ConfigServer Community Forum

Hi,
sorry for question i am not expert of csx.I have a lot of alert from csx from different account.
example:
Scanning web upload script file...
Time : Wed, 18 May 2022 12:48:55 +0200
Web referer URL : www.google.com
Local IP : 51.255.xx.xx
Web upload script user : nobody (99)
Web upload script owner: xxxx(1017)
Web upload script path : /home/xxxx/public_html/wp-admin/admin-ajax.php
Web upload...

Mailscanner and calmav are doing a decent job of blocking a recent wave of virus.
But is it possible to have the IP blacklisted in CSF once a vrus has been detected.
This might slow down sebsequent receipts for a short while.

I did see that i may have been possible many years ago, but don't see this feature today.

I am running a server to provide DNS to my public IP subnet. I want the server to be able to get NTP, OS updates, send email, etc, but only allow incoming tcp/udp/53 from my public subnet. My goal is to block all incoming requests and only allow DNS requests incoming from my subnet 1.2.3.0/24.

Since by default it blocks all and only allows ports I open, I believe it have the ports configured...

I have really weird issue i installed csf to a new server. when user run pm2 to run node app. it runs successfully as soon as the user logout of the cpanel the process disappear.

kindly note that this only happen with cpanel user if i run the command with the root and log out it will work fine

Hi, Is there a way to permanently set up an email to receive warnings about firewall attacks or problems that could endanger the system?
I'm new to ConfigServer firewall & security, so I need to share your experience.
Thanks!

Hi!,

I would like to open a port just for a user.

For example i have port 993 closed from outside to not permit users do access imap.

But i need to give permission to one user.

So, can i add this line to csf.allow to permit this?
tcp|in|s=993||u=1018

I already tried but doesn't work.

I there a way to do this?

Thanks

CC_ALLOW_FILTER not working.

# An alternative to CC_ALLOW is to only allow access from the following
# countries but still filter based on the port and packets rules. All other
# connections are dropped

OS: AlmaLinux 8.5 cPanel 102.0.14
also using it with Proxmox Virtual Environment 7.2.
Debian 11.3 Bullseye but using a newer Linux kernel 5.15.30,
QEMU 6.2, LXC 4

Both are using- CSF Version:...

Hello

I need to block all UPD traffic for one host on server. How can I do that ?

Regards

Reinstalled MSFE after server reload
However MSFE is showing blank screen
CPanel 102.0.12

Anything that needs to be adjusted?

Hi,

I've recently setup the emails for csf/lfd and I started getting tons of emails coming through, but most of them appear to be false positives.

I've added the following rules to csf.pignore but they don't appear to be working as the emails for the very same reasons are still coming through even after restarting both CSF and even the entire server....

Hello,

I have had some issues with a security research company binaryedge.io. From time to time they scan some of the web site on our servers without throttling activity or connections and my server loads spike, sometime well over 36 load for a an 8 core server.

I spoke to Linode abuse, since mane of the IP's were theirs. Linode say they are a 'Security Research' Company, so they are not...

Hi,

I have just installed CXS in my server

1) How do I check that CXS does not delete or blocks infected files from websites found in the daily/weekly scan? I want to be alerted by email but no that the files are deleted or quarantied

2) Can I perform a manually scan when I want for ALL the sites? The same questions biy apply the scan for ONE domain?

Thanks,
Francisco

When doing Learn as Spam & Report to learn and report multiple messages, I occasionally get this error on a few of the messages:
SpamCop report to vmx.spamcop.net failed: Net::SMTP error

How can I best debug this and investigate it further? Perhaps there is a more verbose logging option for the spamcop reporting portion that I can use?

I could not access my sites so I used a VPN to see what is wrong and I discovered that my own IP was listed as

temporary Blocks: IP:xxxxxxx Port: Dir:in TTL:3600 (lfd - *Port Scan* detected from xxxxxxx. 21 hits in the last 105 seconds)

Before that I tried 4-5 numbers in order access cpanel like domain.name:2083, 2082 etc

Hey,

Just wondering if anyone knows where csf downloads the geoip databases to when it refreshes? Or is it just loaded into a memory stream?

I would like to reference it for another purpose if possible.

Hello.

We're facing an issue ever since cPanel/WHM update from v100 to v102 where SpamAssassin keeps marking domains with a DMARC record with KAM_REJECT_DMARC on every single outgoing mail. Currently we've mitigated the worst with a temporary score setting. This has its own obvious drawbacks.
Has anyone faced this issue? What was your solution? Ideally we'd like to keep outgoing spam filter, but...

I keep receiving the following errors when trying to run CSF on my cPanel OpenVZ server.

# /etc/csf/csftest.pl
Testing ip_tables/iptable_filter...FAILED - Required for csf to function
Testing ipt_LOG...FAILED - Required for csf to function
Testing ipt_multiport/xt_multiport...FAILED - Required for csf to function
Testing ipt_REJECT...FAILED - Required for csf to function
Testing...

Hello.

I'm using cPanel & WHM v102.0.8 (STANDARD) and CSF Firewall v14.16.
Today I changed some settings: SMTP_ALLOWUSER (added another user) and also added some ports to TCP_OUT list. Then I restarted the firewall and tested the new rules. Everything worked fine.
Some minutes later, the connections stopped working. Reviewed the configuration again and found that the changes I made were lost....

Hello, I have some virtualized dedicated servers with Virtualizor with KVM , I have CSF installed and everything works fine... but every time I make a change and I have to restart the LFD and CSF the internet of the VPS KVM is blocked... I have to place the command:

/sbin/iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT

I would like to know if there is a way to make this command...

Hi.
On the Front-End Settings under Server Spam Whitelist, that I use a lot, I see that if I add a domain to the Server Spam Whitelist like this:
*@*.domaing.tld

it only allows the following:
anyword@word1.fixeddomain.tld

it doesn't allow any of the following:
anyword@fixeddomain.tld
anyword@word1.word2.fixeddomain.tld
anyword@word1.word2.word3.fixeddomain.tld

and in order to allow any of the...