ConfigServer Community Forum

Does anyone know how I can add the users IP address to sualert.txt?
I've tried the following but it does not work

IP:

Since a few weeks the CSF Real time blocklists checker in WHM stopped working. The titles of the hourly checks that email me, they report this:

`RBL Check on server04.ourcompanydomain.com: failures`

Every single list is failing, and I have no idea where to start checking why.

The only clue I have and the only text that seems out of order is in the middle of the email report Senderbase:...

Hi. I've been using CSF for a while on a PVE (LXC) server.
The host has an interface vmbr0 for public address and a vmbr10 that we use as an internal network (10.0.X.X)
Most LXC containers only have one of the internal network address as we use a Nginx proxy in one of them to receive all the external traffic. This to the local containers is an eth0 address. Additional IPs are routed through the...

I get a lfd on host.******: Suspicious File Alert.

Time: Mon Jun 29 11:45:17 2020 -0400
File: /tmp/libjansi-64-git-Spigot-db6de12-18fbb24-5095707643582958365.so
Reason: Linux Binary
Owner: kar***:kar*** (1050:1050)
Action: No action taken

The number after /tmp/libjansi-64-git-Spigot-db6de12- always changes.
How can I ask lfd to ignore those files?
Thank you.

Hi guys,
I'm new to csf, so, please dont judge me hard if already have answers.
Could you please help me understand how to build me owr rules.
As many users we run WP sites and most attacks are over login.php and xmlrpc.php.
So, how to tell:
If xxx.xxx.xxx.xxx POST (GET) login.php (and/OR xmlrpc.php) then check this IP in csf blacklists and if is there ban it perm (temp)

This example will help...

I have OSM installed on a few servers and I'm running into some weird errors I can resolve. The original error was:
*ERROR* Net::Pcap failed to install, see /etc/osm/osmpcap.log. Packet inspection feature has been disabled in osm.
To which i installed pcap on the servers that were affected via
sudo yum install perl-Net-Pcap
yum install libpcap libpcap-devel -y

I later saw this post ( ) where...

Hi there Folks

CXS is still a mystery to me so, while I'm slowing getting to grips with it being on our servers, could someone advise what to do with this?

.../public_html/accesson1.php] does not exist on this server. ModSecurity is still triggering cxs to scan the attempted uploading of potentially malicious data

I get these messages everyday from CXS from various of our servers. Do I...

Hello,

I need to clean the server of this file:

How to use xtra file to do it?
Thanks

I have CSF installed on a Ubuntu 18.04 machine. We just installed libvirt on the machine and have VMs that are using the internal network adapter virbr0. When libvirt starts, it adds the following rules:

# Generated by iptables-save v1.6.1 on Tue Jun 16 11:48:26 2020
*nat
:PREROUTING ACCEPT
:INPUT ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24...

Hi,

i need to protect FORWARD rules , csf.redirect

-A INPUT ! -i lo -j LOCALINPUT
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j SYNFLOOD
-A INPUT ! -i lo -p tcp -j INVALID
-A INPUT ! -i lo -p icmp -m icmp --icmp-type 8 -j LOGDROPIN
-A INPUT ! -i lo -p icmp -j ACCEPT
-A INPUT ! -i lo -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT !...

Hello!
I have server Cpanel Cloudlinux+CSF>
I need make redirect port 4554 on port MySQL 3306.
I added on csf.redirect
But doesn't work , mysql not accept connect

Hello buddies , from somedays I am facing connection was reset by peer issue in my dedicated server.
The Following are installed in my server :
CPanel
CloudLinux
LiteSpeed
ConfigServer Firewall
Imunify360

I asked my friend he said that someone doing Ddos on your server.

sir I checked my IP on check-host.net , and I patched a issue that when UDP Ports showing connection refused then HTTP shows...

on cpanel I can set LF_CPANEL_ALERT to get a mail if a user login into cpanel. On the DA version I can't find such an option.

can this function also be made available for DA? would be very practical.

thanks

Hello,

I was wondering if anybody has any insight into this issue we are seeing. We have centos6 and csf with cpanel integration installed. Sometimes a users IP will be blocked, and after being removed, the hostname will still remain blocked in iptables.

After trying to remove the block through CSF it's saying it doesnt exist:

Unblock 184.153.XXX.XX, trying permanent blocks...

csf:...

Hello

Just i make a fresh installation on dedicated server with centos7 and cpanel.
When reboot server look ofline i believe this happening After installation of csf.
Now i have access only from rescue mode.
In past i didnt had any problem with csf and cpanel (centos 6 + cpanel)

Steps to reproduce:

1.I make fresh installation again.
2.I try to set csf on test mode to disable it.
3.I search on...

Good morning CSF Team!

We are currently evaluating if we can use CloudLinux's Imunify360 solution which has a CSF Integration mode.

In Imunify360, when it detects CSF blocked an IP, it will move that block from CSF to Imunify360, however it relies on the 'BLOCK_REPORT' function of CSF.

During our testing, we've noticed that sometimes CSF will block an IP but Imunify360 didn't see the block....

hello
im try to open / block port by country with this settings

all country:
TCP_IN = 20,25,53,80,443,465,587,993,995,1167,49152:65534,2080,2443,49152:65534

only from IT
CC_ALLOW_PORTS = IT
CC_ALLOW_PORTS_TCP = 21,110,143,2077,2078,2082,2083,2086,2087,2095,2096

deny all CHINA
CC_DENY = CN

deny BR,VN,TH
CC_DENY_PORTS = BR,VN,TH
CC_DENY_PORTS_TCP = 993,995,465,587

seem all works great...

Hello

I have two related questions if you could answer, I would be very grateful;

1) I am using Mod security as well as CSV on my Apache Centos server. I have been getting some IPV6 attacks and mod security is adding them to the mod security block just fine - but how can I manually add the offending IPV6 address into CSF? For example this one: 2a03:6f00:1::5c35:601e - when I try to add it I get...

Hello,

I am having issues with CSF not loading iptables rules on CentOS 8 on reboot. I have to run csf -r to apply the rules after reboot. How can I fix this?

Thanks,

# iptables -n -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# Warning:...

Hi

csf.deny lists the IPs, and the protocol used for the IP blacklist. This is fine.
However, and when running shared servers, it would be really helpful if we could know what email address is being used when it gets blocked.

One of our clients has 30+ email accounts, and supposedly ONE user is constantly get blocked because of wrong SMTP credentials, this is what I see in the logs.

Is there a...