ConfigServer Community Forum

I can't explain why this is happening, but in recent weeks CSF has begun blocking outbound traffic to specific update servers for cPanel services. At first I thought it was all related to a forced server host name change by GoDaddy, but on further review it seems to be something else. The timing of it all just made it all suspect though.

My general IP4 configs:
TCP_IN:...

Our O/S Commerce software sends an confirmation email to customers.
In the bottom of this email is a load of gibberish, which contains:
'MailScannerScript29528'

Any thoughts as to what this might be please ?

OS: AlmaLinux 8.6 / CloudLinux 8.6

Kernel: Linux cp10 4.18.0-372.19.1.lve.el8.x86_64 #1 SMP Tue Aug 9 15:56:43 EDT 2022 x86_64 x86_64 x86_64 GNU/Linux

Linux Virtual Machine running on Proxmox with KVM

System is to date

As soon as I enable CSF, I cannot connect to any website on port 80 or 443

Looking at the firewall logs, it seems port 80 gets redirected to 19080 and port 443 gets redirected...

hi,

i wish i could use the LF_NETBLOCK function of csf in directadmin. this function would allow me to have a list of really malicious ip while avoiding false positives. BFM works very well, but many users are blocked very often because they are unable to configure an email client. the function of CSF would help me to better manage the problem. afterwards, the generated list of csf.deny is sent...

For few days i have been receiving errors from users trying sending email to Gmail accounts that spf/dkim is not showing
than another domain that ptr is not working.
I have Assp Running so i tought that was the issue but after disabling ASSP Services the error Continued.

Than i Turn Off CSF and all emails started going trough so was happy but than 2 hrs later it started getting block again.......

Hello, we want exclude a spesific user or spesific process for mail notification with csf.pignore.

Mail Notifications:
1
Excessive resource usage: username

Time: Tue Jun 29 15:59:06 2021 +0300
Account: username
Resource: Process Time
Exceeded: 1818 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/php/73/sbin/php-fpm
Command Line: php-fpm: pool user_username
PID: 6898 (Parent...

How to create firewall group inside CSF and block all IP's using shodan.io?
An example:

The include option in /etc/csf/csf.allow no longer loads the rules

Hello,
Sarah.
Would you please take in consideration to add in MailControl Statistics the Top 10 Email Subjects?
That will really help to create SpamAssassin rules to block the ones that are not being blocked by MailScanner.

Regards,
Sergio

Hi,

i install cxs but error.
ERROR: Unsupported OS:

how to success installer ?

csf: v14.17
MESSENGER config by default with MESSENGER v2 enabled

I'm receiving these mail alerts from the Messenger recaptcha:

Subject: lfd on server.domain.com: recaptcha ?ôЄÿê/¶7Ô³Æ >ßv¬£þlÄ ¡ƒÃƒà¤õ-qJ7L-°¤Úwyµ#w@/V{Õ[7ÀTÀKÕˆ=RN”¯c?‘æø˝5Ô¬Œ•šñ+é>þGãïo&ŽÌÒoskäÊcìƒÙnePü[|š§AñÂDõ¯|¤ð¸£ãº7 (Unknown)

Time: Mon Aug 21 11:50:34 2022 +0200
IP: ?ôЄÿê/¶7Ô³Æ >ßv¬£þlÄ...

Hello,
Sarah.

There are times that the emails received are not blocked by MailScanner and that are a security risk because of the attachment it contains.

It will be really nice to have a button Delete (Direct) that could delete those emails directly on the inbox of an account, similar to the Release (Direct) .

Would you, please, consider to add this in MailControl in a near future?

Sergio

I’ve a running CSF installation with messenger service on CloudLinux 8, I’ve migrated it from iptables to ipset to use blocklists, works wonderfully. But now I have a problem which I cannot solve: if I use the variable CC_MESSENGER_ALLOW and enter any country code or more then I can no longer reach the messenger (v3) page from a blocked IP. I have made sure that CSF recognizes my country...

I am getting these lfd emails constantly lately. Can anyone tell me what I need to do to fix this please?

Time: Mon Aug 15 08:00:23 2022 -0400
Error: Failed to detect code in SYSLOG_LOG

Emails are the same except the code is different each time.

Gunstra

Hello,
it is shared hosting and there is strong problem regarding csf, someone is temporary allowing ips without root access and in csf comment, it is showing manually added but I did not.
how is possible without access? and how to solve the issue?

Since some time DirectAdmin (custombuild?) Apache config password protects the URL.

The username and password are re-configured every time build rewrite_confs is run.

The current values are printed (in plain text) at the bottom of /etc/httpd/conf/extra/httpd-info.conf. Eg.

#Authenticate using:
#Username: USERNAME_STRING
#Password: PASSWORD_STRING

The LDF load check calls the URL above but...

Hello,

When viewing the CSF firewall in cpanel WHM there is a CSS style error noticeable at the top of the Juniper theme page for the Search field.

Console shows error:
Source map error: Error: request failed with status 404
Resource URL:
Source Map URL: bootstrap.min.css.map

If I fix this on my end will updates overwrite my fix?

I was wondering if there are any pre-existing hooks/script support for the moment CSF downloads and pulls the geolocation database download? Or would it work to just monitor /var/lib/csf/Geo for file changes?

ls -lAhrt /var/lib/csf/Geo/
total 51M
-rw------- 1 root root 116 May 30 2021 README.txt
-rw-rw-r-- 1 root root 14M May 16 08:00 GeoLite2-Country-Blocks-IPv4.csv
-rw-rw-r-- 1 root root 398...

Hi,

I would like to configure CSF to not block IP-s form some countries in csf.deny ( permanent block ) but still implement the firewall rules for closed ports and other configuration. Temporally block should also work normally.

I know of CC_Allow option but when i add county in that list it ignore ALL firewall rules and i`m looking for solution just not adding the IPs in csf.deny .

Any...

Hey Folks,

I am facing an issue with lfd, ever time i try to terminate an account or modify an account this command is coming of lfd - scanning log files

it also runs at the end of each month, it like it is waiting something that make the CPU spike higher, when every cpu spikes this command runs.

LOGSCANNER = Off
LOGSCANNER_INTERVAL = manual
LOGSCANNER_STYLE = 1
LOGSCANNER_LINES = 5000...