I'm trying trying out CSF using vagrant to test out how it works and testing out the configuration I need to do before I apply to my actual VMs.

I deployed two sandbox VMs. 192.168.33.10 (with CSF) and 192.168.33.11 (VM that will try to brute force SSH to 192.168.33.10)

Given /etc/csf.allow

10.10.10.10
192.168.33.1
172.16.1.1/29
192.168.33.11

And /etc/csf.ignore

127.0.0.1
10.10.10.10...

I keep seeing dozens, sometimes hundreds of class B or C IP's coming to the server with 1 connection with no real performance impact. I never let them stay connected long enough (or they don't) to dig deep into what they are actually doing (I need to thought).

My question is, is there a setting in CSF to watch for a scenario like this and block that B or C class block. This latest one is from...

What are the correct values for SYNFLOOD Enabling?

Hi,

We are facing last 1 week our multiple server frequently 443 port is not accessible, When ever port is not accessible once we restart csf then its start working.

Please help us what was the issue and how we can fix it in all the server?

Hi all,

I have started to receive emails from my server like a week ago about suspicious file running on my server. This is an example email sent to me by CSF.

lfd on frodo,.em4hosting.com: Suspicious File Alert

File: /tmp/f7d5859d3fd2dc6
Reason: linux binary
Owner: em4hosting:em4hosting (1003:1005)
Action: No action taken

The system keep sending the same mail several times a day. How can i...

I just installed cmq on DirectAdmin (seeing that version 3 supports DirectAdmin) but I get a blank page
Are there any users of Directadmin who have successfully installed it? Thanks.

I had issues with a weird attack so I've installed mod_qos on a cPanel server.
It seems to work:

# cat /var/log/apache2/error_log | grep qos
AH00489: Apache/2.4.39 (cPanel) OpenSSL/1.0.2s Apache mod_bwlimited/1.4 mod_qos/11.63 configured -- resuming normal operations
AH00489: Apache/2.4.39 (cPanel) OpenSSL/1.0.2s Apache mod_bwlimited/1.4 mod_qos/11.63 configured -- resuming normal operations...

The directadmin installation suggests that CSF config should be managed by the directadmin and we have to set some bruteforce settings to 0 or disable them. By doing this, the CSF will trigger few warning messages.

From what I've known, CSF use a special installation config file for directadmin called csf.directadmin.conf and it contains a generic variable DIRECTADMIN=1

If we can use this...

We are trying to cut down on the number of emails of logs that we receive and are attempting to move everything to pipe all logs from a stack to papertrail. Is it possible to do this for the csf, lfd, cxs, rootkit logs?

Hi.
I use a lot the CMC and the page to see the LOGs, I think it needs a new design. Something like the one that you do with MailControl.

Right now I only can see one or two lines of the log as all the header is so big and consumes a lot of wasted space.

Can you, please take a look at this.

Best Regards,
Sergio

Hello,

I want to config my CSF on Debian to block failed logins for Wordpress websites.

I have a lot failed logins everyday and Im wondering how to block it as if 10 logins failed IP is blocked for several days.

This will help me to solve spammers attack to my websites on Wordpress.

Can you give advide which settings should I change and what values will be good for that case?

Kindly...

Hello,

I am getting serious problem with UDP i am getting a lot of UDP outgoing traffic which makes my server went down and my provider won't allow these kind of traffic at all so when this happen server IP went into nulled routed which cause a lot of issue to my clients. I need your help to sort this thing out. Below you will find logs.

out: 173.208.255.5 168.62.170.227:48658 -...

Hi,
recently I get emails like the following email, There are blocked UDP_OUT with different ports to some IP addresses which those are blocked
How can I trace where is the problem and which accounts do such connections?
It seems there are some scripts which try to connect to the output, but I couldn't find which accounts do this
Appreciate for any help

Title: lfd on XXXXXX.com: UID 25 (named)...

Hi, I make a block of /24 IP address on my server but this block still acessing my sites, I already try restart csf, apache and the problem persists, I runn csftest.pl too!

# ./csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing...

Just wondering if it's possible to use CSE to copy a 200MB backup file from one home directory to another home directory. I tested the copy feature on a small text file and it works fine. Concerned about the size of the backup file tho.

Any feedback appreciated.

how to reset server??

I am trying to use CT_LIMIT to block IPs connecting to my jetty server on port 8443, the connection from specific IP keep in CLOSE_WAIT status and keep opening new connections in CLOSE_WAIT, I configured CT_LIMIT=30, on port 8443 but CSF did not catch this IP and block it,
CSF test script shows Testing xt_connlimit...OK,
how can I figure why CT LIMIT is not working and how to configure it...

I am a very happy user of csf for many years on dedicated and VPS systems.
I have recently setup a dedicated server within my own network and installed csf successfully.

Problem is when I receive emails about logins or check any of the logs, it is only ever reporting the gateway internal IP address.
Scenario:
From a different physical location, using an internet connection not related to my own...

Our CSF don't block udp ddos attacks.
OS: Debian10 buster.
Last version CSF has been installed.
csf.conf link:

Hello,

I have use VPS with CPanel I receive this message continuously.
I receive between 150-200 messages a day.

Time: Sat Jul 27 16:00:43 2019 +0200
Account: mailman
Resource: Process Time
Exceeded: 986557 > 1800 (seconds)
Executable: /usr/bin/python
Command Line: /usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:1 -s
PID: 31036 (Parent PID:31029)
Killed:...