello
As a server admin I would find it usefull if it was possible to interact with the MailScanner interface via an API, or via CLI commands, so some things could be scripted or integrated with existing custum user interfaces.
Thanks
Best regards,
Yves

Hello
WireGuard and Tailscale becomes used alot.
If I make no mistake anabliing it needs setting up things outside of the CSF UI or standard cfs.conf
Suggestion : integration as a checkbox option in the UI or config
Thanks
Best regards,
Yves

Would it be possible to have the From: (Header) added to the options of where to search in MailScanner FE? The number of messages that take forever to find because MSFE does not look at the From Header field is very frustrating.

In my testing I wasn't able to get the LF_BIND login failure trigger to work. After checking some Centos7 and Centos 8 servers it looks like the BIND trigger in RegexMain.pm doesn't account for the hex value e.g. (@0x7f18041004f0) that is logged in Bind 9+ servers.

Broken (Currently used):

Fixed (I just added the (?: \S+)? to add a non-capturing group that is optional):

I hope this helps!

A user submitting the wrong login details to the mail service or htaccess login can easily result in their IP address being added to the CXS reputation list. Their access to the server will be blocked, and access to other servers using CXS reputation list.

When a user reports the problem, the first thing we do is search for & remove the IP address in CSF (as I presume most server admins will...