ConfigServer Community Forum

Hi,

I am getting tons of email from csf lfd on server.xxxxxxxx.com: Suspicious process running under user xxxxxxx

Just want to know if this can be added in csf.pignore? Is it safe

Any help will be highly appreciated.

Time: Thu Jan 26 11:01:09 2023 +0530
PID: 5587 (Parent PID:4853)
Account: torqueparmap
Uptime: 135550 seconds

Executable:

/opt/cpanel/ea-php73/root/usr/bin/php-cgi

Command...

Having the instant IP block is an awesome feature and we use it frequently for repeat offenders. But these days so many spammers are sending from multiple IPs from a single CIDR 24 block. It would be so cool to have two options to click to block. One like the current single IP block, and a second one right next to it that blocks the entire range, ie NN.NN.NN.0/24. We do this manually at times but...

Hi there

A new server with Cloudlinux installed, Installed CFS, but all messages are logged to the console, making the console unusable.

I have no idea what setting needs to be done for this to stop. Any help is appreciated, as I am sure I am not the only one. This was presented before here: (but no fix was provided)

screen looks like this:

Instructions I think how to block tor in /etc/csf/csf.blocklists by uncommenting this line (remove the #):
#TOR|86400|0|
and in /etc/csf/csf.conf make sure URLGET is set to use LWP then restart the firewall

We leave the ip=1.2.3.4 and don't change it to our server ip address?

I've bunch of ips / networks added to csf.deny

csf.deny
1.1.0.0/19 # do not delete

However i want to allow 1.1.1.1 on port 80 and 443 with csf.allow

csf.allow
tcp|in|d=80|s=1.1.1.1
tcp|in|d=443|s=1.1.1.1

or

csf.allow
1.1.1.1

Allow rules above is not working.

- If i add IP adress to both csf.allow and csf.ignore it works but opens all ports which i don't want to
- Adding...

Does this error indicate a Zone file error? If so, what is the best way to correct it?
*ERROR* line:
Command:
Error:

This network is found in /var/lib/csf/Geo/ip2asn-combined.tsv & /var/lib/csf/zone/us.zone

Dear all,

I am using block_all_temp profile to temporarily block the IPs attempting a brute force attack. using this profile, it only allows me to block the IPs for 1 hour aftr this the IPs get unblocked. i want to customize this time to 5 min for example. so that, any IP trying brute force attack will be blocked for 5 minutes only. help will be grateful.

Hamza

Hi there,

With the High Load template for instance, there are set variables which don't seem to be documented.

This includes , , , , and however there doesn't seem to be a way to tweak them. For instance, we'd like to amend how ps is invoked (and likely include a 2nd copy of it, sorted differently), include iostat/sar reports and others.

How does one go about amending what the above variables...

Hello,

Having too many data in /etc/csf/csf.deny makes it impossible to edit the file in a web-interface of Directadmin.
It is a built-in limit in DirectAdmin when a loading variable 'POST' is limited to hard-coded 125749 bytes. Whenever a 'POST' request of a bigger size arrives it gets rejected by DirectAdmin and no changes are actually saved.

In Directadmin logs one can see a line of the...

Hi all,
I need help with Check Server Security configuration on cPanel VPS.
My VPS hosts mutliple Wordpress and various different Laravel CMS websites, along with some static content.

I need to know is it safe to do as Security says (disable) and will it impact my websites:
PHP Check
1. Check php for enable_dl or disabled dl()
2. Check php for disable_functions

Server Services Check
3....

I use Centos 7 and DirectAdmin have an issue with unblock adress IP. Validation recaptch works but adress IP still block.

In /home/csf/public_html/index.php file_put_contents doesn't work and unblock.txt and lfd_messenger.log don't create.
PHP Warning: file_put_contents(/home/csf/unblock.txt): failed to open stream: Permission denied in /home/csf/public_html/index.php on line 252PHP message:...

Hello, i want to know is this rule that i have wrote correct?
i mean that can we use source port and desteniation port after each other with same ip.
tcp|in|s=0_65535|s=x.x.x.x
tcp|in|d=(some specific ports)|s=x.x.x.x

Hi all,
I am rebuilding my infrastructure and those services facing the public, I am opting to use CSF instead of vanilla IPTables.

I am having a bit of an issue when CSF is active Bird2 is failing to work properly, I was wondering if anyone else has had this issue before and solved it.

The error I get is:
bird : ospf1: Socket error on enp6s0: Operation not permitted

Setup is Vultr VPS with...

Hi,

I've noticed that the cPanel disk usage emails sent to hosted clients were all marked as low spam.

The emails were sent from cpanel@local-domain-name with a client IP of 127.0.0.1 and tripped the KAM_MAILBOX2 rule with a score of 6.25.

The KAM_MAILBOX2 rule relates to Mailbox Quota Phishing Scams.

How do I stop internal cpanel emails from triggering this rule while keeping the score as...

Hi,

I'm regularly getting an email form cxs Scan saying it is scanning a file but then Clamd gives an error saying there's a File path check failure: No such file or directory. ERROR

cxswatch Scanning /home/username/public_html/wp-content/cache/db/singletables/c99:

then:

# Clamd Error for : /home/username/public_html/wp-content/cache/db/singletables/c99: File path check failure: No such...

My WHM server is nat with private ip in the 10.10.1.0/24 range. I am looking to block 2087 access over the internet

eth0 10.10.1.5 Main/shared IP for: admin and others x.x.x.x

In my csf.allow I have the following config tcp|in|d=2087|d=10.10.1.0/24
and in csf.deny I have the following config tcp|in|s=2087|s=0.0.0.0/0

However, I can access the WHM page over the internet, outside of my network....

Hi.
I have a list of 27 emails and using the option:
TO DOES CONTAIN email@address.com
shows that 12 of them contains the email address.

So, now I want to see the list of the ones that doesn't include that email address using:
TO DOES NOT CONTAIN email@address.com
and when I click VIEW EMAILS, it shows all the 27.

Just to give more information:
All the 27 emails contains about 12+ recipients....

Hello, I have been using Configserver on WHM/Cpanel on CentOS for years and recently moved to a new server with WHM/Cpanel on CentOS.

The file csf.conf keeps getting overwritten with what appears to be a default configuration. I make changes and safe via the UI in WHM/CPanel or I make changes via SSH and Emacs. Either way, after some time the file is replaced with a 'default' csf.conf that...

Hello everyone,

After googling for some time and not finding anything on this problem I'm asking here for some help.

I've setup remote logging for rsyslog on debian 11 and when CSF / LFD ist enabled, I get the following error for rsyslog:
(changed URL inside of the error message because of limitations)
Oct 30 16:54:08 SERVER85 rsyslogd : action 'action-0-builtin:omfwd' suspended (module...

I cannot reproduce this on any other servers, but am not sure where to go with this. LFD is detecting brute forces fine and logs that it is blocking the IP:

Oct 28 17:06:44 dalgarno lfd : (sshd) Failed SSH login from 112.95.75.195 (CN/China/-): 5 in the last 300 secs - *Blocked in csf*

However, the IP does not end up in IPTABLES nor does an entry get written to /etc/csf/csf.deny

I have...