hi,

I'm an old user and I can assure you deleting mail by error is a VERY destructive process for our customers' confidence in us and by extension, ours in your tools.

I found at least two OLD threads about this problem and I think a very small enhancement could prevent us to make a VERY big mistake:

In a longer-than-one-page mail list, the DELETE SELECTED button is hidden... and your...

Hello, how we can exclude cpanelsolr in pignore?

Thanks!

Time: Fri Nov 16 23:01:20 2018 +0100
Account: cpanelsolr
Resource: Process Time
Exceeded: 274648 > 1800 (seconds)
Executable: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.x86_64/jre/bin/java
Command Line: /usr/lib/jvm/jre-1.8.0/bin/java -server -Xms512m -Xmx512m -XX:NewRatio=3 -XX:SurvivorRatio=4 -XX:TargetSurvivorRatio=90

If i were to block all countries but the US, would this load all non-US IPs into the deny list (memory) in order to block? How is this handled, is it memory intensive?

Hi. I'm getting through a lot of `Suspicious File Alert` emails and wondered if you can shed some light for me. I'm not sure what is triggering the emails, whether its csx or the firewall or what but here's the email I get::

```
Time: Thu Nov 15 02:15:15 2018 +0000
File: /tmp/systemd-private-a6133d7fde4048eb9edfb67e9b7a5554-ea-php72-php-fpm.service-vNsXRF/tmp/error.htm.php4L36dP
Reason: Script,...

HI Eveyone,

We've just had an issue where csf was blocking remote backups to a server on my internal network. I ended up turning off the firewall so we could do backups.

Any idea?

Hi,

I've recently noticed in my logs many of these:

Nov 14 01:50:48 server.fqdn phpMyAdmin : user denied: root (mysql-denied) from x.x.x.x

How can I get CSF /LFD to catch these and block the source IP attempts?

Thanks.

Michael.

Hey Guys,

Would anybody be able to assist with a regex rule for CSF that would block attempts on the SMTP gateway ASSP?
It create's lines like this in exim_mainlog : dovecot_plain authenticator failed for ( - 185.222.209.83 -) :60094: 535 Incorrect authentication data (set_id=user@domain.tld)

How can I have these ip's blocked after let's say 5 attempts?

Hi.

I recently enabled a couple of RBL's in CSF. I get reports via X_ARF enabling, and it seems that IP's listed in the RBL's defined in csf.rblconf are still getting through and hitting Brute Force, producing the X_ARF report where I can see 5 attempts.

Shouldn't the RBL match of the IP stop even 1 attempt? (assuming the RBL check is working)

Michael.

Hi.

Firstly just to let you know I'm new to CSF but really love it. Thank you for making this tool available.

I've installed it on a couple of CentOS 7 machines, running Virtualmin Pro and Webmin.

All installs and works fine and I install the csfwebmin.tgz into Webmin, however I like to have all iptables logs in a specific file, instead of the normal /var/log/messages file.

I configure...

I've decided to start a new thread because I haven't seen any current working solution, or activity on older threads regarding this issue.

I have spent countless hours over the last 3 months trying to solve this issue with email that is getting blocked which comes from Gmail:

DNS Error: 91335 DNS type 'mx' lookup of localinternetads.com responded with code SERVFAIL

I've read through 3 dozen...

I'm having a lot of problems with clients blocking themselves by signing in with the wrong email login details.

All my clients are in Ireland and I was wondering if I was to use CC_ALLOW_FILTER IE would it stop the problem.

2. If I was to do that would it create significant additional load on the server?

Hi Team,

I have added 177.0.0.0/8 # BR/Brazil/NA. do not delete to our deny list of IPs.

Normally when a range is blocked, then I don't continue to get e-mail notifications for that denied range... however recently I am getting notifications for repeated hacks for IP Addresses that are blocked on the deny list of IPs
Is there a way to ONLY get notifications of NEW IP Address hack attempts?...

Hi All,

I was wanting to permanently deny the following IPV6 IPs

QUESTIONS:-
1) Will the following work?
0:0:0:0:0:ffff:65fe:e68c/120/ # CN/China/Beijing, Xuanyu. do not delete
0:0:0:0:0:ffff:6f49:2e21/118 # CN/China/Nanchang. do not delete
0:0:0:0:0:ffff:7276:6175/120 # CN/China/Beijing. do not delete
0:0:0:0:0:ffff:7bf9:d28/119 # /Shenzhen. do not delete
0:0:0:0:0:ffff:d3da:7e8e # KR/Korea...

Howdy,

We've got an interesting issue with CSF on one customer's VPS only whereby the customer will log in to WHM in order to remove an IP block for a client of theirs only to find that CSF is showing up as disabled - with a button to reenable visible.

They're not disabling the firewall and neither are we, but the interesting part here is that the logs indicate that CSF is in fact functioning...

Hi,

How to configure CSF to allow CIFS mount?
Ive enabled TCP_IN and TCP_OUT ports 139. 445 (both for IPv4 and IPv6) and I still get errors:

Nov 3 20:26:13 kernel: Firewall: *TCP6OUT Blocked* IN= OUT=eth0 SRC=xxxx:xxxx:xxxx:xxxx:0000:0000:0000:0001 DST=2222:xxxx:xxxx:xxxx:0000:0000:0000:0001 LEN=80 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=54886 DPT=445 WINDOW=28800 RES=0x00 SYN URGP=0
Nov 3...

Hi all,

Came across a user who was blocked for portscan on 443, is this normal? As far as I can tell my CSF is configured correctly to allow connections on 443, and browsing HTTPS hosted sites works just fine.

/var/log/messages
# grep ::data-removed:: /var/log/messages
Oct 31 11:15:49 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:15:5d:64:7b:05:::data-removed::...

Hello,
after i have updated csf from v11.7 to latest version 12.08, some things on my server have stopped working (such as cronjob for udptscaper) so i desperately need the old working version and ask everyone who has it somewhere to send one such to me ...

thanks to all of you

This one user we have keeps calling us because LFD has blocked him every time his IP Address changes (cell tower change, etc)... How do i prevent this block from happening without disabling all email login failure blocks?

Log entries:

info - user@domain.com POST /cpsess#############/3rdparty/afterlogic/?/Api/ HTTP/1.1 FAILED LOGIN webmaild: cookie ip check: IP address has changed
info - -...

Hello, I've been led here by cpanel posts in seeking a way to give my clients an email signature that will be appended to there outgoing emails, regardless of the email client they may be using.

The goal would be pretty vanilla: html formated signature of the associated email account Bob.Smith@company.co, some contact info and a PNG.

Please excuse if I am looking in the wrong place.

Much...

***necessary grave-dig***

I have same problem. Disabling IPV6 is not a proper solution in the server world.

I added my IP to csf.allow, I generated self signed certs and those did not work either. I cannot access the UI on the port configured. I get ERR_CONNECTION_RESET from the browser.

When accessing the https:// URL I get a SSL warning, which I accept and add exception, then I get...