ConfigServer Community Forum

I have a spammer accessing my server via an outside source. But that's really not the problem at the moment.
Some clients can't access their website.
Some get a 403 Permission Denied
You do not have permission for this request /wp-admin/post.php
when editing a page

I just got CXS and ran a full scan and got back hundreds of emails for vipercache directory
----------- SCAN REPORT -----------...

we have a client with a busy and complex WordPress site that is triggering the php-fpm pool virtual memory size trigger all day everyday

Resource: Virtual Memory Size
Exceeded: 1096 > 1024 (MB)
Executable: /opt/cpanel/ea-php74/root/usr/sbin/php-fpm

the site is secure and is running as it should, so we know theres nothing malicious or anything happening just the false positive alerts are really...

Guys, I'm getting an error like this. Csf is installed on the server and it's blocking push notifications. The problem is caused by csf, but I couldn't find where it is blocking the port. What is preventing push notifications? I will be glad if you help.

ErrorException: Push notification failure: cURL error 7: Failed to connect to fcm.googleapis.com port 443 after 1011

Hello

I have a simple question.

If I allow few countries through cc_allow_filter is my csf.allow whitelisting still works?

For example, if I allow thiese countries: HR, BA, ME and I still try to whitelist a US IP address, is it possible to exclude that IP address, even US is not on the list of allowed countries?

Thanks in advance

Hello, i am trying to configure my CSF messenger service with recaptcha in directadmin its working sometime with HTTP but its not working with HTTPS
also its show recaptcha 1 time in 10 attempts, can you help me please if anyone required any information that can help you about my setting, please let me know

Thank You

Hello Support.

I am using ConfigServer Security & Firewall - csf v14.16

Within CSF Country Blocks the list of country codes that I save are dynamically disappearing , so that the text field is left empty.

This phenomena has occurred 5 times .

And it usually happens somewhere between 3 to 24 hours.

======

My country code list is . . .

AF, BD, BR, CN, CZ, GR, HK, HU, IT, KR, RO, RU, TR,...

Hello,

It seems CSF blocks DHCPv6 ports by default, which can cause some confusion. I suggest that by default, CSF allows UDP6_IN for port 546.

DHCPv6 clients listen on UDP 546, and send responses to servers on UDP 547.

Reference:

Running Ubuntu 20.04.4 and found that even though I have a valid csfpost.sh it is not run on server reboots.
root@mybox:/etc/csf# ls -l csfpost.sh
-rwx------ 1 root root 529 Jun 16 13:22 csfpost.sh

If I manually csf -r then it does get executed. I can't find anything in documentation to indicate I have something wrong.

As a workaround I created a line into the cron /etc/cron.d/csf-cron...

Is it possible to create some form of block rule based on headers.

ie, if headers conatins xyz, don't deliver, or drop or reject of fail

I have a vps with cpanel and csf.
I add my ip, as a test, in Deny IP and I can continue browsing without problems.
It is worth clarifying that the IP is not added to Allow IPs.
CSF latest version.

Any suggestion?
Thanks

Hello

I have one question about CSF and WHMCS. We are using a free addon for WHMCS for clients to allow clients to unblock an IP that has been blocked on a cPanel server that is using CSF., without needed to open ticket etc.

On WHMCS for security reasons we have create API Tokens through WHM, so WHMCS would be able to create, suspend, terminate, delete accounts etc.

If we would like to have...

Hi,

We have been using CMC for a few years and find it invaluable when needing to make quick tweaks to ModSecuirty rules for specific users, domains, etc.

Since installing CMC there have been a couple of ModSecurity packages/modules added to easyApache in cPanel, and I am wondering whether CMC is compatible with these modules...

1. modsec2-rules-owasp-crs for auto updating the rule set
2....

Example log

/var/log/directadmin/login.log

2022:05:29-21:10:34: '1.2.3.4' failed login attempt. Account 'awdasdawd'

with this new format, currently CSF Firewall doesn't block on failed login activities.

Currently I temporary fix myself by adding new regex to regex.custom.pm

Mailscanner FE says it's working, but in taillog I see this:
May 24 19:59:22 host MailScanner: Failed to read configuration file /usr/mailscanner/etc/MailScanner.conf
Mail doesn't seem to be coming through since we updated an hour or so ago.

I notice that when I run my csf installer script on my ipv6-only hosts, it fails. Seems like download.configserver.com isn't reachable over ipv6. Could you please enable ipv6? I know there aren't many ipv6-only hosts around, but I'm pretty sure that will change in the upcoming few years.

Angelo.

--2022-05-22 17:15:46--
Resolving download.configserver.com (download.configserver.com)......

I have some blocking rules set up in csf.blocklists including a paid API key for IPDB with a limit set to 100000 (one hundred thousand). Can you give me some general guidance on other blocks to allow for my server? it is a fairly large VPS with 8 GB of Ram.

Mailscanner and calmav are doing a decent job of blocking a recent wave of virus.
But is it possible to have the IP blacklisted in CSF once a vrus has been detected.
This might slow down sebsequent receipts for a short while.

I did see that i may have been possible many years ago, but don't see this feature today.

I am running a server to provide DNS to my public IP subnet. I want the server to be able to get NTP, OS updates, send email, etc, but only allow incoming tcp/udp/53 from my public subnet. My goal is to block all incoming requests and only allow DNS requests incoming from my subnet 1.2.3.0/24.

Since by default it blocks all and only allows ports I open, I believe it have the ports configured...

I have really weird issue i installed csf to a new server. when user run pm2 to run node app. it runs successfully as soon as the user logout of the cpanel the process disappear.

kindly note that this only happen with cpanel user if i run the command with the root and log out it will work fine

Hi, Is there a way to permanently set up an email to receive warnings about firewall attacks or problems that could endanger the system?
I'm new to ConfigServer firewall & security, so I need to share your experience.
Thanks!