ConfigServer Community Forum

There should be an option where csf.tempip is updated on using csf -td from the CLI. This way if system admins keep adding temp adding the same IP or CIDR, LFD would see this in the file and perm ban the offending IP or CIDR

Hi,

# Issue

We've been seeing the following error coming through from CSF/LFD recently:

Time: Wed Jun 11 04:27:14 2025 +0000
Error: Failed to detect code in SYSLOG_LOG

SYSLOG may not be running correctly on server.domain.com

# What I've checked:

I've checked checked that rsyslog is running by using:
systemctl status rsyslog

I've checked that /var/log/messages is being written to...

Hi,

I've noticed a behavior in CSF where temporary blocks issued via `csf -t` do not seem to respect the allow or ignore lists. This led to some unintended blocks of IPs that were explicitly allowed or ignored, which was not expected.

To mitigate this, I implemented a workaround where I first attempt to add a permanent block. If that fails due to the IP being on an allow or ignore list, no...

Hi!

I'm trying to use CSF on a Digital Ocean (DO) VPS and I'd like to try managing it through WebMin. The VPS came with Uncomplicated Firewall (UFW) pre-installed.

The VPS just serves one website. I like using the DO firewall for blocking ports and allow-listing my home IP, and continue to use it for that.

The only reason I want to use CSF is to block inbound connections from the three...

I was wondering if anyone has had any experience running MSFE on a cpanel mailnode?

Very keen to see if anyone can share their experiences and if there are any intricacies we need to prepare for if we go down this route.

Hi Team,
I am using ubuntu 24.04 server minimal using virtualmin pro
Replaced fail2ban with CSF. i keep getting bruteforce attacks or unsure what it is from mail logs please see below assist me with regex codes. apologies just a beginner

warning: unknown : SASL LOGIN authentication failed: authentication failure, sasl_username=shosabu
May 23 15:08:23 server.com postfix/smtpd : disconnect from...

Blocking countries in CC_DENY from Country Code Lists and Settings blocks access to some domains and their websites on the VPS.
We have to restart CSF to gain access, and so every time we are unable to access without making any changes to CC_DENY, we have to restart CSF again.

Hi.
One of my servers is reporting:
/var/log/cxswatch.log:
May 10 03:02:00 server1 cxswatch : Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource or increase /proc/sys/fs/inotify/max_queued_events
May 10 03:08:24 server1 cxswatch : Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource...

Hi There,

We like to use CSF in combination with a Paid version of MaxMind Geo-IP2 database.

If i review the code, the free-version is hard-coded:

ConfigServer/Config.pm:

$config{cc_country} =
$config{cc_city} =
$config{cc_asn} =

It would be great if these download URLs (or edition_id) are overwritable so that the Paid GeoIP2-Country-CSV edition can be used.

Recently we've added the UptimeRobot IPs from to our CSF allow list (using Include of a separate file).

For each IP, we've added icmp|in|d=ping|s= and tcp|in|d=80,443|s= .

On some servers running CloudLinux 8 with cPanel, we've got this error after restarting CSF:
csf: IPSET creating set chain_ALLOW
csf: IPSET creating set chain_6_ALLOW
csf: FASTSTART loading csf.allow (IPv4)
csf: FASTSTART...

Hi.
What means the following LOG Line on CXS?

Inotify Event Queue Overflow - some activity for [] [] has been lost, you might want to ignore this resource or increase /proc/sys/fs/inotify/max_queued_events

Sergio

Hello,

We'd like to use the LF_APACHE_404 option to block IP's getting multiple 404 errors. The issue is it appears to be based on HTACCESS_LOG and that is set to /usr/local/apache/logs/error_log. Even if that was pointing at the access log, it's the main Apache log, not the hosted site logs. What would the side effects be if we change that to be /var/log/apache2/domlogs/*/* ?

Thanks in advance

Hi! Greetings from Mexico!

I've been using MSFE for several years, but each day spammers get more creative and resourceful, so I'm getting more and more spam every day.

Any tip or trick so MSFE can filter more spam?

Thanks!

Hello,

To spot some hacked websites and some virus, I'd like to have a log of all outgoing traffic on a list of specific ports. Is this achievable on CSF or I have to manipulate directly iptables?

Thanks in advance.

Hi.
I created an MD5SUM for index.html file and add it to cxs.ignore but CXS continues to show:

WARNING: '.../public_html/wp-content/uploads/ast-block-templates-json/index.html' scanned 6 times in the last 30 seconds, you might want to ignore this resource

I don't want to ignore the route nor the file name but I want to ignore the MD5SUM, Any idea?

Sergio

I have an AlmaLinux 8 server running CSF + LFD, using ipset for a larger corpus. Load looked very, very high, and I noted in the web server logs that IPs which were blocked in CSF were hammering some of my domains. So I did a systemctl status on iptables. It responded that iptables was dead . systemctl status csf showed that CSF was running.

I did a systemctl iptables start , and load plummeted...

At I see 2 buttons View lfd statistics and view system statistics.

These are not displayed on my CSF. (Installed on Debian12)
Is there something to be done at csf.conf ?

PS : I have a log issue (

Hi,

I recently added Abuse IP DB to my CSF blocklists file as I've seen an increase in web scanning, and all of the source IPs were listed on AbuseIPDB, so I figured it may be a good source to add to CSF blocklists..

I noticed some unwanted traffic this morning, and the IP was on AbuseIPDB, so I started digging and found that the csf.block.abuseipdb file in /var/lib/csf only contains around...

Are there any plans to release a version of MSFE that supports the webuzo panel?

Hi all,

Used the CC_DENY option to block AS16276 since some bots hosted there are hammering my site.

Noticed email to some users can no longer be delivered, seems that their mail server is hosted on AS16276 (mail.ovh.net).

Is there any solution to fix both problems? Continue to block AS16276 but allow mail to be delivered?

R=lookuphost T=remote_smtp defer (110): Connection timed out...