ConfigServer Community Forum

I am getting these lfd emails constantly lately. Can anyone tell me what I need to do to fix this please?

Time: Mon Aug 15 08:00:23 2022 -0400
Error: Failed to detect code in SYSLOG_LOG

Emails are the same except the code is different each time.

Gunstra

Hello,
it is shared hosting and there is strong problem regarding csf, someone is temporary allowing ips without root access and in csf comment, it is showing manually added but I did not.
how is possible without access? and how to solve the issue?

Since some time DirectAdmin (custombuild?) Apache config password protects the URL.

The username and password are re-configured every time build rewrite_confs is run.

The current values are printed (in plain text) at the bottom of /etc/httpd/conf/extra/httpd-info.conf. Eg.

#Authenticate using:
#Username: USERNAME_STRING
#Password: PASSWORD_STRING

The LDF load check calls the URL above but...

Hello,

When viewing the CSF firewall in cpanel WHM there is a CSS style error noticeable at the top of the Juniper theme page for the Search field.

Console shows error:
Source map error: Error: request failed with status 404
Resource URL:
Source Map URL: bootstrap.min.css.map

If I fix this on my end will updates overwrite my fix?

I was wondering if there are any pre-existing hooks/script support for the moment CSF downloads and pulls the geolocation database download? Or would it work to just monitor /var/lib/csf/Geo for file changes?

ls -lAhrt /var/lib/csf/Geo/
total 51M
-rw------- 1 root root 116 May 30 2021 README.txt
-rw-rw-r-- 1 root root 14M May 16 08:00 GeoLite2-Country-Blocks-IPv4.csv
-rw-rw-r-- 1 root root 398...

Hi,

I would like to configure CSF to not block IP-s form some countries in csf.deny ( permanent block ) but still implement the firewall rules for closed ports and other configuration. Temporally block should also work normally.

I know of CC_Allow option but when i add county in that list it ignore ALL firewall rules and i`m looking for solution just not adding the IPs in csf.deny .

Any...

Hey Folks,

I am facing an issue with lfd, ever time i try to terminate an account or modify an account this command is coming of lfd - scanning log files

it also runs at the end of each month, it like it is waiting something that make the CPU spike higher, when every cpu spikes this command runs.

LOGSCANNER = Off
LOGSCANNER_INTERVAL = manual
LOGSCANNER_STYLE = 1
LOGSCANNER_LINES = 5000...

I try to secure login inside OpenCart. I kindly ask you to help me if code is the correct for CSF:

nano /usr/local/csf/bin/regex.custom.pm

# XMLRPC
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] \w*(?:GET|POST) \/xmlrpc\.php.* /)) {
return ( WP XMLPRC Attack ,$1, XMLRPC , 5 , 80,443 , 1 );
}

# OC-LOGINS Users
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*]...

does anyone here have any tips to setting up nginx reverse proxy to properly and fully serve up all of csf's webmin control panel correctly? right now, it mostly works with examples available online for putting webmin behind nginx, but, when editing csf properties and attempting to save them, the proxy redirects fail. i'm left with having to make the csf config edits via command line and manually...

Hi,

may i make a sueestion,
you may create cpanel interface for ender users to scan or check file.
and more feature on whm,by the way,admin can view or make operation easier.

thanks

We are seeing that imap-login is aborting IMAP connections during our nightly upcp cron job which is triggering LFD to add customer IPs to the deny list even though the password is correct and after unblocking they continue to check email fine. Likely a problem with cPanel directly, but since the problem presents itself in CSF first, I wanted to see if anyone else has been seeing this happen? We...

The docs are not very clear about this. Does it add one IP for each list it founds or for all lists?

There is a big difference because one IP can be in multiple lists. My question is if CSF considers the unique IP before it adds to the block list or just reads all the block lists and adds duplicates.

I think the documentation is not very explanatory when it comes to the BLOCK_REPORT feature.

I suspect more than one person found out that this only works for triggers from LFD after a lot of debugging.

This hampers more or less the idea of being able to report abusive IP's or report them because half of the features of CSF rely on, well, CSF and not on LFD.

Since CSF already has the option to...

1-2 times per days I am getting a flood of SSH alerts for user/root logins to ssh but looking at the dates they go back several months and are not current logins.

The first time this happened I thought I was compromised but it's been 2 weeks now and I am growing tired of the random floods of email. Any ideas?

I just move my clients to a new server.
I have dovecot and Exim
CSF and imunify360

I get a lot of emails about lfd on jds1.3aliXXXXXXXX.com: blocked XX.68.245.XX (US/United States/c-XX-68-245-xx.hsd1.xx.xxxxxxx.net)

T ime: Fri Jul 8 11:59:08 2022 -0400
IP: XX.68.245.XX (US/United States/c-XX-68-245-xx.hsd1.xx.xxxxxxx.net)
Failures: 5 (smtpauth)
Interval: 3600 seconds
Blocked: Permanent Block...

This post can be deleted - We found a bug in the way Imunify360 integrates with CSF whereby it removes the iptables entry but fails to add the IP to its own greylist ipset list.

I have a spammer accessing my server via an outside source. But that's really not the problem at the moment.
Some clients can't access their website.
Some get a 403 Permission Denied
You do not have permission for this request /wp-admin/post.php
when editing a page

I just got CXS and ran a full scan and got back hundreds of emails for vipercache directory
----------- SCAN REPORT -----------...

Guys, I'm getting an error like this. Csf is installed on the server and it's blocking push notifications. The problem is caused by csf, but I couldn't find where it is blocking the port. What is preventing push notifications? I will be glad if you help.

ErrorException: Push notification failure: cURL error 7: Failed to connect to fcm.googleapis.com port 443 after 1011

Hello Support.

I am using ConfigServer Security & Firewall - csf v14.16

Within CSF Country Blocks the list of country codes that I save are dynamically disappearing , so that the text field is left empty.

This phenomena has occurred 5 times .

And it usually happens somewhere between 3 to 24 hours.

======

My country code list is . . .

AF, BD, BR, CN, CZ, GR, HK, HU, IT, KR, RO, RU, TR,...

Hello,

It seems CSF blocks DHCPv6 ports by default, which can cause some confusion. I suggest that by default, CSF allows UDP6_IN for port 546.

DHCPv6 clients listen on UDP 546, and send responses to servers on UDP 547.

Reference: