Is there a way to discard emails with a specific Subject if they are sent to any email address on the server?

For example our server is being bombarded with spoofed emails with subject lines such as:

Your account was under attack! Change your access data!
Security Notice. Someone have access to your system.
Security Alert. Your accounts was compromised. You need change password!

It is possible...

I've been running WHM/Cpanel on Servers For at least 12 years along with CSF/LFD. Yesterday all of the sudden the server wouldn't accept WHM connection on port 2087. I immediately tried bringing it up on my mobile phone to see if for some reason by connecting from my hotel the system had auto blocked the IP. Nope, was blocking external access to the port, not IP specific. Had made no config...

We have a single account that for whatever reason was running mdbox formatting mailboxes. A recent cpanel webmail update did something to cause all emails (thousands) to no longer be viewable from webmail. I cannot see them in cmm either. I tried converting back to maildir format (successfully) but cmm is still showing them as mbox format and the users can still not see their emails. They are...

Dear Team,

We have a domain name on which we are using WHMCS and for sending of Emails we are using AWS-SES.
We are installed with CSF/LFD and that is not allowing sending of email.
When we disable CSF then we are able to send emails without any problem through our portal (WHMCS).

Is it possible to white-list our domain name XYZ from the CSF/LFD check or white-listing the ports to send emails...

Hi,

We are annoyed by what looks like abnormal process time exceeded repeated alerts on Apache workers. Details below.
It appeared after moving websites from php5.5 to php7.2. Adjusting PHP limits has no effect.
Temporary workaround : pignore all Apache user-ids.

Thanks for any hint.

---
ConfigServer Security & Firewall 12.09 gpl on Virtualmin / Ubuntu 14.04 / Linux 2.6.32-042stab127.2 #1 SMP...

I have CSF running on my debian machine and try to figure out which call is being blocked (either incoming or outgoing) that prevents a specific service to operate, but I fail to find the right log. When I tail /var/log/messages and invoke the webservice error I see no entry appearing. Could someone advise how to minitor every csf/iptables blocks in realtime?

I know it is csf, when I disable it,...

Sorry, wrong section. Posted a new one in the bugreport section.

This post can be removed.
Thanks for providing this discussion board.

Hello,
i use CSF on a cPanel server in the current version. Without having changed anything, I was suddenly locked out today. Even changing the IP by restarting the DSL connection or access via smartphone (not WLAN) didn't bring any change - the server is/was not reachable, there was also no reaction to a simple PING. The only thing that helped was to run csf -x directly on the server console via...

Hi,

I was wondering if it would be feasible to implement smarter blocking for login failures as per the following logic:

Do not consider multiple login attempts that use the same IP address, username, and password as separate failures if they occur within the same six-hour period.

We find that we spend a significant proportion of support-time helping customers get unblocked after they set a...

Having an issue when trying to restart the CSF module.

Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 175.

This is line 175
# start csflock
sub csflock {
my $lock = shift;
if ($lock eq lock ) {
sysopen ($CSFLOCKFILE, /var/lib/csf/csf.lock , O_RDWR | O_CREAT) or die ( Error: Unable to open csf lock file: $! );
flock...

When I try to access ConfigServer MailScanner Front-End v8.23 via WHM I get the following error.

MySQL Error:

In /var/log/maillog i am also getting the following error

MailScanner: Unable to initialise MailControl database connection: %%CBCB8KR33FFS7M0MOGPCSZJCMSH0N6FTE3O0HHB61D412VPQKWM

Can someone assist putting together a custom regex for CSF? Log files below of the issue (IP used is arbitrary). CENTOS 7 server.

Log directory:
/var/log/exim_mainlog

2019-02-13 18:51:46.727 no MAIL in SMTP connection from :53797 I= :25 D=10s
2019-02-13 18:51:57.453 no MAIL in SMTP connection from :57662 I= :25 D=10s
2019-02-13 18:52:08.176 no MAIL in SMTP connection from :62178 I= :25 D=10s...

Hi,
Sometimes listing has 1000s of email messages and to get to the most recent (being at the bottom), we need to wait 10 minutes after refresh and scroll way way down until the end

Can we have paging in ConfigServer Mail Manage?
Ideally most recent is at the top. ;)

Eventually manual sorting and choosing the number of item per page would be nice too. ;)

Thanks!

Hello,

I'm already using DYNDNS feature of CSF and it's really great.
Just asking, can I write a custom regex to protect /wp-login.php and accept the request to it only from my DYNDNS IP only?

Regards,

Hi,

CSF is installed and port 11211 was not open in CSF but still the refection attack was used successfully.

Did the install of memcached open port 11211 ?

Why did CSF not block this attack? Did CSF fail?

Regards,
Iken

Hello.

In my var/log/secure I got a lot of :

Feb 3 21:47:11 420215 auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=limi@domain.lv rhost=125.122.251.16
Feb 3 21:47:13 420215 auth: pam_unix(dovecot:auth): check pass; user unknown

but csf not blocking this ip's. If i add manually then this messages stop for some time and then again with diffrent...

Hello, in a server with 2 TB of data we need +3 days to analyze all the content with cxs.

The server has 24 cores and PCI-e/NVMe disks, however cxs only uses 1 core.

Is it possible to configure to give more cores and thus be able to finish the process faster?

When I check WHM > ConfigServer Security & Firewall it shows it is stopped.

I can restart and it shows it is running but later when I check it's stopped again.

Any suggestions on where I can check to see what is causing the issue?

Hi.
It would be great if we could have a new option to blacklist an IP or domain name to the receiving account only.

Right now MailControl only offers to blacklist the Email or Domain to all users on a server, but what about if only one customer ask us to block for example all the emails that comes from one domain or email address?

For example, right now customer ask us to blacklist all emails...

Hi Everyone,

I have my support system on the same server as some customers and want to be able to whitelist this domain so if they get blocked out they can still access the support system. Is this possible?