ConfigServer Community Forum

Hi!

I think it would be amazing if we could have advanced port filtering for csf.ignore file. I prefer to use this sparingly if not at all since it ignores all activity from an IP, but all too often we get requests from customers that cannot figure out which email client is causing them LFD blocks and want us to add their IP to csf.ignore. I provide the warnings about making sure all devices on...

Last night the server using CWP Pro comming with CSF and LFD upgraded to the latest version.

One of our websites/shop running on that server started having issues on the checkout page.

Page load times of normal cached pages got a little extra delay in it.
The checkout page however gotten an extra delay of between 20-60 seconds......

Yes u read this right 20-60 seconds delay on page load

When...

It has become standard to block bad API calls with a 400 status.
With MVP architecture so prominent on the web, it has become commonplace to build everything as an API (for AJAX to serve the front end of a website).

Our API endpoints, especially login endpoints, constantly get bombarded with SQL injection attempts. These requests fail with a 400 Bad Request status.

It would be extremely useful...

Hi all! :)

I just wanted to confirm whether wildcards are supported in csf.redirect or not. The documentation seems to suggest that they are, but I get this:

Error: csf: Invalid csf.redirect format , at line 3249

With this:

# /usr/local/csf/bin/csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing...

I added several repeat offender ASN's to CC_DENY. Was really excited about this because it could make my life a lot easier.

However, I was dismayed to see IP's from within those ASN's still hitting Apache. The field is setup like this:

CC_DENY = AS12345, AS23456, AS34567

Is this the proper format? I added 20 ASN's, are there any settings to adjust to allow so many? Perhaps DENY_IP_LIMIT? I'm...

Hi all!
We have these settings in place in CSF configuration file:

LF_DISTSMTP = 5
LF_DISTSMTP_UNIQ = 3
LF_DISTSMTP_PERM = 1
LF_DISTSMTP_ALERT = On
LF_DIST_INTERVAL = 300

And some DISTSMTP triggers have been intercepted because of some customer of ours having used Gmail for sending mail messages via our server's MTA.

So we received some mail warings (subj: distributed SMTP Logins on account...

Is there a way to skip the Apache status check in LFD altogether?

I tried setting: PT_APACHESTATUS =
but lfd log keeps showing lfd: STATS: Unable to retrieve Apache Server Status - Unable to download: Cannot parse URL: '?auto'

Time: Thu Oct 28 22:21:17 2021 +0000
Uptime: 152156 seconds
Executable:
/usr/local/cpanel/3rdparty/perl/532/bin/perl

Is this a false signal?

Hello,

There has been recent exim 4.95 changes made which.smtp transports rfc compliant:

It based on RFC 2822 / RFC 5322 (Internet Message Format).

2.1.1. Line Length Limits

There are two limits that this specification places on the number of
characters in a line. Each line of characters MUST be no more than
998 characters, and SHOULD be no more than 78 characters, excluding
the CRLF....

Hi, I'm new to the forum and was clicking around a few of the pinned topics, and noticed that at least one has a dead link:

The link at the bottom is but I assume the forum migrated at some point to the new link format with viewtopic.php instead. Substituting viewtopic for showthread in the link pulls up what appears to be the correct link.

Maybe the DB could be search/replace for this to do...

Hi, I have some servers acting as Wireguard endpoints that need to accept traffic from certain ports and forward them to another host on a LAN at the other end of the Wireguard tunnel. Incoming data on the ports are accepted and forwarded to the appropriate host. Outgoing data is masqueraded. The TCPMSS clamp is required to ensure the forwarded packets respect the tunnel MTU. In this case as you...

Messages missing in Quarantine after upgrade to 9.12

When examining messages in MailScanner Front End, the ability to see the contents of the message is missing, replaced with this remark:
Message not found in quarantine

Hello

the LFD keeps failing and recovered every fed minutes

The service “lfd” appears to be down.
The system’s command to check or to restart this service failed.

i have tried to investigate the issue by

# service lfd status
Redirecting to /bin/systemctl status lfd.service
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled;...

Hello.

I hope everyone is safe and healthy.

The most recent update (Oct. 4, 2021) of ConfigServer wiped out all my previous settings. Does it make a backup somewhere?

Thank you.

helo
lets say our server has 2 ip A and B.
but i only want to block ip A to access country CN.
how do we achieve that?

cc_deny , yes we can use that but for ip source A and B.. how do we only apply ip A?

Hi

I am actually satisfied with ConfigServer MailScanner Front-End. We get a lot of Phishing emails these days. i searched for what i can do better, and I came across here.

Phishing Updates
These scripts will allow you to update your MailScanner Phishing safe and bad sites. The data files are updated four times per day. To use this service simply replace the respective cron files. These files...

I've got a user that keeps getting blocked for a custom LFD rule to block 3 consecutive Worpress failed logins within 3600 seconds. But they swear they are not getting failed logins. The rule is the widely published rule:

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] POST \/wp-login\.php.* 200/)) {
return ( Failed WordPress login from ,$1, wordpress , 5 , 80,443 , 3600 );
}...

Genuine transaction or website access or wordpress-admin updates are blocking csf with the following reason.

Temporary Blocks: IP:157.33.50.133 Port:80 Dir:inout TTL:518400 (Blocked port 80 with Directadmin Brute Force Manager)

How to prevent this or how to prevent the genuine traffics.?? its happening for all.

Sorry if this is a dumb question, but what's the difference between the DYNDNS_IGNORE and GLOBAL_DYNDNS_IGNORE settings in csf.conf?

Login page can't login with reverse proxy.
After that, I modify source code to add remote ip address as a ip address instead of localhost ip address, it work but only in firefox, and after login it still in login screen although i press F5 button. Only when i press Ctrl+Shift+R it will redirect to admin page but when i click a function it redirect to login page, only when i press Ctrl+Shift+R it...