ConfigServer Community Forum

Hi, I'm looking at logs and finding that src ip's are looking for trouble, but they are spreading their attack times to a couple of tries over a spread of minutes. Cannot find a way in csf config to set a ban for this. Here is a sample of the syslog to show what I'm seeing (pruned the log down for viewing):

15: 17:26 xx krnl: Firewall: *TCP_IN Blocked* IN=eth0MAC=zz:zz SRC=m:m DST=x:x PROTO=TCP...

Hello ,

This is my first time here , i had joined today to discuss about many email alerts i am receiving since a week or so .

There is 3 types of emails :

1- It is titled by : lfd on *server name* : Suspicious File Alert‏
and contains :

File: /tmp/systemd-private-be537481d81d48b4b230533e9c529e32-ea-php81-php-fpm.service-teQo08/tmp/python3.61
Reason: Linux Binary
Owner: *website-username*...

hi,
i've a cpanel server with regex.custom.pm, but getting ignored and no block

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /^(\S+).* HTTP\/.* 403/)) {
return ( 403 bruteforce ,$1, block , 2 , 80,443 , 604800 );
}

CUSTOM1_LOG is
CUSTOM1_LOG = /var/log/apache2/domlogs/*/*
Access log with 403

1.1.1.1 - - HEAD /?play=ulti700?page=1&mqwsaWOeAy&cLLFTOZk59 HTTP/2 403 0 - Mozilla/4.0...

Sarah,
I have this scenario, one customer has a scanner that sends an email from one defined account but the file format that the scanner uses is RAR.
On my server I block RAR files to any one, but on this particular case FAX can't send in another format and I need to allow this email address to deliver such files.

How may I can add the FAX email address to allow to send RAR attachments but not...

csf install on Webmin OS

| SYSTEM INFORMATION||
|------------------------------|-------------------------------|
|OS type and version|AlmaLinux 9.5|
|---|---|
|Webmin version|2.202|

I will likely post this also at the Webmin forums, but just in case it's relevant here, I saw a number of errors and if CSF supply the Webmin install template, a small layout issue after following the...

Hi, I some time receive High load average alerts from lfd. When I open the attachments ps.txt or other ones, looks like it is not a proper text file and everything looks gibberish. I checked the file type and it's detected as file type data application/octet-stream. I also reinstalled csf but that didn't fix my issue. here is what vmstat file looks like in gmail and in text editor....

In searching here I was unable to see whether CSF is compatible with nftables. I only found info on iptables-nft.

My application is cPanel servers running Almalinux, on which firewalld is installed and running on nftables. My question is simply will CSF drop in to that system and run fine? (I would assume yes, that nftables is fully supported, and that no tweaks are needed. But I didn't find the...

Hi,
LF_APACHE_404 not working on cPanel with litespeed.
HTACCESS_LOG is setup with /var/log/apache2/error_log but not working
I've inserted custom regex but no work.

Can you help me to build custom 404 regex on cPanel litespeed?

I have an issue because every day I receive from lfd information about overload my server and logs shows me many connections from Microsoft adress IP. Manual block IP isn’t good because every day is another IP. In Csf I have set two parameters: CONNLIMIT 80;50,443;50 i PORTFLOOD 80;tcp;100;60,443;tcp;100;6 but it doesn’t work. Could you give me any suggest how to resolve this an issue?

I apologize if this is in the wrong area.

On ModSecurity I switched the ruleset from Comodo to OWASP, and now LFD isn't sending the Mod Security notifications to email.

LFD is sending out emails for other notifications.
Have restarted CSF & LFD, and ran csf -ra

Any suggestions are welcome on what to look at.

Thanks

Hi there,

would be very nice if LFD could ignore the files updated by (unattended) APT updates. It would make sense if LDF could ignore these files. When doing manual APT updates it's still ok if you get an LFD email about the system integrity but especially with the unattended updates it's sometimes quite scary getting a LFD email about your system integrity.

Any help to achieve this is...

I'm getting a version check that's telling me the versions of the RSForms mod_rsform and mod_rsform_list are old. It seems to be looking for version at least 3.3.3, but the current version of the module is 3.1.0, according to the RS Joomla site:

RSForm! Pro Module 3.1.0
With this module you can publish your form into a module (template position).

Same thing for the mod_rsforms_list module:...

Hello,

Due to some requirements, I can't use PT_USERKILL to kill process over PT_USERTIME / PT_USERMEM, I need to use custom script in PT_USER_ACTION to perform advanced checks.

However, I've seen that since I switched PT_USERKILL to 0, I keep receiving Excessive resource usage emails, no matter if PT_USERKILL_ALERT is set to 0 or 1.

How can I disable the Excessive resource usage email without...

Hello to CSF Community,

After migration to AlmaLinux 9 from CentOS 7 I suddenly met the problem with loading files by ftp (example from shell)
curl -u user:password ' -o /var/www/html/df/file1.zip
Result
curl: (7) Failed to connect to example.com port 21: Connection refused

When I stop only CSF service (lfd and iptables leave running as i s) - everything is OK, file will be downloaded by...

Hello

I have a few rules under regex.custom.pm.

Some are very important and I want to receive mail notification and other not so much so no need of notification.

Is there any way I can disable mail notifications for specific rules and keep temp/perm block working as expected?

It would also be cool if we can filter notifications by country.

Thank you

It seems there is a bug with IPv6 support. I installed CSF on an AWS Lightsail instance and in order to automatically obtain a public IPv6 address, AWS requires support for RA/SLAAC. With CSF turned on, the instance receives an IPv6 address on boot but then once valid_lft reaches 0, it falls off the interface and can't be renewed.

I have set:
IPV6 = 1
IPV6_ICMP_STRICT = 0
IPV6_SPI = 1

Operating...

As indicated:

Is there any guidance or roadmap from CSF on --gulp-- firewalld, or other, as RHEL seems to indicate these may be dropped in the next version.

Thank you.

Hi, forgive me if this has already been asked and adequately answered, but I haven't found it so far:

I'm new to DirectAdmin and ConfigServer and trying to configure everything properly. I'm confused because the server security check keeps returning:

You should consider disabling commonly abused php functions, e.g.:
disable_functions = show_source, system, shell_exec, passthru, exec, popen,...

I've seen some posts about using BLOCK_REPORT to customize when an IP is blocked. I'm looking for something that will allow me to execute a custom script whenever CSF identifies accounts exceeding processes, mem, time limits. I want to be able to kill certain accounts (based on their web hosting plan) via a custom script that will allow me to do further reporting/stats at the same time.

Is there...

Hello people,

There are a lot of questions on this forum regarding this, and I have read most of them. As is usually the case, I am receiving a huge amount of notifications from CSF, from a cron.php that the user of this server has placed and wants to run every 5 minutes. This process is legit, and we want to keep it running. The output is this:

Executable:

/home/virtfs/...