ConfigServer Community Forum

I'm getting a lot of single IP's hitting multiple domains on a server in a DDOS attack. Something like this - 1x IP (sometimes 3, 4 or more) calling:

domain1/index.php
domain2/index.php
domain3/index.php
domain4/index.php
etc

Often they will call 20 url's on the single domain and hit 5,10,20 domains at once, over loading the server. Some of the URL's exist, some don't.

A simple way to block...

Hi,

I've noticed that the cPanel disk usage emails sent to hosted clients were all marked as low spam.

The emails were sent from cpanel@local-domain-name with a client IP of 127.0.0.1 and tripped the KAM_MAILBOX2 rule with a score of 6.25.

The KAM_MAILBOX2 rule relates to Mailbox Quota Phishing Scams.

How do I stop internal cpanel emails from triggering this rule while keeping the score as...

Learn as spam & report is not reporting to spamcop, so where is it supposed to be reporting to?

If I click Report to Spamcop it works, but not the button addressed above.

Is it reporting elsewhere?

Hi,

I'm regularly getting an email form cxs Scan saying it is scanning a file but then Clamd gives an error saying there's a File path check failure: No such file or directory. ERROR

cxswatch Scanning /home/username/public_html/wp-content/cache/db/singletables/c99:

then:

# Clamd Error for : /home/username/public_html/wp-content/cache/db/singletables/c99: File path check failure: No such...

My WHM server is nat with private ip in the 10.10.1.0/24 range. I am looking to block 2087 access over the internet

eth0 10.10.1.5 Main/shared IP for: admin and others x.x.x.x

In my csf.allow I have the following config tcp|in|d=2087|d=10.10.1.0/24
and in csf.deny I have the following config tcp|in|s=2087|s=0.0.0.0/0

However, I can access the WHM page over the internet, outside of my network....

Hi.
I have a list of 27 emails and using the option:
TO DOES CONTAIN email@address.com
shows that 12 of them contains the email address.

So, now I want to see the list of the ones that doesn't include that email address using:
TO DOES NOT CONTAIN email@address.com
and when I click VIEW EMAILS, it shows all the 27.

Just to give more information:
All the 27 emails contains about 12+ recipients....

Hello, I have been using Configserver on WHM/Cpanel on CentOS for years and recently moved to a new server with WHM/Cpanel on CentOS.

The file csf.conf keeps getting overwritten with what appears to be a default configuration. I make changes and safe via the UI in WHM/CPanel or I make changes via SSH and Emacs. Either way, after some time the file is replaced with a 'default' csf.conf that...

Hello everyone,

After googling for some time and not finding anything on this problem I'm asking here for some help.

I've setup remote logging for rsyslog on debian 11 and when CSF / LFD ist enabled, I get the following error for rsyslog:
(changed URL inside of the error message because of limitations)
Oct 30 16:54:08 SERVER85 rsyslogd : action 'action-0-builtin:omfwd' suspended (module...

I cannot reproduce this on any other servers, but am not sure where to go with this. LFD is detecting brute forces fine and logs that it is blocking the IP:

Oct 28 17:06:44 dalgarno lfd : (sshd) Failed SSH login from 112.95.75.195 (CN/China/-): 5 in the last 300 secs - *Blocked in csf*

However, the IP does not end up in IPTABLES nor does an entry get written to /etc/csf/csf.deny

I have...

I find csf will not check ip in list or not, if same ip for multi attack, csf will add multi times
I know we can't realtime to check ip list because it will slow down server, but can you add a function let us click on it and check ip list then remove duplicate one?

Thank you

As per CSF v14.17
SMTPAUTH_LOG= /var/log/maillog handles
.* postfix/smtpd : warning: unknown : SASL LOGIN authentication failed: authentication failure
but it does not handle
.* postfix/smtps/smtpd : warning: unknown : SASL LOGIN authentication failed: authentication failure
so for the latter lines you still need to use CUSTOM?_LOG and /etc/csf/regex.custom.pm

Hello all
I needs support. I am trying to protect the login to my application using regex.custom.pm
I added to /etc/csf/csf.conf > CUSTOM1_LOG = /var/log/apache2/my_log

log code

my.domain.com:443 1.1.141.25 - - POST /api/v1/hybrid/session/start HTTP/1.1 200 257 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

the code I made...

I wanted to take the time to come here to thank the developers of csf/lfd. I have been using it on many dedicated CentOS servers for years now and I never had a single problem. It's easy and powerful and I feel that my server are bulletproof!
I want to gradually switch to Debian and I was very happy to see that you also support this distribution.
Thank you very much for your great work!

PS: I...

We've been using this tool for years. Recently have set up a new server, migrated accounts, and tools including this one. But there is no activity in the logs. Don't have a clue where to look. The configuration looks identical.

Looks like one of my servers is not upgrading... and probably for a while.

Upgrading csf from v14.08 to 14.17...
Retrieving new csf package...

Unpacking new csf package...
sh: line 0: cd: /usr/src: No such file or directory
tar (child): csf.tgz: Cannot open: No such file or directory
tar (child): Error is not recoverable: exiting now
tar: Child returned status 2
tar: Error is not recoverable:...

Hi,
I'm the VP engineering at CrowdSec.

I was wondering if CSF could get an option to send its signals to CrowdSec, and in return, the user would get the community blocklist associated with those signals.

CrowdSec supports custom signals, and by using CrowdSec, all CSF users would benefit from a tailor-made blocklist on signals from other CSF users and a global blocklist for global signals they...

Hello,

I'd like to provide some feedback on the Server Check feature.

I've gotten scores up to around 95+ on all our WHM servers but I feel there are some items on there that aren't really bad conditionally. Obviously I've just been ignoring them so far as I understand why they can be ignored, though they could mislead other people.

Server Check

Check for cxs: You should consider using...

Our O/S Commerce software sends an confirmation email to customers.
In the bottom of this email is a load of gibberish, which contains:
'MailScannerScript29528'

Any thoughts as to what this might be please ?

OS: AlmaLinux 8.6 / CloudLinux 8.6

Kernel: Linux cp10 4.18.0-372.19.1.lve.el8.x86_64 #1 SMP Tue Aug 9 15:56:43 EDT 2022 x86_64 x86_64 x86_64 GNU/Linux

Linux Virtual Machine running on Proxmox with KVM

System is to date

As soon as I enable CSF, I cannot connect to any website on port 80 or 443

Looking at the firewall logs, it seems port 80 gets redirected to 19080 and port 443 gets redirected...

hi,

i wish i could use the LF_NETBLOCK function of csf in directadmin. this function would allow me to have a list of really malicious ip while avoiding false positives. BFM works very well, but many users are blocked very often because they are unable to configure an email client. the function of CSF would help me to better manage the problem. afterwards, the generated list of csf.deny is sent...