ConfigServer Community Forum

Good Morning,

We're running Interworx servers with qmail and have noticed that submission-logins aren't being blocked. Below is what the log entries look like in dovecot.log

Sep 15 11:01:23 submission-login: Info: Remote closed connection (auth failed, 1 attempts in 3 secs): user=, method=LOGIN, rip=, lip=, TLS, session=

We can sometimes see a few hundred attempts an hour from a single IP. Is...

My website suffer from bad bots and Invalid Traffic bots can i configure csf to stop that

I would like to know if is possible to remove the emails I would select when using the Bulk Actions on the Menu.

when I click on the MailControl option and open all the emails logs, sometimes it goes up to a large amount of the emails and the pagination goes to a lot of pages.. As I really enjoy the option to disable the No Pagination (Danger) as it would list all emails on the same page, I...

Can someone help me?
I can't login to csf admin page when i setup it to a external app proxy in openlitespeed. When i login, alway return to login page, in debug mode, log print request data is null in spite of request data in my browser is correct csflogin and csfpassword. In direct access to csf admin page, login is normal.
So sorry for my bad English. Thank for all.

Hi,
I have blocked an ip xx.xx.65.81 but i can still see ddos attack from that ip.
csf -l shows that DROP rules have been added as shown below:

200 2 1450 DROP all -- !lo * xx.xx.65.81 0.0.0.0/0
200 4 1840 LOGDROPOUT all -- * !lo 0.0.0.0/0 xx.xx.65.81

The IP is present in the /etc/csf/csf.deny file. lfd and csf both services are running.
csf version is v14.10

Is there anything else i can...

Hi, would love to see integration with crowdsec

It would make CSF SUPER powerful and leverage the crowd

Hi there,

Just wondering if anyone's run into this, I can't find anything directly relevant in the search at least.

We use the SMTP_BLOCK option by default with our whm server and allow exceptions for some users. We had quite a few users listed under SMTP_ALLOWUSER and I thought it may be easier to set up groups and simply put the groups in SMTP_ALLOWGROUP instead of having a disorganized...

Hello there!

I'm newer here, but I have used CSF for a while, and recently we are having problems with spam.

I get the authrelay notification from other countries and when I change the passwords of the compromised account the problem stops, but I would like to stop this definitely, so I tried to fix it by using this configuration:

cc_deny_ports = RU,CN,KR
cc_deny_ports_tcp = 587,25,465...

Hi,

I have been trying to configure CSF and Docker under a Plesk server. There are many posts in forums reporting that when Docker creates a NAT redirect to certain port, that port is exposed to the entire world.

I tried to use this csfpost tool but apparently It hasn´t worked.

In some way, installing netfilters tool for saving iptables rules I have managed to store a set of iptables rules...

Hello.
CSF plugin is installed on the Directadmin control panel.
Recently, possibly after updating the CSF, when performing a backup from the panel via FTP, we found that connections were blocked on the allowed port.
Configuration:
TCP_IN 20,21,22,25,53,80,110,143,443,465,587,993,995,2222,35000: 35999
TCP_OUT = 20,21,22,25,53,80,110,113,443,587,993,995,3306,2222,43,35000: 35999
With these ports...

Hi,

My ConfigServer MailScanner Front-End works great but it labels several internal emails as {spam?}, {disarmed}, etc.

By internal I mean from someone@thisdomain.com to someoneelse@thisdomain.com

Is there any possibility to stop the tagging for only the intenal emails?

Thank you!

Hi,

***THIS IS NOT A PROBLEM BUT A SOLUTION***

I followed:

Editting: /usr/mailscanner/etc/filename.rules.conf and (in my case) commented:

#deny \.cer$ Dangerous Security Certificate (according to Microsoft) Dangerous$

And added just after # These are very dangerous and have been used to hide viruses

#NubeNinja
allow \.cer$ - -
allow \.key$ - -
allow \.req - -

And worked as a charm if the...

I have a mail server that configured with mailscanner and spamaassassin. Lately, I have received a kind of bot attack of email which the sender send an email to multiple recipient( >100) in a short time.

One of my rule in spamassassin is to detect any sender in which is sending to more then 20 person as high scoring spam value.
However, since the attack is a private 1 to 1 mail, my rule cant hit...

Hi! I have a VPS running Virtualmin/Webmin and have CSF installed and mostly tweaked to ignore most of the false positive type of processes. A few weeks back - prior to installing CSF, I had someone exploit one of my wordpress sites and they managed to lay waste to several of my sub servers. Over the weeks - I have wiped most traces that I could find (without standing up a brand new server) and I...

We migrated clients to a new server using the WHM wizard. Should the standard migration wizard copy the modsec rule files created by CMC or is there something we should manually do?

The two user files I'm referring to:
/etc/apache2/conf.d/userdata/std/2_4/ /modsec.conf
/etc/apache2/conf.d/userdata/ssl/2_4/ /modsec.conf

On one server, that has been running fine for a couple of years, I notice now that /etc/csf/csf.deny is empty of all IP listings, though it shows the initial remarked text.

I still receive email LFD notices saying there has been permanent bans of IP addresses, and the latest timestamp of the file was the same as the time of the last LFD email.

Please advise.

When CF_ENABLED is set to 1, Is there a log of CSF's interactions with CloudFlare?

I have mod_remote IP setup and working, mod_security is setup and working, and in the LFD log I can trigger the mod_security rules and see a block come up (I am testing via TOR):

Jul 16 23:01:42 myserver lfd : (mod_security) mod_security (id:210860) triggered by 162.247.74.216 (US/United...

Hi,

I have set rules in max.message.size.rules. I test send mail with message size bigger than max.message.size.rules. My test mail did not get reject or send, the status in delivery report only show in progress.

How to reject email that violate max.message.size.rules and return bouncing mail?

Thank You

i have problem with *MESSENGERV3* Error: The home directory for csf does not exist
I was useradd csf -s /bin/false and then check lfd.log

Jul 10 23:39:32 lfd : Messenger HTTPS Service starting...
Jul 10 23:39:32 lfd : Messenger HTML Service starting...
Jul 10 23:39:32 lfd : *MESSENGERV3* Error: The home directory for csf does not exist
Jul 10 23:39:32 lfd : Messenger TEXT Service starting......

Hello,

I have a problem with my AWS EC2 VPS.
I have AlmaLinux 8.4 with WHM/cPanel and everything is running very well so far.
But as soon as I enable CSF, my server IPv6 is blocked and my server has no IPv6 anymore.
When I disable it, everything works again.
In CSF I have IPv6 enabled.
Does anyone have any idea what this could be?

I have added a few screenshots