ConfigServer Community Forum

When i enable IPSET give me this error.

csf: IPSET creating set chain_DENY
IPSET:
csf: IPSET creating set chain_6_DENY
IPSET:
csf: FASTSTART loading csf.deny (IPv4)
Error: FASTSTART: (csf.deny IPv4) [] . Try restarting csf with FASTSTART disabled, at line 5781

What modules i need? i run CSF test and not give me any error.

Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing...

I have PT_USERMEM set to zero but I still get the emails. How is this possible? So much so that the email address that it sends too is now blocked by outlook. So now I just get the email failed messages.

Yes I know I should either stop my scripts from doing it or buy another 100 CPUs but I just want to stop the crazy amount of emails I get.

Hello, Sarah.

On my server I have blocked some file extensions and .gz was one of them.

Unfortunately a few companies that send DMARC reports uses .gz files and are blocked by MailScanner.

Is there a way to create a kind of filetype.whitelist.rules and add in there the external domains?
Example:
From: noreply@dmarc.google.com no
From: noreply@dmarc.yahoo.com no

Or do you have anothter...

Hello,

I hope everyone is well.

I have a need to block countries, but allow dns querries into the server from everywhere, including those countries I've blocked.

What is the simplest solution with CSF for this?

Thanks in advance for any help.

no list of option. It only shows:

# csf -h
csf: v14.10 (cPanel)

That's normal?.

Btw, Is there some way to reinstall withtout loosing the configuration?

Hi all,

I am getting a lot of e-mails about suspicions process running. I did find many threads about it and all pretty much talk about how to silience those.
I want to fix (if possible) the underlying problem.

Those warnings are generally only specify user and PHP executable.

Network connectiosn I am getting are:
Network connections by the process (if any):

tcp: 127.0.0.1:41462 ->...

Hi,

My client is getting ban from CSF every time when he changes the ip. His ip is dynamic, I'm trying to whitelist him but once the ip is changing he is getting ban.

He is using Jazler to upload from radio the song titles in website using ftp connection.

How we can fix this issue to allow his ftp connection by hostname or by domain?

Thank you

Is there a way to blacklist an IP based on the repeated failures like the following logs?

I get these from journalctl not sure if they are also logged somewhere else.

Jun 01 23:13:07 myhost.goo.edu sshd : Unable to negotiate with 139.59.240.248 port 55732: no matching key exchange method found. Their offer:...

Is it possible to do advance filtering using the command line?

It seems like the only possible way is to write the directly to the rule file?

Hi guys.

For the last few weeks, every night around 10 PM I receive emails from my LFD:
Subject: lfd on XXX.XXX.COM: SYSLOG Check Failed
Time: Wed May 26 21:38:05 2021 -0400
Error: Failed to detect code in SYSLOG_LOG

SYSLOG may not be running correctly on XXX.XXX.XXX

Any ideas where I should start to look? I opened a ticket with cPANEL and they say that they use rsyslogd instead and that it...

Hello,

I'm using LF_DISTSMTP to help to detect compromised email accounts.

It works fine but I have a few email accounts for sending reports that have distributed logins.

Is it possible to LF_DISTSMTP ignore this specifics accounts? How can I do that?

Thank you

Hello,
When reviewing / checking the list of e-mails intercepted or not in mailcontrol , it happens to me to come across phishing mail which was not detected (not a problem of mailscanner FE).
But in these cases I would like to be able to easily notify the recipient who mistakenly received this unmarked spam / phishing email.
Currently there is in the detail view of the mailcontrol list the...

Here are the ^PT_ related settings:
# grep ^PT_ /etc/csf/csf.conf
PT_LIMIT = 60
PT_INTERVAL = 60
PT_SKIP_HTTP = 0
PT_ALL_USERS = 1
PT_DELETED = 1
PT_DELETED_ACTION =
PT_USERPROC = 10
PT_USERMEM = 1024
PT_USERRSS = 256
PT_USERTIME = 1800
PT_USERKILL = 1
PT_USERKILL_ALERT = 1
PT_USER_ACTION =
PT_LOAD = 30
PT_LOAD_AVG = 5
PT_LOAD_LEVEL = 6
PT_LOAD_SKIP = 3600
PT_APACHESTATUS =...

Good morning,

I've set weekly scan on my cPanel server with CXS. At this time, the log is stored at /var/log/cxsreports/cxs.scan . As I see, this file is erased after each new scan.

Is there a way to set a new logfile per scan (such as /var/log/cxsresports/cxs-20210517.scan ) ?

Thanks in advance.

It is possible to edit the file that sends the email to include other parameters such as:
Client IP
Page title
Because then I will know which client is doing something wrong in the system.

Original email I receive:

Time: Tue May 11 20:40:43 2021 -0300
Account: xxxxxx
Resource: Process Time
Exceeded: 1813 > 1800 (seconds)
Executable: /usr/local/bin/php-cgi
Command Line:...

I used to have this enabled and had made the necessary changes to the exim configuration to make it work. I have now disabled it in both CSF and exim configuration, and restarted both firewall and lfd, and exim. I have ports 465, 587 and 25 enabled and open for SMTP auth.

But I can't connect to the server from Apple Mail for SMTP. Apple reports: Unable to verify account name or password.

I...

Hello,

I see everyday similar action. How can I block with CSF firewall ? For example more than 50 packet per IP blocked. CT_LIMIT not help this problem.

From 205.209.159.201 - 1548 packets

Regards,

I get this alert every 5 minutes:

File: /tmp/systemd-private-c187857224034146b6d5778aa1a95646-ea-php73-php-fpm.service-Va0Oin/tmp/config.tmp.phlT82
Reason: Script, file extension
Owner: x:x (1009:1011)
Action: No action taken

What should I do about it?

Hello All,

I got all of the settings double checked to setup the CSF Cluster, I have all nodes sharing both send and receive and the firewalls are open on each, so when I cping test it comes back with pong, so communications is happening.

My test was to add an ip on a deny list and then check if that IP is on the deny list on all the servers in the cluster.
I added a comment as well, so I was...

Hello,

I have a 6 domain on me server. I need to block all icmp and ping one IP on my server. I tried this way.

icmp|in|d=ping|d=xxx.xxx.xxx.xxx

But not blocked ping, any idea ?

Regards,