Only enabling http/1.1 with keepalive disabled forces the user to recreate connections to Apache for every request sent to the Messenger host. This reduces the delay between an unban and a successful first request.

Protocols http/1.1
KeepAlive Off

# grep -Rin -E '(Protocol|KeepAl)' /usr/local/csf/lib/ConfigServer/Messenger.pm
493: print $OUT Protocols http/1.1\n ;
494: print $OUT KeepAlive...

hey,
how can I block all the world except 1 country?
I can't block all the countries with CC_DENY due to limitations in the IPSET .. I get an error of the kernel limit
I tried to put the country inside CC_ALLOW_FILTER but users still login outside the country in CC_ALLOW_FILTER

thanks for the help

I have noticed that CSF has started to ban Google IPs when a user did setup Gmail to import their email account contents using pop3 showing an alert message like 5 distributed SMTP Logins on account
Has anybody else have noticed something similar?

CSF is running on my cPanel server and after quite a lot of Googling, it left me even more confused, as a lot of contradicting info is out there.

Problem: Anyone can connect to telnet port 25 and abuse internal mails (Relay access is not authorised) As an example if the server is hosting mails for xyz.tld:
Anyone could send email from jane@xyz.tld to joe@xyz.tld without any authentication.

How...

Found a new blocklist which works with CSF. Thought I'd share it with the community.

This guy takes IP addresses from a number of blocklists, and counts how many they're on. You can process the whole file with some grep / awk / sort ninja, or you can download the pre-parsed files, which are updated daily.

eg. this line in your csf.blocklist file will download very naughty IP addresses...

Hi!

i install yum install ipset

and activate it in csf... but i have this error when i restart csf:

=========================
ACCEPT tcp opt -- in * out !lo 0.0.0.0/0 -> 8.8.8.8 tcp dpt:53
LOCALOUTPUT all opt -- in * out !lo 0.0.0.0/0 -> 0.0.0.0/0
LOCALINPUT all opt -- in !lo out * 0.0.0.0/0 -> 0.0.0.0/0
LOCALOUTPUT all opt in * out !lo ::/0 -> ::/0
LOCALINPUT all opt in !lo out * ::/0 ->...

I am getting This site can’t be reached after clicking on the change button in the configuration menu. some of the info of the error is ERR_SSL_BAD_RECORD_MAC_ALERT. What could be causing this? I have tried uninstalling and reinstalling CSF and that didn't help. Any ideas?

CentOS 6
No changes to CSF for some time.
Recently began getting an error when the daily cron job runs:
/usr/sbin/csf -u

Oops: Unable to download: write failed: Connection timed out

I've tried searching for solutions, but nothing pops out a me. Again, I'd not made any changes prior to this failing. It started failing sometime in the last week or so.

I have a lot of countries blocked, and have...

Hello,

Can anyone suggest me how to block .xz file extensions? I already edited filename.rules.conf with this new line

deny \.xz$ - -

but still not working. Can anyone please help? Thanks!

Hi,

I am having a weird problem with the lfd daemon in Directadmin. I installed csf+lfd as a plugin, and it seems to be running just fine. If I look at the service monitor, however, lfd shows up as using 0 bytes memory (despite having a PID). When I click on reload, I get the following error message:

An error has occurred

Details

/usr/bin/systemctl reload lfd.service 2>&1

Show lfd status......

Hello,

Since update 12.10 we have white pages when clicking on CSF in WHM sometimes. cpanel error log comes back with the following error ;
warn The subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/csf.cgi) exited with an error: The subprocess ended prematurely because it received the PIPE (13) signal. at /usr/local/cpanel/Cpanel/Server/Handlers/SubProcess.pm line 251....

It seems that Spamassassin has started writing files to a /tmp directory and I regularly get messages from lfd saying there's a suspicious file alert because of files like /tmp/.spamassassin6685u9JYgNtmp

Is it really that suspicious though? Presumably the directory has been created by Spamassassin. What's the best way to quell these alerts?

Hi,

When i check server security in CSF one of result is about

Apache Check : HTTP Binary not found or not executable

i can't understand how can solved this issue. i contact with my host provider and don't any thing for me. who know about this problem?

Thank you.

I was wondering if it might be possible for me to code (using PHP ideally) a solution where users can input their IP into a form and have this added to the whitelist automatically?

Obviously the form would ONLY be available to authorised customers and on a separate IP.

Following are the server logs..

Mar 27 04:02:56 lfd : Failed SMTP AUTH login from 141.98.80.17 - ignored
Mar 27 04:03:01 lfd : Failed SMTP AUTH login from 141.98.80.17 - ignored
Mar 27 04:04:06 lfd : Failed IMAP login from 154.72.188.190 - ignored
Mar 27 04:04:52 lfd : Failed IMAP login from 185.53.152.189 - ignored
Mar 27 04:05:27 lfd : Failed IMAP login from 190.131.220.130 - ignored
Mar 27...

hello
i have activated the ipv6 support in csf configuration but still is blocking all trafic... when i go to csf deny ips my ipv6 is listed there and is not ticked.. so i can't understand why they are blocked... if i turn off csf ipv6 is working fine
is anyone having the same issue? i searched the forum but i couldn't find anyone else experiencing the same problem...

Hi, I am using CXS on a WHM server and the Daily and Weekly Scan Wizards lets me configure an email address to send the reports to.
Is there a way to send reports to multiple email addresses?

Hi all!, From my vps (Cpanel v78.0.18 on centos 6.9 and csf 12.09) I'm trying send smtp email on 465 port but using other server in other location (using phpmailer). By default, CSF blocks all outgoing connections (SMTP_BLOCK = ON). Due to I don't want disable SMTP_BLOCK I deleted the 465 port from SMTP_PORTS (ports monitoring) and save the changes and all worked fine.

The problems appear after...

Have you considered integrating DDoS Deflate from: ?

I recently had a situation with my linodes where I got locked out.

They support recommendation from them was to run iptables -F which cleared the problem.
I never found my IPs in csf.deny

My question is, are there 2 layers of firewall.
The rules contained within CSF and additionally on top of that other rules that could have been added by some other process?

Thanks for any insight.