ConfigServer Community Forum

I have an entry in MSFE Blacklist for a domain (*.domain.tld). But I am still getting email from that domain. Any ideas?

Hi there,

From what I can make out, the settings are correct to only receive notifications for successful logins via SSH.

# Send an email alert if anyone logs in successfully using SSH
LF_SSH_EMAIL_ALERT = 1

LF_PERMBLOCK_ALERT = 0

Though we're still receiving alerts when there are blocks caused by failed SSH logins.

Time: Mon Jan 17 23:29:24 2022 +1000
IP: 0.0.0.0 (ZZ/Country/-)...

For some reason its seems that cluster members do not always respond properly when denying an IP address.

Cluster Ping (They all respond fine):

csf --cping
Sent request to 10.0.0.10, replied:
Sent request to 10.0.0.20, replied:
Sent request to 10.0.0.30, replied:
Sent request to 10.0.0.40, replied:
Sent request to 10.0.0.50, replied:
Sent request to 10.0.0.60, replied:
Sent request to...

Seems that command line help ( -h --help -?) does not work any more.
csf: v14.15 (cPanel)

When Mailscanner FE is installed on a Centos 7 server with WHM/cpanel do global email filters at a cpanel account level still work? (they don't seem to).

I have a situation where mail TO a domain on the server is whitelisted in Mailscanner, and there are global filters at an cpanel account level for that domain, however mail that matches those filters is still delivered.

I have problem with coding in file /etc/csf/csf.deny.

When I'm editing this file in Python I'm getting error: UnicodeDecodeError: 'utf-8' codec can't decode byte 0xce in position 2882: invalid continuation byte .

# file -i /etc/csf/csf.deny
/etc/csf/csf.deny: text/plain; charset=unknown-8bit

# find . -type f -print | xargs file | grep deny
./csf.deny: Non-ISO extended-ASCII text

So my...

Hello Forum,
I want to block an IP Adresse in the range of 91.241.72.0 to 91.241.72.254. Due to spam and multiple IP Adresse in that range.
So i added 91.241.72.0/24 #do not delete to /etc/csf/csf.deny.
And yes i restarted the firewall.

Then i tried to ping 91.241.72.1 from my host... no ping.. Great I thought it works.
The next day I got spam from that IP range agian. WTF!

After some...

Hi, i have two servers that every hour the settings are reseting, and removes on special cofig on TCP_IN, TCP_OUT and SMTP_ALLOWUSER,
i tryed to fix this reinstalling, searching for a cronjob but i already not found what is happening, on the logs there is no not about the resetting

Unless I have an IP address/port entry in the csf.allow (tcp|in|d=5061|s=my_ip_address/32), incoming SIP signaling with TLS transport (not UDP) on port 5061 is blocked.
I suspect SPI is rejecting this traffic.
Is it possible to turn off SPI on specific ports?

port 5061 is being opened with port knocking. I can see incoming traffic on tcp 5061 port with tcpdump, so I guess port has been...

Any idea how to make CSF Firewall only logging to file not the console ?
Using CloudLinux 8.5 with cPanel, last time i check the server it was correctly logging into the log file, but now it's shows the log too in the console.

Recently I started get these error messages. They are for one customer only.
Can anyone tell me what a possible cause may be.

Time: Tue Dec 14 16:16:03 2021 +1300
Type: AUTHRELAY, Remote IP - 124.248.134.94 (NZ/New Zealand/124-248-134-94.dynamic.lightwire.co.nz)
Count: 101 emails relayed
Blocked: No

2021-12-14 07:57:43 1mx2gw-0002Ok-OM <=email@domain.co.nz...

Hi

I recently installed ConfigServer Security & Firewall - csf v14.15 on my VPS and there is an apparently easy problem to solve. A single client has access to the webmail blocked by the Firewall. The internet provider that serves you very often changes the internet IP. There are customers that the provider is another and changes with 30 days or more the IP address, but this provider is messing...

Hi

CC_ALLOW_PORTS_TCP seems to not be working for port 587 in combination with the Dutch (NL) country filter.

The connecting IP's came from NL but were not able to connect.

Thanks

Dear all:

I've been using csf at least 5 years, great product.

I have setup a new server and installed it as usual. But as soon I enabled it, all the network goes crazy, the network latency pikes high, making almost unusable :confused: , I thought I was having issues with the ISP, but I then disabled csf and everything back to normal, enabled it, and the network slow down inmediately.

OS:...

Hi.
I have been using CMM for a long time and I will like to have two options in there that could help us a lot:
1. Download a zip file with all the emails that a user has in all his/her folders.
2. Upload a zip file with all the emails that a user has to his/her folder.

The meaning of this is:
1. We can do a backup of the emails that the user has.
2. Then we can use the backup file to recreate...

Hi!

I think it would be amazing if we could have advanced port filtering for csf.ignore file. I prefer to use this sparingly if not at all since it ignores all activity from an IP, but all too often we get requests from customers that cannot figure out which email client is causing them LFD blocks and want us to add their IP to csf.ignore. I provide the warnings about making sure all devices on...

Last night the server using CWP Pro comming with CSF and LFD upgraded to the latest version.

One of our websites/shop running on that server started having issues on the checkout page.

Page load times of normal cached pages got a little extra delay in it.
The checkout page however gotten an extra delay of between 20-60 seconds......

Yes u read this right 20-60 seconds delay on page load

When...

It has become standard to block bad API calls with a 400 status.
With MVP architecture so prominent on the web, it has become commonplace to build everything as an API (for AJAX to serve the front end of a website).

Our API endpoints, especially login endpoints, constantly get bombarded with SQL injection attempts. These requests fail with a 400 Bad Request status.

It would be extremely useful...

Hi all! :)

I just wanted to confirm whether wildcards are supported in csf.redirect or not. The documentation seems to suggest that they are, but I get this:

Error: csf: Invalid csf.redirect format , at line 3249

With this:

# /usr/local/csf/bin/csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing...

I added several repeat offender ASN's to CC_DENY. Was really excited about this because it could make my life a lot easier.

However, I was dismayed to see IP's from within those ASN's still hitting Apache. The field is setup like this:

CC_DENY = AS12345, AS23456, AS34567

Is this the proper format? I added 20 ASN's, are there any settings to adjust to allow so many? Perhaps DENY_IP_LIMIT? I'm...