ConfigServer Community Forum

On a shared server, we have a hotel account with a number of users sending between each other. All of them send/receive successfully except one. They routinely get mail marked as high scoring spam and in mail control it looks like this:

In the exim log we get this:

2023-09-20 11:25:39 1qiz58-0000T5-1J no immediate delivery: queued in mailscanner by ACL

Their originating IP *is* listed in...

Hi there,

when trying to access to UI from an nginx proxy, I have these weird error lines:

2023/09/20 15:43:20 2333492#2333492: *687017 upstream sent invalid header: \n ;
print Content-type: text/html\r\n ;
print \r\n ;
print \n ConfigServer Security & Firewall \n \n ;

That 'print \n ;' line should be added just before 'print '...

You are adding that line between HTTP headers, and this...

Hello all!
I have problem with CFS. almal 8.8+DA. CSF shows:
You should consider disabling commonly abused php functions, e.g.:
disable_functions = show_source, system, shell_exec, passthru, exec, popen, proc_open
Some client web scripts may break with some of these functions disabled, so you may have to remove them from this list:
Affected PHP versions:
/usr/local/php56/lib/php.ini...

I just spun up a new server to upgrade the OS to Almalinux 8. I purchased a new license to MailScanner FE and had ConfigServer install it on the new system. When the new and old systems swapped IP addresses, MSFE on both servers stopped working up in WHM (i.e. when I visit /cgi/configserver/mailscanner.cgi the page is blank). How do I fix this?

I don't think that I can use ConfigServer Servics...

Hello,
i am facing a big problem?
I am using csf with cpanel / whm .
Please take a look at this part of the exim_mainlog which indicates some of the 4000 dovecot failed logins over the last 5 days. :
Line 118101: 2023-09-15 06:54:10 dovecot_login authenticator failed for 107.40.3.213.static.wline.lns.sme.cust.swisscom.ch :43582: 535 Incorrect authentication data (set_id=abuse@domain.com)
Line...

Hello!
I'm having some problems with a invasion on a few WHM accounts, CXS is able to locate just a small portion of them and put them on quarantine.
We're also scanning with Imunify and removing the files and injections manually.

There is someway for me to make CXS more effective? I've been just running a few custom commands on the accounts and cleaning based on the report.

Hello,

I currently have Mailscanner running under CPanel and i was wondering if anyone managed to set it up in a way a user can just forward the email to a spam@ to pipe the emails into learning and also add it to the whitelist or even just auto-whitelist address when a learn request is issued.

Hello,
i recently was checking lfd.log ( i am using CSF/LFD with WHM/cPanel) and it caught my eye that although my server is constantly being targeted by potential perpetrators for trying to login by SMTP there are no entries in the lfd.log that indicate that lfd picks up these failed attempts.
Here is a grepped part of my exim_mainlog indicating failed smtp login attempts :
2023-09-13...

I quite often receive cxswatch notifications such as this:

cxswatch Scanning /home/-----------/public_html/administrator/cache/page/6bcd733d21761eedca1b4bdf7116d137-cache-page-38b9d565663691ecd167624392049896.php:

'/home/--------/public_html/administrator/cache/page/6bcd733d21761eedca1b4bdf7116d137-cache-page-38b9d565663691ecd167624392049896.php'
Universal decode regex match =

My server is...

Hi,
Currently in the watch/search log in CSF we only have :
/var/lib/mysql/myserver.myhost.err

Do you think it would be possible to have also the mysql Slow Query Log file access ?
/var/lib/mysql/myserver-slow.log

And why not also the general log ?
/var/lib/mysql/myserver.log

Thanks
Best regards

Hello,

I know this is my first post here, however I must do it since there is no support for CSF on Help Desk. Long story short I have a few ARM64 servers with AlmaLinux, Alibaba Cloud linux, Ubuntu 22; and CSF and LFD does not function properly. For instance, the CSF service on all of them:

● csf.service - ConfigServer Firewall & Security - csf
Loaded: loaded...

Hi I need to know if good way to block spam is just by putting:

Spam List = BARRACUDA SORBS SPAMHAUS SPAMCOP

Will that be enough to start getting blocklists and spam from this list start to be rejected?

I also have the option in exim for bl.spamcop.net and zen.spamhaus.org enabled

Regards

Hello everyone,

I'm inquiring about the possibility of utilizing CSF to block all bots while allowing an exception for Google bots. Google has kindly provided us with a list of whitelisted IPs at the following links:

Googlebot IPs:
Special Crawlers IPs:
User-Triggered Fetchers IPs:
Google IPs:
I've attempted to research this on various forums but haven't been able to find a solution. Most...

Hello. We have a server with CSF that is not logging iptables blocks to var/logs/messages. Last iptables logs are from december. I tried to restart CSF but not works. I compared CSF configuration with other server that logs iptables well, but there is no differences.

Somebody knows what is happening?.

Thanks.

Kind regards.

lfd is checking to see if syslog is running on more modern systems that have moved on to using journald in place of syslog.

It is flooding my inbox with email:

Time: Thu Aug 24 10:11:05 2023 -0500
Error: Failed to detect code in SYSLOG_LOG

SYSLOG may not be running correctly on server.mydomain.com

I have changed the /var/log/messages entries in /etc/csf/csf.conf to correctly point to...

I am using CSF on Debian 11 server, I installed Wazuh agent and I opened ports 1514 and 1515 in TCP OUT in csf.conf and in csf.allow
restart the CSF by csf -ra, also I used csf -f m but the ports still clocked and I see this in syslog

Aug 24 11:46:16 dns kernel: Firewall: *TCP_OUT Blocked* IN= OUT=ens5 SRC=172.31.31.157 DST=X.X.X.X LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48959 DF PROTO=TCP...

Hello, I have seen other systems using csf and when your password is incorrect a certain amount of times it brings up a ban screen which you can then complete a captcha to unban. I have enter my captcha details and tried everything I could find on the web nothing works, currently when i get banned I just cant access my whm cpanel or server etc but I cant unban myself. Does anyone know why this...

I was trying to figure out why changes to blocklists and firewall configurations didn't seem to be taking effect. After digging into it more today, I think I have found a potential bug.

When restarting csf and lfd through csf -ra or through the web interface, the web interface reports back that CSF and LFD were restarted, however when checking the service status with systemctl status lfd.service...

I am getting tons of emails with this alert.
I have opened port 9993 and works but I am getting theese errors

How I can exclude this service or allow all traffic?

What ports does ZeroTier use?#

It listens on three 3 UDP ports:

9993 - The default
A random, high numbered port derived from your ZeroTier address
A random, high numbered port for use with UPnP/NAT-PMP mappings

That means...

Dear friends,
I have a VPS Ubuntu, I changed the default port ssh from 22 to 2222. I want to know, after I changed the default port ssh, Does CSF block the access if they were failed to login?

Here my setting: LF_SSHD = 5 LF_SSHD_PERM = 1

Normally, CSF monitor SSHD service or port?

Thank you so much!

Hantam