ConfigServer Community Forum

Hello
As a server admin I would find it usefull if it was possible to interact with the MailScanner interface via an API, or via CLI commands, so some things could be scripted or integrated with existing custum user interfaces.
Thanks
Best regards,
Yves

Hello
WireGuard and Tailscale becomes used alot.
If I make no mistake anabliing it needs setting up things outside of the CSF UI or standard cfs.conf
Suggestion : integration as a checkbox option in the UI or config
Thanks
Best regards,
Yves

Would it be possible to have the From: (Header) added to the options of where to search in MailScanner FE? The number of messages that take forever to find because MSFE does not look at the From Header field is very frustrating.

In my testing I wasn't able to get the LF_BIND login failure trigger to work. After checking some Centos7 and Centos 8 servers it looks like the BIND trigger in RegexMain.pm doesn't account for the hex value e.g. (@0x7f18041004f0) that is logged in Bind 9+ servers.

Broken (Currently used):

Fixed (I just added the (?: \S+)? to add a non-capturing group that is optional):

I hope this helps!

A user submitting the wrong login details to the mail service or htaccess login can easily result in their IP address being added to the CXS reputation list. Their access to the server will be blocked, and access to other servers using CXS reputation list.

When a user reports the problem, the first thing we do is search for & remove the IP address in CSF (as I presume most server admins will...

Hey, i´m stuck.

Mailscanner is breaking my DKIM check, mailscanner disable all good. I dont know why but mailscanne ris always adding a = at the End of my text, but only on the plain text part of the email.

here is the part of the email on my outgoing mail:
Content-Type: text/plain; format=flowed; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Test3

And thats the part on the...

I have the LF_PERMBLOCK_ALERT set to OFF and have saved and reloaded CSF. Still, even after turning it off I am getting dozens of PERMBLOCK alerts in my inbox every day like the one pasted below. Am I missing some other setting that I have to change to stop CSF from sending me all of these?

Time: Thu Apr 1 02:45:29 2021 -0400
IP: 186.206.129.189 (BR/Brazil/bace81bd.virtua.com.br)
Failures: 5...

We have been using CSF on cPanel quite successfully for years and over the last couple of years, we have started using them on Virtualmin/Webmin servers as well. The difference we see is that while CSF is very well optimized for cPanel with lot of additional custom configuration like monitoring unwanted scripts, monitoring exim login attempts and blocking them if necessary, monitoring service...

Hello,

my /usr/local/cpanel/logs/login_log is full of failed whm login attempts from ip addresses in verry strange countrys but it looks like the attackers know the defending mechanism against this type of attack because they stop after two failed attempts and a few hours hours later they try again.

I know this would be a working as designed status as my LF_CPANEL is set to 5 so it only...

Is the intended behavior that csf /lfd will only email upon the first WHM root access from the same IP within so many hours?

I'm trying to figure out why lfd only sent one email WHM/Cpanel root access alert when I logged in and out and then in again a few times to WHM. The cpanel login_log shows all three WHM logins, but lfd only emailed once and only logged the first whm login to...

Hello, i facing a little issue, everything work fine.
but when I run a Test on the iptables i get missing modules:

Testing iptables...

Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing ipt_recent...OK
Testing xt_connlimit...OK
Testing...

whoops... silly error. I was placing my ignore commands under IP Blocking rather than process blocking ... completely missed the drop-down list of ignore options.

Hello

I would like to activate the access limit for each IP, for example, to allow 5 requests per second for one IP

how can I do that ?

Inquiry

Is CSF useful in protecting against Layer 3 and 4 attacks?

Hello!
Help me please to get rid of hundreds firewall messages in bash, like this:

New messages appears every few seconds, so in a minute screen is full of them. It's hard to type any command in bash.
Is it possible to redirect output of this messages to some log file instead?

Thank you!

How an I increase the RSS Memory size? Running on WHM/cpanel

Time: Wed Mar 10 07:12:25 2021 -0500
Account: xx
Resource: RSS Memory Size
Exceeded: 501 > 256 (MB)
Executable: /opt/cpanel/ea-php73/root/usr/bin/php-cgi
Command Line: /opt/cpanel/ea-php73/root/usr/bin/php-cgi /home/xx/public_html/wp-cron.php
PID: 5945 (Parent PID:30682)
Killed: No

Hi there. Lately I was getting a lot of errors like
*Error* pid mismatch or missing, at line 1160
daemon stopped
This error is caused by trying to block some IP address, which triggered csf of lfd rule few times in a row. After that csf is disabled, but it was reenabled by cron job, which monitors services state

This is from lfd.pl (including line 1160, where an error is triggered)
while (1)...

Hello,

we have a server that needs to be able to access mysql with the root user.

We have blocked port 3306 globally.

And allowed the authorized IP in csf.allow with the following format:
tcp|in|d=3306|s=x.x.x.x

We check that it works fine, but we have found a strange log:

cat /var/log/mysqld.log | grep Access denied
2021-03-03T09:27:40.493517Z 574416 Access denied for user...

Hi

We tried to install csf on a server running the Ubuntu 18 system and you blocked countries from accessing the server
But it appears that the server works in countries that have been blocked

I don't know what the problem is

What was applied to the composition:

1-===========

dpkg --configure -a

2-===========

cd /usr/src
rm -fv csf.tgz
wget
tar -xzf csf.tgz
cd csf
sh install.sh

3...

I try to set restriction to user and not general SMTP restriction.
As I understand SMTP_BLOCK should be ON and additional per user
2. SMTP_ALLOWUSER XXXuser

Is this correct?

Hello,
I am new using ConfigServer security & firewall and can use some guidance.

I am trying to set it up so that I receive alerts when certain actions take place for example when the server load is high.

My first question is can alerts only be sent via email? Or are there other ways of sending alerts such as SMS or post to url?

Can you point out where in CSF you specify these settings, for...