ConfigServer Community Forum

Hi Team,
I am using ubuntu 24.04 server minimal using virtualmin pro
Replaced fail2ban with CSF. i keep getting bruteforce attacks or unsure what it is from mail logs please see below assist me with regex codes. apologies just a beginner

warning: unknown : SASL LOGIN authentication failed: authentication failure, sasl_username=shosabu
May 23 15:08:23 server.com postfix/smtpd : disconnect from...

Hi all,

I was invited to write here my problem... that is actually not only my problem as I can see from past threads complaining the same problem....

PROBLEM : MSFE only allow to block by envelope-from not from .

SCENARIO
I happens that trying to blacklist spammers, very often the envelope-from is the address of mailchimp servers and not of the real email account.
Let's take this real...

Blocking countries in CC_DENY from Country Code Lists and Settings blocks access to some domains and their websites on the VPS.
We have to restart CSF to gain access, and so every time we are unable to access without making any changes to CC_DENY, we have to restart CSF again.

Hi.
One of my servers is reporting:
/var/log/cxswatch.log:
May 10 03:02:00 server1 cxswatch : Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource or increase /proc/sys/fs/inotify/max_queued_events
May 10 03:08:24 server1 cxswatch : Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource...

Hi There,

We like to use CSF in combination with a Paid version of MaxMind Geo-IP2 database.

If i review the code, the free-version is hard-coded:

ConfigServer/Config.pm:

$config{cc_country} =
$config{cc_city} =
$config{cc_asn} =

It would be great if these download URLs (or edition_id) are overwritable so that the Paid GeoIP2-Country-CSV edition can be used.

Recently we've added the UptimeRobot IPs from to our CSF allow list (using Include of a separate file).

For each IP, we've added icmp|in|d=ping|s= and tcp|in|d=80,443|s= .

On some servers running CloudLinux 8 with cPanel, we've got this error after restarting CSF:
csf: IPSET creating set chain_ALLOW
csf: IPSET creating set chain_6_ALLOW
csf: FASTSTART loading csf.allow (IPv4)
csf: FASTSTART...

Hi.
What means the following LOG Line on CXS?

Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource or increase /proc/sys/fs/inotify/max_queued_events

Sergio

Hello,

We'd like to use the LF_APACHE_404 option to block IP's getting multiple 404 errors. The issue is it appears to be based on HTACCESS_LOG and that is set to /usr/local/apache/logs/error_log. Even if that was pointing at the access log, it's the main Apache log, not the hosted site logs. What would the side effects be if we change that to be /var/log/apache2/domlogs/*/* ?

Thanks in advance

Hi! Greetings from Mexico!

I've been using MSFE for several years, but each day spammers get more creative and resourceful, so I'm getting more and more spam every day.

Any tip or trick so MSFE can filter more spam?

Thanks!

Hello,

To spot some hacked websites and some virus, I'd like to have a log of all outgoing traffic on a list of specific ports. Is this achievable on CSF or I have to manipulate directly iptables?

Thanks in advance.

Hi.
I created an MD5SUM for index.html file and add it to cxs.ignore but CXS continues to show:

WARNING: '.../public_html/wp-content/uploads/ast-block-templates-json/index.html' scanned 6 times in the last 30 seconds, you might want to ignore this resource

I don't want to ignore the route nor the file name but I want to ignore the MD5SUM, Any idea?

Sergio

I have an AlmaLinux 8 server running CSF + LFD, using ipset for a larger corpus. Load looked very, very high, and I noted in the web server logs that IPs which were blocked in CSF were hammering some of my domains. So I did a systemctl status on iptables. It responded that iptables was dead . systemctl status csf showed that CSF was running.

I did a systemctl iptables start , and load plummeted...

At I see 2 buttons View lfd statistics and view system statistics.

These are not displayed on my CSF. (Installed on Debian12)
Is there something to be done at csf.conf ?

PS : I have a log issue (

Hi,

I recently added Abuse IP DB to my CSF blocklists file as I've seen an increase in web scanning, and all of the source IPs were listed on AbuseIPDB, so I figured it may be a good source to add to CSF blocklists..

I noticed some unwanted traffic this morning, and the IP was on AbuseIPDB, so I started digging and found that the csf.block.abuseipdb file in /var/lib/csf only contains around...

Are there any plans to release a version of MSFE that supports the webuzo panel?

Hi all,

Used the CC_DENY option to block AS16276 since some bots hosted there are hammering my site.

Noticed email to some users can no longer be delivered, seems that their mail server is hosted on AS16276 (mail.ovh.net).

Is there any solution to fix both problems? Continue to block AS16276 but allow mail to be delivered?

R=lookuphost T=remote_smtp defer (110): Connection timed out...

So we're running a Proxmox server with several LXC containers, Proxmox is Debian, and Containers are Centos 7. We install CSF on both the Host and the Containers.

We configured everything properly and running 'perl /usr/local/csf/bin/csftest.pl' under the container gives OK on all tests:

# perl /usr/local/csf/bin/csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing...

Hi,

I'm getting suspicious alerts for webalizer process like this for all users. I couldn't find anything suspicious.

USER 917236 0.0 0.0 272464 7172 ? SNs 06:38 0:00 /usr/local/cpanel/3rdparty/webalizer/bin/english -N 10 -D /home/USER/tmp/webalizer/dns_cache.db -R 250 -p -n DOMAIN.com -o /home/USER/tmp/webalizer /etc/apache2/logs/domlogs/DOMAIN.com.bkup

I have noticed that webalizer binary...

CSF or LFD do not detect failed logins via email and do not send report emails.
Hi, I've been using csf for a while now and I've noticed from the journal logs that there are several failed login attempts via pop and imap. It seems that these, unlike ssh login attempts, are simply ignored.
cat /etc/csf/csf.conf | grep mail.log
POP3D_LOG = “/var/log/mail.log”
IMAPD_LOG = ”/var/log/mail.log”
The...

we have written rule in csf allow to only allow connection to port 25 from server ip but we are being able to telnet to this port from another ip

rule is written in csf.allow

tcp|in|d=25|s=server ip

tcp|out|d=25|server ip

our intention is only the server should be able to send and receive mails that is we created mail and from cpanel we login into mail and from there only we should be able to...