ConfigServer Community Forum

Hello

I have a few rules under regex.custom.pm.

Some are very important and I want to receive mail notification and other not so much so no need of notification.

Is there any way I can disable mail notifications for specific rules and keep temp/perm block working as expected?

It would also be cool if we can filter notifications by country.

Thank you

It seems there is a bug with IPv6 support. I installed CSF on an AWS Lightsail instance and in order to automatically obtain a public IPv6 address, AWS requires support for RA/SLAAC. With CSF turned on, the instance receives an IPv6 address on boot but then once valid_lft reaches 0, it falls off the interface and can't be renewed.

I have set:
IPV6 = 1
IPV6_ICMP_STRICT = 0
IPV6_SPI = 1

Operating...

As indicated:

Is there any guidance or roadmap from CSF on --gulp-- firewalld, or other, as RHEL seems to indicate these may be dropped in the next version.

Thank you.

I have hourly Log Scanner Report enabled, however they are flooded with messages like this snippet:

Sep 28 11:52:53 REDACTED named : client @0x7f2130057918 45.148.10.248#6967 (ccb.gov): query (cache) 'ccb.gov/ANY/IN' denied
Sep 28 11:52:53 REDACTED named : client @0x7f2128012e68 45.148.10.248#11681 (ccb.gov): query (cache) 'ccb.gov/ANY/IN' denied
Sep 28 11:52:53 REDACTED named : client...

Hi, forgive me if this has already been asked and adequately answered, but I haven't found it so far:

I'm new to DirectAdmin and ConfigServer and trying to configure everything properly. I'm confused because the server security check keeps returning:

You should consider disabling commonly abused php functions, e.g.:
disable_functions = show_source, system, shell_exec, passthru, exec, popen,...

I've seen some posts about using BLOCK_REPORT to customize when an IP is blocked. I'm looking for something that will allow me to execute a custom script whenever CSF identifies accounts exceeding processes, mem, time limits. I want to be able to kill certain accounts (based on their web hosting plan) via a custom script that will allow me to do further reporting/stats at the same time.

Is there...

Hello people,

There are a lot of questions on this forum regarding this, and I have read most of them. As is usually the case, I am receiving a huge amount of notifications from CSF, from a cron.php that the user of this server has placed and wants to run every 5 minutes. This process is legit, and we want to keep it running. The output is this:

Executable:

/home/virtfs/...

Hello,

I'm looking for a way to add entries to the global Whitelist and Blacklist of the ConfigServer MailScanner Front-End via command line or API. Currently, the only available method is to manually add items through the cPanel interface, which is manageable when dealing with 2 or 3 servers. However, when the number of servers increases to, for example, 10 or more, this manual process becomes...

OS: CloudLinux release 9.4 (Vladimir Vasyutin)
CSF version: csf: v14.21 (cPanel)

Hi,

I'm facing a strange issue where CSF is not blocking nor allowing IPs in Almalinux/CL 9.
If I add a temporarly allow like this, it creates an IPTABLES entry and it doesn't work (port 22 is not in TCP_OUT):

# csf -ta 12.34.12.34
ACCEPT all opt -- in !lo out * 12.34.12.34 -> 0.0.0.0/0
ACCEPT all opt -- in * out...

Hello,
After upgrading from Ubuntu 22.04 to 24.04, and while CSF+ProFTP server was working fine, now it doesn't allow to retrieve directory listing.
Any suggestions ?

Hello ,
I created a custom modsec rule that returns a 403 status code if there is a sql injection attempt, i want csf to block the ip that is triggering this rule by monitoring the log that modsec is logging in it , but it isnt blocking it at all
the log came up as either
/usr/local/apache/error_log or
/var/log/apache2/error_log

so in csf.conf i specified the MODSEC_LOG to be...

It seems LFD outputs its blocked messages (eg. Firewall: *UDP_IN Blocked* IN=eth0... ) to the system journal with priority 4 (warning), even when it's just blocking incoming traffic based on port number. This makes them gold-coloured in my TTY, but more annoyingly it gets spammed out to my VPS's emergency console standard output, putting out lines every few seconds. Is there a way to get LFD to...

Hello,

I am getting weird block mails everyday from ldf.

The title of the email is:

lfd on : :: (Unknown) blocked permanently

And the content is:

Time: Wed Sep 11 06:44:40 2024 +0300
IP: :: (Unknown)
Temporary Blocks: 48

Temporary blocks that triggered the permanent block:
Tue Sep 10 07:14:01 2024 (CT) IP :: (Unknown) found to have 32 connections
Tue Sep 10 07:44:01 2024 (CT) IP ::...

Hello,

I get this email from my server:
Subject: Cron /usr/sbin/csf -u
Message: csf and lfd have been disabled, use 'csf -e' to enable

I logged in to WHM to enable again all connection become blocked, if I disable via SSH everything works fine.
I can't image what I have to do to work again, should I reinstall csf or how can I find the problem?
I did not changed anything for weeks, csf updated 5...

Hello Everyone :)

I hope you are well. I now manage numerous servers running WHM; and I have lately begun integrating config server security and firewall and login failure daemon to improve the security of these systems. While I have some familiarity with server management; I am new to the more advanced configurations and optimizations that CSF and LFD provide. I am seeking out this informed...

Hello dear community.
I wanted to ask if ConfigServer ModSecurity Control support LiteSpeed Web Server and Imunify360?

Hello,

After setup MESSENGERV3 when IP is blocked, return this error bellow on log, and show 404 page of Litespeed:

Failed to open : Permission denied

My csf.conf:

MESSENGERV3 = 1

MESSENGERV3LOCATION = /etc/apache2/conf.d/

MESSENGERV3RESTART = /scripts/restartsrv_httpd

MESSENGERV3TEST =

MESSENGERV3HTTPS_CONF = /usr/local/apache/conf/httpd.conf

MESSENGERV3WEBSERVER = apache...

In order to sort (some) compatibility with Docker and CSF we are working on an approach to allow docker to handle its iptables adding a chain on prerouting added in csfpost.sh

The problem is that for this to work we need to store all docker generated chains on each csf restart and reload them in csfpost.sh

For my surprise, csfpre.sh is not executed first on that process. CSF first clears all...

Hello everyone

Recently I'm receiving a lot of logs regarding spamd.
Do I need to worry about this?

Aug 21 05:57:24 cloud lfd : *User Processing* PID:270555 Kill:0 User:icaro Time:4337 EXE:/usr/local/cpanel/3rdparty/perl/536/bin/perl CMD:spamd child

Aug 21 06:01:24 cloud lfd : *Suspicious Process* PID:270556 PPID:269407 User:icaro Uptime:4577 secs...

Hello Guys,

I'm new to firewall/server configurations and I have a PCI scan result saying:

THREAT:
Your firewall policy seems to let TCP packets with a specific source port pass through.

IMPACT:
Some types of requests can pass through the firewall. The port number listed in the results section of this vulnerability report is the source
port that unauthorized users can use to bypass your...