ConfigServer Community Forum

Messages missing in Quarantine after upgrade to 9.12

When examining messages in MailScanner Front End, the ability to see the contents of the message is missing, replaced with this remark:
Message not found in quarantine

Hi,

seems that the bug reported in this previous topic is happening again.

On several of our servers it was not working until we did apply the same fix.

I'm using a file with IP addresses and ranges as a permanent block list. When I search for an abusive IP address (5.188.62.76) in CSF I see that it's blocked by 5.188.62.0/24 resulting in the following output:
Table Chain num pkts bytes target prot opt in out source destination

filter DENYIN 37291 0 0 DROP all -- !lo * 5.188.62.0/24 0.0.0.0/0

filter DENYOUT 37291 0 0 LOGDROPOUT all -- * !lo...

Hello

the LFD keeps failing and recovered every fed minutes

The service “lfd” appears to be down.
The system’s command to check or to restart this service failed.

i have tried to investigate the issue by

# service lfd status
Redirecting to /bin/systemctl status lfd.service
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled;...

How are the IP's/ranges loaded into Ipset? Are they simply added to the csf.deny and csf processes them into Ipset or other method? Is there a way to easily bulk add deny IP's?

I have an existing ipset how do I add that to the deny?

All I've seen essentially is make sure it's installed and change the conf to 1.

Thanks!

Hello.

I hope everyone is safe and healthy.

The most recent update (Oct. 4, 2021) of ConfigServer wiped out all my previous settings. Does it make a backup somewhere?

Thank you.

Good morning!
I am new to csf so sorry if this a repeat thread. How do I use the csf firewall app in WHM to white list IP address ranges? The documentation I have read is not very clear.

Thanks in advance.

Eric

helo
lets say our server has 2 ip A and B.
but i only want to block ip A to access country CN.
how do we achieve that?

cc_deny , yes we can use that but for ip source A and B.. how do we only apply ip A?

Hi

I am actually satisfied with ConfigServer MailScanner Front-End. We get a lot of Phishing emails these days. i searched for what i can do better, and I came across here.

Phishing Updates
These scripts will allow you to update your MailScanner Phishing safe and bad sites. The data files are updated four times per day. To use this service simply replace the respective cron files. These files...

I've got a user that keeps getting blocked for a custom LFD rule to block 3 consecutive Worpress failed logins within 3600 seconds. But they swear they are not getting failed logins. The rule is the widely published rule:

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] POST \/wp-login\.php.* 200/)) {
return ( Failed WordPress login from ,$1, wordpress , 5 , 80,443 , 3600 );
}...

Genuine transaction or website access or wordpress-admin updates are blocking csf with the following reason.

Temporary Blocks: IP:157.33.50.133 Port:80 Dir:inout TTL:518400 (Blocked port 80 with Directadmin Brute Force Manager)

How to prevent this or how to prevent the genuine traffics.?? its happening for all.

Sorry if this is a dumb question, but what's the difference between the DYNDNS_IGNORE and GLOBAL_DYNDNS_IGNORE settings in csf.conf?

Login page can't login with reverse proxy.
After that, I modify source code to add remote ip address as a ip address instead of localhost ip address, it work but only in firefox, and after login it still in login screen although i press F5 button. Only when i press Ctrl+Shift+R it will redirect to admin page but when i click a function it redirect to login page, only when i press Ctrl+Shift+R it...

My website suffer from bad bots and Invalid Traffic bots can i configure csf to stop that

I would like to know if is possible to remove the emails I would select when using the Bulk Actions on the Menu.

when I click on the MailControl option and open all the emails logs, sometimes it goes up to a large amount of the emails and the pagination goes to a lot of pages.. As I really enjoy the option to disable the No Pagination (Danger) as it would list all emails on the same page, I...

Can someone help me?
I can't login to csf admin page when i setup it to a external app proxy in openlitespeed. When i login, alway return to login page, in debug mode, log print request data is null in spite of request data in my browser is correct csflogin and csfpassword. In direct access to csf admin page, login is normal.
So sorry for my bad English. Thank for all.

Hi,
I have blocked an ip xx.xx.65.81 but i can still see ddos attack from that ip.
csf -l shows that DROP rules have been added as shown below:

200 2 1450 DROP all -- !lo * xx.xx.65.81 0.0.0.0/0
200 4 1840 LOGDROPOUT all -- * !lo 0.0.0.0/0 xx.xx.65.81

The IP is present in the /etc/csf/csf.deny file. lfd and csf both services are running.
csf version is v14.10

Is there anything else i can...

Hi, would love to see integration with crowdsec

It would make CSF SUPER powerful and leverage the crowd

Hi there,

Just wondering if anyone's run into this, I can't find anything directly relevant in the search at least.

We use the SMTP_BLOCK option by default with our whm server and allow exceptions for some users. We had quite a few users listed under SMTP_ALLOWUSER and I thought it may be easier to set up groups and simply put the groups in SMTP_ALLOWGROUP instead of having a disorganized...

Hello there!

I'm newer here, but I have used CSF for a while, and recently we are having problems with spam.

I get the authrelay notification from other countries and when I change the passwords of the compromised account the problem stops, but I would like to stop this definitely, so I tried to fix it by using this configuration:

cc_deny_ports = RU,CN,KR
cc_deny_ports_tcp = 587,25,465...