ConfigServer Community Forum

The settings values depend entirely on your user demographic and the type of attack you want to block. You will simply have t experiment with settings until you reduce the number of false-positives to an acceptable level. We would recommend using CONNLIMIT over PORTFLOOD where possible.

It can only send as nobody as that is the account ModSecurity runs under. I'll add the idea of using direct SMTP instead to the DEV list.

Not at present, but you can safely ignore the messages for now.

There's no functionality that would do that in cxs. I'll put the idea on the dev list.

It's not possible at present. I'll add the idea to the DEV list, but can make no promises that it will happen and/or when.

You would have to process their RSS feed yourself and place a list of IP's in a text file and then use the GLOBAL_DENY feature in csf.

This has now been added to csf v5.34

This has now been added to csf v5.34

You would need to use the GLOBAL_ALLOW function which only accepts a text file with one IP address per line, so you would have to preprocess the RSS feed before csf can use it.

This issue was resolved in csf v5.34. Thank you for reporting it.