ConfigServer Community Forum

Hi guys,
If I have a user getting blocked with an ip address say 203.57.138.20 (Not real IP address)
I now want to find in the logs why he was blocked. This IP address is currently unblocked so looking at csf.deny does not help

Kind Regards

Steve

Good morning,

I've set weekly scan on my cPanel server with CXS. At this time, the log is stored at /var/log/cxsreports/cxs.scan . As I see, this file is erased after each new scan.

Is there a way to set a new logfile per scan (such as /var/log/cxsresports/cxs-20210517.scan ) ?

Thanks in advance.

Hi,

I have set LF_PERMBLOCK_ALERT = 0 and restarted CSF through WHM but I am still receiving email alerts on Excessive resource usage. Are there any other configurations that I have missed out?

Remote Machine OS: CentOS-7-x64

Firewall GUI: CSF+LFD

Issue: Granting access to specific Ports by selective IP's and CIDR range to Remote Machine CentOS-7-x64 does not works, as no access to that specific IP's granted?

Hiya,

I'm trying to Grant Access to specific ports on my Remote Server CentOS-7-x64 by specific IP and CIDR range but it's not functioning. I added lines to:...

It is possible to edit the file that sends the email to include other parameters such as:
Client IP
Page title
Because then I will know which client is doing something wrong in the system.

Original email I receive:

Time: Tue May 11 20:40:43 2021 -0300
Account: xxxxxx
Resource: Process Time
Exceeded: 1813 > 1800 (seconds)
Executable: /usr/local/bin/php-cgi
Command Line:...

I used to have this enabled and had made the necessary changes to the exim configuration to make it work. I have now disabled it in both CSF and exim configuration, and restarted both firewall and lfd, and exim. I have ports 465, 587 and 25 enabled and open for SMTP auth.

But I can't connect to the server from Apple Mail for SMTP. Apple reports: Unable to verify account name or password.

I...

Hello,

I would like to know if it is possible to use different users without having whm installed on my server, on this server I have a different application but I want to create users that can only unblock IP's.

Thanks.

Hello,

I see everyday similar action. How can I block with CSF firewall ? For example more than 50 packet per IP blocked. CT_LIMIT not help this problem.

From 205.209.159.201 - 1548 packets

Regards,

Hi guys,

I'm running Postfix on a generic Centos 8 server and I'm trying to lock it down with CSF. I've done a fresh install, reviewed the conf, set testing = 0 and restarted the service.

The postfix maillog (/var/log/maillog) is showing a lot of SASL authentication failures like this:

May 5 09:21:38 myserver postfix/smtps/smtpd : connect from unknown
May 5 09:21:39 myserver...

Hello,

This is only few lines. We have a maybe tousend of line. And CSF didn't stop this. Which config missing our CSF ?

Regards,

139.880043136 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.882366931 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.884717429 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.887074679 43.239.141.121...

I get this alert every 5 minutes:

File: /tmp/systemd-private-c187857224034146b6d5778aa1a95646-ea-php73-php-fpm.service-Va0Oin/tmp/config.tmp.phlT82
Reason: Script, file extension
Owner: x:x (1009:1011)
Action: No action taken

What should I do about it?

Hello All,

I got all of the settings double checked to setup the CSF Cluster, I have all nodes sharing both send and receive and the firewalls are open on each, so when I cping test it comes back with pong, so communications is happening.

My test was to add an ip on a deny list and then check if that IP is on the deny list on all the servers in the cluster.
I added a comment as well, so I was...

Hello,

I have a 6 domain on me server. I need to block all icmp and ping one IP on my server. I tried this way.

icmp|in|d=ping|d=xxx.xxx.xxx.xxx

But not blocked ping, any idea ?

Regards,

Hello,

Everyday I can see a lot of bad IP in logwatch list like that. How can I block that IP automaticly ?

From 139.162.225.221 - 1256 packets
To xxx.xxx.xxx.xxx - 126 packets
Service: echo (tcp/7) (Firewall: *TCP_IN Blocked*) - 1 packet
Service: echo (udp/7) (Firewall: *UDP_IN Blocked*) - 1 packet
Service: discard (tcp/9) (Firewall: *TCP_IN Blocked*) - 1 packet
Service: discard (udp/9)...

Hi,

Currently the ModSecurity Log page doesn't update automatically, it would be nice to have a way to auto refresh the page just like the Watch Logs feature within ConfigServer Security & Firewall.

The next improvement that would make a huge difference is simply adding a column for Status to tell us if it's a 200, 403... etc. The same way how cPanel's Mod Security Hits list has the column...

Hello. It can be done to configure Mailscanner to send email to server administrator of the Other Bad Content Detected emails but configure it to each domain?. Thanks.

Kind regards.

Hello,

I've been receiving the following nightly errors.

ERROR: getpatch: Can't download daily-26096.cdiff from database.clamav.net
ERROR: Can't download daily.cvd from database.clamav.net

Any guidance would be greatly appreciated.

Thank you,
Tim

Hi,

I tried first installing CSF from the guideline provided on your website: but this created a huge problem for us. Our server was filled up with 60k+ processes like this:

root 2398 0.0 0.0 124500 1620 ? Ss Apr27 0:01 /usr/sbin/crond -n
root 13451 0.0 0.0 222996 3648 ? S 00:00 0:00 \_ /usr/sbin/CROND -n
root 13468 0.0 0.0 113280 1200 ? Ss 00:00 0:00 | \_ /bin/sh -c /usr/sbin/csf --lfd...

Hello,

For some reason i’m getting the digest email twice each time it runs (to the same email address0. Where can i check to see how/why this happens and correct it.

Thanks in advance.

hello -

i am having trouble being able to UNblock by a specific port, in this case, 3306.

in my csf.allow file, when i have just the following:

123.123.123.123

i can certainly access port 3306 as expected.

HOWEVER when i only have the following: ( i included ALL i could think of just to see if that helped)

tcp|in|d=3306|s=123.123.123.123
tcp|out|d=3306|s=123.123.123.123...