ConfigServer Community Forum

Hi! I have a VPS running Virtualmin/Webmin and have CSF installed and mostly tweaked to ignore most of the false positive type of processes. A few weeks back - prior to installing CSF, I had someone exploit one of my wordpress sites and they managed to lay waste to several of my sub servers. Over the weeks - I have wiped most traces that I could find (without standing up a brand new server) and I...

We migrated clients to a new server using the WHM wizard. Should the standard migration wizard copy the modsec rule files created by CMC or is there something we should manually do?

The two user files I'm referring to:
/etc/apache2/conf.d/userdata/std/2_4/ /modsec.conf
/etc/apache2/conf.d/userdata/ssl/2_4/ /modsec.conf

On one server, that has been running fine for a couple of years, I notice now that /etc/csf/csf.deny is empty of all IP listings, though it shows the initial remarked text.

I still receive email LFD notices saying there has been permanent bans of IP addresses, and the latest timestamp of the file was the same as the time of the last LFD email.

Please advise.

CSF, great product, thanks.

I need clarification about the error message I am receiving for a particular client.
dovecot_plain authenticator failed for ( ) :51008: 535 Incorrect authentication data (set_id=xxxxx@xxxx.xxx.xx)

The xx ip address I know is their office IP address, however the IP address 10.242.59.0 I don't recognise, Google search sees it as a private address.
What does the first...

When CF_ENABLED is set to 1, Is there a log of CSF's interactions with CloudFlare?

I have mod_remote IP setup and working, mod_security is setup and working, and in the LFD log I can trigger the mod_security rules and see a block come up (I am testing via TOR):

Jul 16 23:01:42 myserver lfd : (mod_security) mod_security (id:210860) triggered by 162.247.74.216 (US/United...

Hi,

I have set rules in max.message.size.rules. I test send mail with message size bigger than max.message.size.rules. My test mail did not get reject or send, the status in delivery report only show in progress.

How to reject email that violate max.message.size.rules and return bouncing mail?

Thank You

i have problem with *MESSENGERV3* Error: The home directory for csf does not exist
I was useradd csf -s /bin/false and then check lfd.log

Jul 10 23:39:32 lfd : Messenger HTTPS Service starting...
Jul 10 23:39:32 lfd : Messenger HTML Service starting...
Jul 10 23:39:32 lfd : *MESSENGERV3* Error: The home directory for csf does not exist
Jul 10 23:39:32 lfd : Messenger TEXT Service starting......

Hello,

I have a problem with my AWS EC2 VPS.
I have AlmaLinux 8.4 with WHM/cPanel and everything is running very well so far.
But as soon as I enable CSF, my server IPv6 is blocked and my server has no IPv6 anymore.
When I disable it, everything works again.
In CSF I have IPv6 enabled.
Does anyone have any idea what this could be?

I have added a few screenshots

I'm having another issue with CSF blocking inbound emails from Gmail. I logged into multiple gmail accounts and tried to send email to one of our servers and the emails are never received. After I disable CSF firewall i can then receive email from all 3 gmail accounts. I flushed all IP blocks, and added Googles entire IP block 209.85.166.0/255 to CSF ignore. Restarted CSF and still CSF is...

Hello,

I have already bruto force protection for WordPress:
# WP-LOGINS
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] \w*(?:GET|POST) \/wp-login\.php.* /)) {
return ( WP Login Attack ,$1, WPLOGIN , 5 , 80,443 , 1 );

But how can I do this for Magento?
Magento 1: /index.php/admin/
Magento 2: /admin

Hello, i have an dedicated bare metal server with Hetzner but everyday I'm getting emails for outgoing bruteforce and portscan attacks.
My server is a shared hosting server, we're selling shared and reseller hosting through the server and server have almost 900+ cPanel Accounts.
So how can i find out which account is sending outgoing bruteforce attack and how can i stop it ?
I am mentioning some...

Hello,
when I have more as 1 recipient of a mail,
the use of Release (direct) gives the modal say an error message,
and the modal keeps turning.
Error message :
-----)
Direct delivery of 1m************5E to c***************t, g**********************t, d*****************t
Usage: dovecot-lda

(-----

On one of my servers, lfd keeps crashing with the error shown in
CSF version is v14.10

Any help or insight on how to approach/fix this error would be appreciated.

Jul 2 09:42:12 server lfd : Main Process: Unmatched [ in regex; marked by line 2.
Jul 2 09:44:16 server lfd : Main Process: Unmatched [ in regex; marked by line 2.
Jul 2 09:46:46 server lfd : Main Process: Unmatched [ in regex;...

I am trying to install owncloud on a Ubuntu Servers as a docker container.
I am following this documentation.

If I disable CSF all works, but if it's enabled, it doesn't and I see these messages in the logs.

Now, as I see CSF is blocking the traffic between the docker containers or just the port 8080? It's not clear for me.

Any tips?

I setup CSF with ansible using the following config:...

Hi there

The default refresh rate appears to be 5 seconds.

Is there a config setting somewhere to change this to e.g. 15 seconds?

I have PT_USERMEM set to zero but I still get the emails. How is this possible? So much so that the email address that it sends too is now blocked by outlook. So now I just get the email failed messages.

Yes I know I should either stop my scripts from doing it or buy another 100 CPUs but I just want to stop the crazy amount of emails I get.

no list of option. It only shows:

# csf -h
csf: v14.10 (cPanel)

That's normal?.

Btw, Is there some way to reinstall withtout loosing the configuration?

Hi all,

I am getting a lot of e-mails about suspicions process running. I did find many threads about it and all pretty much talk about how to silience those.
I want to fix (if possible) the underlying problem.

Those warnings are generally only specify user and PHP executable.

Network connectiosn I am getting are:
Network connections by the process (if any):

tcp: 127.0.0.1:41462 ->...

Hi,

My client is getting ban from CSF every time when he changes the ip. His ip is dynamic, I'm trying to whitelist him but once the ip is changing he is getting ban.

He is using Jazler to upload from radio the song titles in website using ftp connection.

How we can fix this issue to allow his ftp connection by hostname or by domain?

Thank you

Is there a way to blacklist an IP based on the repeated failures like the following logs?

I get these from journalctl not sure if they are also logged somewhere else.

Jun 01 23:13:07 myhost.goo.edu sshd : Unable to negotiate with 139.59.240.248 port 55732: no matching key exchange method found. Their offer:...