It would be nice to have an option to be able to exclude a specific TCP or UDP port so that it is not affected by the CC_DENY filter

Hi,

We are getting alerts about suspicious file alert However we know they are legitimate files. Is there any way we can ignore anything to do with this user?

The error is as below.

Time: Wed Apr 24 18:16:39 2019 +0100 File: /tmp/wprss/twig-cache/2f/2f760a05665d1006ee76f2ad692f7e97b3ab25f069a74669a4c995e10502486a.php Reason: Script, file extension Owner: thechallengesgro:thechallengesgro...

Hello everybody,

for everyone who uses portscan tracking and blocking, check your messages logfile in /var/log/messages. If you find a large number of blocked IPs with port 443 here you will get the reason what it is caused by.

The reason is Google Chrome. If a Chrome user visits a webpage, Chrome uses the UDP protocol for a port scan and checks to see if port 443 is open, not just once, but up...

Hello,
I changed the value of LF_CPANEL to reduce the chance of banned IPs
due to bad password mistakes but I still don't understand the
purpose of the LF_CPANEL_PERM variable.

Can somebody explain me it better?

PS: Is it possible to attach pictures to posts of this forum?

Hi,
I am using my VPS under CentOS 7.10 with CPanel/WHM, and everything work well, but I've got this message from LogScanner, I've check the ifconfig and found three adapters installed
eth0 >> primary one with 10.x.x.x configuration
eth0:1 >> External IP
lop01 >> 127.0.0.1
is there any recommended thing to do in this case?
warn detects system IP as 64.202.186.216 and system local IP detected as...

There is always a spam folder usually, from Spamassassin or assp deluxe.

Is there a way to automate this:
:
We recommend filtering the email in your email client and placing it in a separate folder so that you can check through it in your own time.

And filter {Spam?} and {definitely Spam?} in the ./spam folder for all old and new users ?

Most users, don't know how to do it, And if a...

Hello,
I have noticed several errors like the following line
xxx.yyy.zzz.xxx # lfd: (eximsyntax) Exim syntax errors from xxx.yyy.zzz.xxx (PE/Peru/-): 10 in the last 3600 secs - Tue Apr 23 22:16:45 2019
and some of them are false positives so I was wondering if it is possible
to disable any rule to avoid IP blocking for this reason.

Just setup docker with csf, rules arent working, i still cant build containers (docker cant connect to outside world)

maybe there are some settings in csf blocking it? or more rules need to happen?

Running Amazon EC2 (Amazon Linux) with a load balancer.

CSF has been running fine until today (some 1.5 years).
I logged in via SSH and ran the latest update for EC2.
Then restarted CSF - and https and sftp stop working worldwide.

Disable CSF - all good.

Turn CSF TEST MODE on - all fails.
- My understanding is LFD does not run when in test mode. So LFD not the issue.
I have flushed iptables,...

Hello,

Even if we mark an up with do not delete (in order for csf not to automatically remove the IP during it's retention of keeping a number of IPs), when we enable reCaptcha unblock the malicious user connecting from a do not delete IP can delete it from csf_deny list.

Hello, I am using cPanel and csf installed in it. I have blocked port 80 and 443. Now some of the services are not working. So, If I enable those IPs then it is working fine. Like on my wordpress website Akismet was not connecting after blocking the Ports. So I have allowed Akismet IPs and now it is working.
I have added gdrive backup system on my cpanel server for backup. After blocking these...

CSF from configservers is killing processes from my PHP-FPM, could they help me prevent this?

Only enabling http/1.1 with keepalive disabled forces the user to recreate connections to Apache for every request sent to the Messenger host. This reduces the delay between an unban and a successful first request.

Protocols http/1.1
KeepAlive Off

# grep -Rin -E '(Protocol|KeepAl)' /usr/local/csf/lib/ConfigServer/Messenger.pm
493: print $OUT Protocols http/1.1\n ;
494: print $OUT KeepAlive...

hey,
how can I block all the world except 1 country?
I can't block all the countries with CC_DENY due to limitations in the IPSET .. I get an error of the kernel limit
I tried to put the country inside CC_ALLOW_FILTER but users still login outside the country in CC_ALLOW_FILTER

thanks for the help

I have noticed that CSF has started to ban Google IPs when a user did setup Gmail to import their email account contents using pop3 showing an alert message like 5 distributed SMTP Logins on account
Has anybody else have noticed something similar?

CSF is running on my cPanel server and after quite a lot of Googling, it left me even more confused, as a lot of contradicting info is out there.

Problem: Anyone can connect to telnet port 25 and abuse internal mails (Relay access is not authorised) As an example if the server is hosting mails for xyz.tld:
Anyone could send email from jane@xyz.tld to joe@xyz.tld without any authentication.

How...

What exactly do the options for Docker do in the configuration? There is no documentation for this.

Initially they seem to work but I'm not even sure if this is CSF not working at all because once you hit csf -r it seems this breaks something on a permanent basis as you cannot start any container anymore, giving an error about iptables no chain/target by that name.

I have tried for hours to...

Found a new blocklist which works with CSF. Thought I'd share it with the community.

This guy takes IP addresses from a number of blocklists, and counts how many they're on. You can process the whole file with some grep / awk / sort ninja, or you can download the pre-parsed files, which are updated daily.

eg. this line in your csf.blocklist file will download very naughty IP addresses...

Hi!

i install yum install ipset

and activate it in csf... but i have this error when i restart csf:

=========================
ACCEPT tcp opt -- in * out !lo 0.0.0.0/0 -> 8.8.8.8 tcp dpt:53
LOCALOUTPUT all opt -- in * out !lo 0.0.0.0/0 -> 0.0.0.0/0
LOCALINPUT all opt -- in !lo out * 0.0.0.0/0 -> 0.0.0.0/0
LOCALOUTPUT all opt in * out !lo ::/0 -> ::/0
LOCALINPUT all opt in !lo out * ::/0 ->...

I have just installed cmq and restart the server too (centos 7.6 - Cpanel v78.0.18) but when I open the cmq plugin page although I can see the number of queued mail but when I click the view , it shows no email and said No matching queue entries found
I have selected All emails!
Also, I used to use your plugin for years and I have used it like this and it worked.

What should I do?