ConfigServer Community Forum

I stopped receiving alert emails about SSH root logins, on all the servers i use CSF+LFD on... did something change in a recent update?

More and more spam emails are arriving at my servers with message bodies that look legit so they pass as NOT spam. But their PDF attachment contains blatant spam, so they are using this method to get by the spam filters. Does Mailscanner scan PDF files for spam? If not, what can be done to stop this?

Thanks,
Greg

Hello!

I'm facing the following situation:

I have two interconnected servers, one with WHM and cPanel, and the other as a Mailnode with only WHM.

Both servers have Mailscanner installed, but on my Mailnode server, due to the absence of cPanel accounts, I encounter difficulties in manipulating user settings.

On my main server, I can access the interface normally. The question that arises is:...

I'm using csf 14.20 on an Ubuntu Jammy system behind a 1GB FIOS connection. With csf/lfd running, I get throughput of about 30M/s, which increases to about 800M/s with csf/lfd disabled. I'm using a fairly generic csf.conf (shown below) and have tried to improve performance by reducing DENY_IP_LIMIT and DENY_TEMP_IP_LIMIT to 100, but obviously it's still subpar. Any suggestions for how to narrow...

For a server I manage, I explicitly want to receive notification emails of successful ssh logins. I've enabled this, and allow-listed my own fixed IP address.

My customer can login to one account using ssh, but doesn't have a fixed ip. Is there a way to allow-list the public ssh key he's using?

An example of such notification would be:

Nov 28 13:05:51 srv sshd : Accepted publickey for...

Hello,

Currently, I get a ton of emails like this:
lfd on : Suspicious File Alert
Time: Mon Nov 27 10:17:20 2023 +0100
File: /tmp/xxxxxxxx.o
Reason: Linux Binary
Owner: varnish:varnish (xxx:xxx)
Action: No action taken

These files are created by Varnish when it compiles the VCL for reloading.

However, I already whitelisted the varnish user from /etc/csf/csf.fignore like this:
user:varnish...

I have tried searching for all the synonyms I could think of for transfer, copy, new server in relation to CSF, and have come up with nothing...

Searched here and on the COnfigServer website.

I am needing to move all my sites from one server to a new server. The old server will get turned off later.

And I would REALLY like to know how to copy all my settings for CSF from the old server to the...

Hello All

We've been using Mailscanner on our servers and so far it's been very helpful.

However, we would like to find a way to NOT forward emails that are flagged as High Spam Score to any email forwarders our clients might have.
We want to do this in order to prevent any further rate limiting from clients like Gmail and Outlook that is being caused due to the massive spam emails our servers...

Recently I disabled WP-CRON for wordpress and started using CPANEL with WGET to replace it. I've started getting emails lfd on XXXXX: Suspicious process running under user . I found some instructions on where to go to tell CSF to ignore these in the /etc/csf/csf.pignore edit, but I'm unclear exactly how to do this. Here is what the LFD emails are showing:

Executable:...

On my DirectAdmin/CentOS server I am using ConfigServer Security & Firewall - csf v14.20

The 'Check php version' mentioned that PHP version 7.4.33 is lower then 7.2 ??
7.4.33 is the only PHP version installed on this server.

Any version of PHP older than v7.2.* is now obsolete and should be considered a security threat. You should upgrade exclusively to PHP v7.3+:
Affected PHP versions:
7.4.33...

SYSTEM INFORMATION
OS type and version Rocky linux 8.8
Webmin version 2.101
Virtualmin version. 7.8.2
Config server Firewall(CSF) verison 14.20(generic)

I want to see alerts of outgoing emails from my server when they cross a certain limit and I have configured everything accordingly but alerts are not coming in my given email. Everything is working fine except Relay Tracking. We are using...

I've always used CC_ALLOW_FILTER to block non-US IPs, but I recently began using Cloudflare and now all connections come from a Cloudflare IP! My server load has skyrocketed, so I don't think that CSF is able to block non-US IPs anymore.

I blocked them in Apache configuration, but I think that runs after CSF, too, so I'm still getting the Apache connection for each request. And I'm talking about...

I've seen a lot of threads related to using Cloudflare, but no answers :-( Hopefully this thread will be the exception!

I've always used CSF's CC_ALLOW_FILTER to block non-US IPs. But I started using Cloudflare in September, and now that all incoming IPs appear to come from Cloudflare I don't think that this is working.

I tried enabling CF_ENABLE, but nothing changed so I think there must be...

LFD is emailing me three times for all excessive SFTP usage. Not for other excesses.

I know I could add the SFTP executable to the pignore file but I want to receive these notifications.

How can I make it email just the once for each excess?

SYSTEM INFORMATION
OS type and version Rocky linux 8.8
Webmin version 2.101
Virtualmin version. 7.8.2
Config server Firewall(CSF) verison 14.20(generic)

I want to see alerts of outgoing emails from my server when they cross a certain limit and I have configured everything accordingly but alerts are not coming in my given email. Everything is working fine except Relay Tracking. We are using...

Hi,

There has been an update to the GeoLite2-Country-Locations-en.csv file that comes from maxmind.

Prior to around 31st October 2023, the GeoLite2-Country-Locations-en.csv file had this entry:

2750405,en,EU,Europe,NL,Netherlands,1

After the 1st November 2023, this line has been updated to:

2750405,en,EU,Europe,NL, The Netherlands ,1

For some reason, csf is having an issue with parsing...

Hi all,

On my VPS I use:
- WHM/cPanel v114.0.11
- CloudLinux v8.8.0
- Plug-in: ConfigServer Security & Firewall - csf v14.20

I am a beginner.

On my VPS I host several websites for others. Also, the VPS serves as a mail server.

Part 1:
I perform all management tasks for my VPS from 1 fixed IP address for example xxx.xxx.xxx.xxx.xxx. This IP address should never be blocked and all ports...

Hello,

I'd like to send all RBL lookup queries to a remote standalone DNS server dedicated to RBL lookups only.

Our cPanel install uses the non-caching version of pDNS, a remote Bind install would go some way to getting access to our RBLs back without the your query was blocked issues we're currently facing.

If I were to add the following to /etc/mail/spamassassin/local.cf would MailScanner...

Hello, please add support for Debian 12.

lfd warns me daily about a process i simply cannot teach csf to ignore:
Time: Wed Nov 1 20:08:44 2023 +0100
Account: www-data
Resource: Process Time
Exceeded: 146435 > 1800 (seconds)
Executable: /tmp/appimage_extracted_a3ed3648c2d4a42fcd239937c53130a2/usr/bin/coolwsd
Command Line: coolwsd --config-file=/tmp/appimage_extracted_a3ed3648c2d4a42fcd239937c53130a2/etc/coolwsd/coolwsd.xml...