ConfigServer Community Forum

(mod_security) mod_security (id:5000222) triggered by 179.108.72.156 (BR/Brazil/-): 5 in the last 3600 secs (CF_ENABLE) - *Blocked in csf* for 3600 secs
lfd : Incoming IP 179.108.72.156 temporary block removed
lfd : Outgoing IP 179.108.72.156 temporary block removed
lfd : CloudFlare: [CloudFlare: block failed: 400 Bad Request] remove failed: 400 Bad Request (any)

Cloudflare support says the...

Hi,

I have a few big subnets in my /etc/csf/csf.deny file, let's say for example something like this:

tcp|in|d=22,25,80,443|s=1.0.0.0/8

This will deny any traffic from that net, to the ports listed on my host. However I also experienced delivery issues to MX hosts in the blocked subnet (the connection times out), and I suspect it's because of the order of the iptables rule (replies from the...

I have created and tested a Global Filter to filter outbound emails in a cPanel account. The filter works when testing using the webmail client. When sending an email via SMTP authentication and an email client such as Outlook, the filter does not apply and the email goes through.

I am guessing this is due to csf having some sort of priority for SMTP connections and overriding the rules. Can...

Hello,

How exactly does one disable the old script version scan in cxswatch?

There is no way to do it in the CPanel cxswatch Configuration Wizard.

I tried adding nosversionscan=1 to cxswatch.conf, but it is still reporting them.

Thank you.

Hello,

I hope you are well!

Perhaps someone might be able to point me in the right direction, as I seem to be getting nowhere with this. I encountered this issue where, cxswatch is unable to scan files in /tmp folder. In logs, I can see the following error:

ModSecurity: Exec: Execution failed while reading output: /etc/cxs/cxscgi.sh (End of file found)

This is happening on a bare metal...

There should be an option where csf.tempip is updated on using csf -td from the CLI. This way if system admins keep adding temp adding the same IP or CIDR, LFD would see this in the file and perm ban the offending IP or CIDR

Hi,

# Issue

We've been seeing the following error coming through from CSF/LFD recently:

Time: Wed Jun 11 04:27:14 2025 +0000
Error: Failed to detect code in SYSLOG_LOG

SYSLOG may not be running correctly on server.domain.com

# What I've checked:

I've checked checked that rsyslog is running by using:
systemctl status rsyslog

I've checked that /var/log/messages is being written to...

Hi,

I've noticed a behavior in CSF where temporary blocks issued via `csf -t` do not seem to respect the allow or ignore lists. This led to some unintended blocks of IPs that were explicitly allowed or ignored, which was not expected.

To mitigate this, I implemented a workaround where I first attempt to add a permanent block. If that fails due to the IP being on an allow or ignore list, no...

Hi!

I'm trying to use CSF on a Digital Ocean (DO) VPS and I'd like to try managing it through WebMin. The VPS came with Uncomplicated Firewall (UFW) pre-installed.

The VPS just serves one website. I like using the DO firewall for blocking ports and allow-listing my home IP, and continue to use it for that.

The only reason I want to use CSF is to block inbound connections from the three...

I was wondering if anyone has had any experience running MSFE on a cpanel mailnode?

Very keen to see if anyone can share their experiences and if there are any intricacies we need to prepare for if we go down this route.

Hi Team,
I am using ubuntu 24.04 server minimal using virtualmin pro
Replaced fail2ban with CSF. i keep getting bruteforce attacks or unsure what it is from mail logs please see below assist me with regex codes. apologies just a beginner

warning: unknown : SASL LOGIN authentication failed: authentication failure, sasl_username=shosabu
May 23 15:08:23 server.com postfix/smtpd : disconnect from...

Blocking countries in CC_DENY from Country Code Lists and Settings blocks access to some domains and their websites on the VPS.
We have to restart CSF to gain access, and so every time we are unable to access without making any changes to CC_DENY, we have to restart CSF again.

Hi.
One of my servers is reporting:
/var/log/cxswatch.log:
May 10 03:02:00 server1 cxswatch : Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource or increase /proc/sys/fs/inotify/max_queued_events
May 10 03:08:24 server1 cxswatch : Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource...

Hi There,

We like to use CSF in combination with a Paid version of MaxMind Geo-IP2 database.

If i review the code, the free-version is hard-coded:

ConfigServer/Config.pm:

$config{cc_country} =
$config{cc_city} =
$config{cc_asn} =

It would be great if these download URLs (or edition_id) are overwritable so that the Paid GeoIP2-Country-CSV edition can be used.

Recently we've added the UptimeRobot IPs from to our CSF allow list (using Include of a separate file).

For each IP, we've added icmp|in|d=ping|s= and tcp|in|d=80,443|s= .

On some servers running CloudLinux 8 with cPanel, we've got this error after restarting CSF:
csf: IPSET creating set chain_ALLOW
csf: IPSET creating set chain_6_ALLOW
csf: FASTSTART loading csf.allow (IPv4)
csf: FASTSTART...

Hi.
What means the following LOG Line on CXS?

Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource or increase /proc/sys/fs/inotify/max_queued_events

Sergio

Hello,

We'd like to use the LF_APACHE_404 option to block IP's getting multiple 404 errors. The issue is it appears to be based on HTACCESS_LOG and that is set to /usr/local/apache/logs/error_log. Even if that was pointing at the access log, it's the main Apache log, not the hosted site logs. What would the side effects be if we change that to be /var/log/apache2/domlogs/*/* ?

Thanks in advance

Hi! Greetings from Mexico!

I've been using MSFE for several years, but each day spammers get more creative and resourceful, so I'm getting more and more spam every day.

Any tip or trick so MSFE can filter more spam?

Thanks!

Hello,

To spot some hacked websites and some virus, I'd like to have a log of all outgoing traffic on a list of specific ports. Is this achievable on CSF or I have to manipulate directly iptables?

Thanks in advance.

Hi.
I created an MD5SUM for index.html file and add it to cxs.ignore but CXS continues to show:

WARNING: '.../public_html/wp-content/uploads/ast-block-templates-json/index.html' scanned 6 times in the last 30 seconds, you might want to ignore this resource

I don't want to ignore the route nor the file name but I want to ignore the MD5SUM, Any idea?

Sergio