ConfigServer Mail Manage - cmm v2.06 is no longer showing existing email accounts under cPanel 78.
Under cPanel v78.0.7 CentOS 7 CMM is showing and empty list but when creating an existing account, CMM is recognizing that the email account is already existing.

Sorry, wrong section. Posted a new one in the bugreport section.

This post can be removed.
Thanks for providing this discussion board.

Hello,
i use CSF on a cPanel server in the current version. Without having changed anything, I was suddenly locked out today. Even changing the IP by restarting the DSL connection or access via smartphone (not WLAN) didn't bring any change - the server is/was not reachable, there was also no reaction to a simple PING. The only thing that helped was to run csf -x directly on the server console via...

Hi,

I was wondering if it would be feasible to implement smarter blocking for login failures as per the following logic:

Do not consider multiple login attempts that use the same IP address, username, and password as separate failures if they occur within the same six-hour period.

We find that we spend a significant proportion of support-time helping customers get unblocked after they set a...

Having an issue when trying to restart the CSF module.

Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 175.

This is line 175
# start csflock
sub csflock {
my $lock = shift;
if ($lock eq lock ) {
sysopen ($CSFLOCKFILE, /var/lib/csf/csf.lock , O_RDWR | O_CREAT) or die ( Error: Unable to open csf lock file: $! );
flock...

When I try to access ConfigServer MailScanner Front-End v8.23 via WHM I get the following error.

MySQL Error:

In /var/log/maillog i am also getting the following error

MailScanner: Unable to initialise MailControl database connection: %%CBCB8KR33FFS7M0MOGPCSZJCMSH0N6FTE3O0HHB61D412VPQKWM

An IP from China got caught by lfd trying to access a cpanel account. However, China is country blocked (CC_DENY), and the IP is in the blocked range, as confirmed by csf (csf -g output below). Can someone explain how the IP managed to access cpanel even though it is in iptables? Thanks.

csf -g 203.2.xxx.xxx

Table Chain num pkts bytes target prot opt in out source destination
No matches found...

Suggestion - block Exim attacks that are designed to degrade server performance:

Log files below of the issue (IP used is arbitrary). CENTOS 7 server.

Log directory:
/var/log/exim_mainlog

2019-02-13 18:51:46.727 no MAIL in SMTP connection from :53797 I= :25 D=10s
2019-02-13 18:51:57.453 no MAIL in SMTP connection from :57662 I= :25 D=10s
2019-02-13 18:52:08.176 no MAIL in SMTP connection from...

Can someone assist putting together a custom regex for CSF? Log files below of the issue (IP used is arbitrary). CENTOS 7 server.

Log directory:
/var/log/exim_mainlog

2019-02-13 18:51:46.727 no MAIL in SMTP connection from :53797 I= :25 D=10s
2019-02-13 18:51:57.453 no MAIL in SMTP connection from :57662 I= :25 D=10s
2019-02-13 18:52:08.176 no MAIL in SMTP connection from :62178 I= :25 D=10s...

Where do the spam.whitelist.rules get built from, and how can I make my changes permanent? I've checked every domain/whm user's cpanel mailscanner whitelist settings, so I know the rules are not coming from the user whitelists.

I thought it might be the cron job rebuilding the spam.whitelist.rules file, but I commented it out, and my changes stayed in place until I went to the front end,...

Hi,
Sometimes listing has 1000s of email messages and to get to the most recent (being at the bottom), we need to wait 10 minutes after refresh and scroll way way down until the end

Can we have paging in ConfigServer Mail Manage?
Ideally most recent is at the top. ;)

Eventually manual sorting and choosing the number of item per page would be nice too. ;)

Thanks!

Hello,

I'm already using DYNDNS feature of CSF and it's really great.
Just asking, can I write a custom regex to protect /wp-login.php and accept the request to it only from my DYNDNS IP only?

Regards,

Hi,

CSF is installed and port 11211 was not open in CSF but still the refection attack was used successfully.

Did the install of memcached open port 11211 ?

Why did CSF not block this attack? Did CSF fail?

Regards,
Iken

Hello.

In my var/log/secure I got a lot of :

Feb 3 21:47:11 420215 auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=limi@domain.lv rhost=125.122.251.16
Feb 3 21:47:13 420215 auth: pam_unix(dovecot:auth): check pass; user unknown

but csf not blocking this ip's. If i add manually then this messages stop for some time and then again with diffrent...

Hello, in a server with 2 TB of data we need +3 days to analyze all the content with cxs.

The server has 24 cores and PCI-e/NVMe disks, however cxs only uses 1 core.

Is it possible to configure to give more cores and thus be able to finish the process faster?

When I check WHM > ConfigServer Security & Firewall it shows it is stopped.

I can restart and it shows it is running but later when I check it's stopped again.

Any suggestions on where I can check to see what is causing the issue?

Hi.
It would be great if we could have a new option to blacklist an IP or domain name to the receiving account only.

Right now MailControl only offers to blacklist the Email or Domain to all users on a server, but what about if only one customer ask us to block for example all the emails that comes from one domain or email address?

For example, right now customer ask us to blacklist all emails...

Hi Everyone,

I have my support system on the same server as some customers and want to be able to whitelist this domain so if they get blocked out they can still access the support system. Is this possible?

Hi,

We have a situation whereby we need two levels of geoblocking, and I was wondering if there was any way of achieving this in CSF as it stands.

We use the CC_DENY_PORTS option to block all FTP/SSH/cPanel/Mail ports from a dozen countries due to the amount of hack attempts that come from those countries. The only port we don't block is 25, as we want mail to be delivered from anywhere,...

Hello,

csf -v
csf: v12.09 (cPanel)

LF_MODSEC is set to 20
LF_TRIGGER is set to 0
LF_SELECT is set to 0

an IP matches more than 20 hits with mod_security for minute but IP is not blocked:

grep x.x.x.x /var/log/apache2/error_log | grep modsec | awk '{print $4}' | grep 21:50:50 | wc -l
23

Waiting for your reply

Regards