Hello,

We have an IP that keeps getting temporarily blocked. I've searched all the logs and there are no hits to that IP address.

Running the unblock IP returns the data that a temporary block was removed and access is restored. Seems to be every 10 minutes or so. We have been searching devices on our network to see if something is misconfigured to no avail.

Would love to get more data from...

Has anyone answered your question yet?
Seems like a very important question. One I would like to have an answer to too.

I have a laravel command as cron job that runs every week. I keep recieving emails that the command line is exceeding process time. I need to igonre this in process tracking ignore:
Executable: /usr/bin/bash
Command Line: /bin/bash -c php /home/rayes/backend/artisan redis:subscribe >/dev/null 2>&1

here's what i tried to put in the process ignore tracking
exe:/home/rayes/backend/artisan...

Hello, i'm Pete

i have been using this firewall for years in cpanel......its great.... i love it....
the reason im in here is because i came to a dead end with the configuration on a server that uses APIs.
This server has apache and php installed and runs some APIs, The port we use is the hhtps thus port 443 and port 80 for curl. both ports are in the list for udp/tcp in and out, when i disable...

Hello, I am not receiving e-mail from CSF/LFD
When I go to mail queue shows the error:

root cannot accept local mail deliveries

This only happens on CSF/LFD. When I create account or delete account on cPanel I receive notifications. But notifications from CSF/LFD I am not receiving.

I also checked on configuration:

LF_EMAIL_ALERT = 1

is set to 1.

Can anyone help?

When a domain is blacklisetd in MSFE, does the sending server receive any sort of bounce.

Hello,

I'm using CSF with my main domain perfectly and I'm using it with Cloudflare and everything is good!
Now, I will create a subdomain and I want to block access to it, how can I do that using CSF?

Regards,

I have a customer for testing needs
Request to temporarily turn on all TCP_Out Port
But I don't know how this should be set in the Firewall Configuration.
Is it OK to set the TCP_OUT option to 0-65535?

Hello,

I'm doing something blasphemous: I'm using CSF on a workstation. Why? Well, it is the only one thus far that is ACTUALLY working for me -- blocking attempts well. That said, I have listed all the ports my chat program uses in csf.conf/TCP_IN,TCP_OUT,UDP_IN,UDP_OUT, and have listed it as exe:/path/to/application in csf.pignore.

However, I still cannot sign in with it to the remote server...

Suddenly on all servers in lfd.log file this is showing and repeating all the time:
Oct 11 14:24:26 server lfd : Cluster Service died, restarted
Oct 11 14:24:26 server lfd : *Error* cannot open server on port 7777: Address already in use, at line 9679

Any idea on how to fix it?
Have tried restarting csf and cluster.

Hi,

New to CSF and the forum. I have been getting a couple of emails regarding different issues and this one has me concerned as I am not sure if this is a false positive or not.

Any help would be appreciated. :)

Executable:

/opt/cpanel/ea-php72/root/usr/sbin/php-fpm

Command Line (often faked in exploits):

php-fpm: pool thedarkblues_co_uk

Network connections by the process (if...

Hi:
Not sure how i should handle this.

We have lot of wp-content/cache/wp-rocket/www.mydomain.tld advises, that are normal beacuse we install wp-rocket on our hostings.

Problem is that i want to ignore the Suspicious directory email, but, if exploit appears on wp-content/cache/wp-rocket/www.mydomain.tld/exploit.php, it should be detect also.

how can this acchieve ?

thanks in advance

Configserver Mail Manage has four buttons, but once you selected the button you are going to use, you only see the other three afterwards.

When you select Manage Mail Hourly Limits you see duplicated buttons on 1st and 3rd positions: Manage Mail Accounts

Hope this feedback may be useful.

Hey guys. I'm willing to know about this question: if I already has Connection Tracking enabled in my VPS, do I add any real benefits by adding mod_evasive to Apache? Or should I really choose between one or the other?

Hope you can answer me soon.
Thanks in advance!

I have 4 different php versions 5.6, 7.0 7.1 7.2 and all of them have disable_functions with many functions disabled.

In Firewall check all of them except 5.6 show up as fine, but I get a warning that I need to fix this in 5.6. I've verified that the file for sure has disabled_functions set correctly.

Same with enable_dl = Off - I've done it in all versions but it shows as not done in 5.6

I...

Hello All,

Sorry if I am posting in the wrong place. Is it possible to run CSF on OpenSuse Tumbleweed? The install appears to work correctly, however I am unable to run it, or integrate it with Webmin. I thought it best to make sure it was compatible before I posted log output.

** Edit **

Here is the output when I try to run the service -

csf.service - ConfigServer Firewall & Security -...

I have used csf and Cloud Linux together many times in the past without issue. Today I upgraded a regular Centos 7 cPanel with latest kernel, cpanel and latest csf version to Cloud Linux.

After the upgrade, csf would no longer load. I do not see any errors in the boot.log or messages, etc. When I try to run commands like csf -ra, csf -x or csf -e it just sits there and hangs.

If I reboot the...

I have a single cPanel server and it is currently protected by a Juniper SRX 300 Hardware Firewall and CPHulk. I would really like to remove the hardware firewall and go back to use CSF, but I am wondering if anyone can advise on what I would lose or gain in making the change? I know CSF can do a lot more, but do I lose any major security by removing the hardware firewall? Since I have just one...

Hi guys

I'd like to know if I should configure CXS with ClamAV Unofficial Signatures Option if i'm using the following on clamav:

Thoughts?

Hi,

I am new here. I have been trying to find my answer through the search function on the forum but cannot find it.
I am blocking traffic from certain countries. Is it possible to redirect that traffic to a specific custom url ?

Thanks,
Marcus