Hi,

We have a situation whereby we need two levels of geoblocking, and I was wondering if there was any way of achieving this in CSF as it stands.

We use the CC_DENY_PORTS option to block all FTP/SSH/cPanel/Mail ports from a dozen countries due to the amount of hack attempts that come from those countries. The only port we don't block is 25, as we want mail to be delivered from anywhere,...

Hello,

csf -v
csf: v12.09 (cPanel)

LF_MODSEC is set to 20
LF_TRIGGER is set to 0
LF_SELECT is set to 0

an IP matches more than 20 hits with mod_security for minute but IP is not blocked:

grep x.x.x.x /var/log/apache2/error_log | grep modsec | awk '{print $4}' | grep 21:50:50 | wc -l
23

Waiting for your reply

Regards

I canot click on any emails in MailControl anymore since WHM updated to 76.0.18
Everything keeps giving me this error

Software error:
malformed JSON string, neither tag, array, object, number, string or atom, at character offset 0 (before Unknown token. Pleas... ) at /usr/local/cpanel/whostmgr/docroot/cgi/configserver/mailscanner.cgi line 331.
For help, please send mail to this site's webmaster,...

Hi there,

Would it be possible for you to please add ID range support to CMC? For example, instead of needing to list an individual rule ID per line, ModSecurity provides support for ranges. So, instead of:

SecRuleRemoveById 1
SecRuleRemoveById 2
SecRuleRemoveById 3
SecRuleRemoveById 4
SecRuleRemoveById 5

For example. You can instead write it as follows:

SecRuleRemoveById 1-5

This...

I have a cPanel server with CSF installed. I am looking for an option to restrict access to a certain page (independent IP for the cPanel account). Am I able to set up a rule for a specific cPanel IP in CSF (cPanel has over 30 IPs)?

Hi,

Our external backups have not run all weekend due to a connection error. Looking at the IP address in CSF, it shows the IP address is in one of the blocklists we use, however, the address is also in the GALLOW ipset.

I'm wondering how come this is still getting blocked?

IPSET: Set:chain_GALLOW Match:nn.nnn.nnn.nnn Setting:GLOBAL_ALLOW

IPSET: Set:bl_FIREHOLLEVEL1 Match:nn.nnn.nnn.nnn...

Hello, I had the install done through ConfigServer several months ago. I ordered the CPanel service package. I just recently had an issue with a new domain running a wordpress site. When I installed the theme I was unable to use the editor after some investigation I looked at the ModSecurity plugin and saw there was an error, however the Rule ID is Unknown so I can't white-list it. The error was...

Hi All

I run a dedicated server with cpanel, until today i had csf installed, however since cpanel updated it stopped working and have had to remove to be able to get server to respond.

I did speak to the cpanel tech guys seems they dont want to know as its not their issue.

Has anyone else had this issue.

I did uninstall and reinstall today, however the result was the same. Im guessing this...

We would like to use csf on solusvm slave server since we are getting injected and almost getting root escalation without notice on the slave server, however after enabling csf it would always block all access to the VM (KVM) except the slave server itself. If we run service network restart it would be fine but only for 5 minutes which is clearly something csf is doing.

Tried the following...

Hello.
I'm newer here, if I start some stupid question, please excuse me.

I use firewall in WHM with CentOS 7*64, the config file of firewall are installed by host, and today, navigate in this site I view are scripts for download/install for my self
Therefore, now I do not know if it is better to use script downloaded from this site...

My doubt is that, in the host where I have the doubt /...

First of all, great plugin!

One of our resellers asked if it would be possible to have a simple 'add to whitelist' for ip addresses window in the Direct Admin plugin. That would allow resellers to add their end users (who seem to be unable to type passwords) to the whitelist.

Is there any way to accomplish this?

Hello,

Restarting csf causes: FORWARD DROP failed at line 1359 in /usr/sbin/csf

After that basically all traffic is blocked to/from server.

Server is a web-server with cPanel-Cloudlinux.

We are in the process of updating our old MySQL from version 5.6 to 5.7 and we saw an warning for WHM/cPanel applications regarding a CRITICAL issue:

MySQL enables strict mode by default as of version 5.7. Strict mode controls how MySQL handles invalid or missing values in data-change statements such as INSERT or UPDATE. Applications not built with strict mode enabled may cause undesired...

Can anyone outline how to configured ConfigServer to ignore all expressions?

I get tons of emails with things like this:

----------- SCAN REPORT -----------

TimeStamp: Thu, 3 Jan 2019 00:00:03 -0700

(/usr/sbin/cxs --allusers --nobayes --clamdsock /var/clamd --ctime 25 --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 10000 --noforce --html --ignore...

Hi -
I'm getting a Suspicious File Alert notice regarding certain dynamically generated cached font files (TTF) within a particular WordPress plugin. Here are a few notices:

Time: Sun Jan 6 00:05:05 2019 -0900
File: /tmp/gravitypdf-f9030c7ae762b0c8213685204124121f/mpdf/ttfontdata/dejavusanscondensed.mtx.php
Reason: Script, file extension
Owner: dxlkfhpl:dxlkfhpl (1014:1016)
Action: No action...

EDIT: safe to delete this thread. After researching a bit more I found out I can accomplish this by adding do not delete to an entry

Currently I have my deny list set at a maximum of 500 entries, but a larger number of entries wouldn't solve this issue anyway. The problem is that I want some addresses blocked permanently and never rotated out.
It would be nice if there would be two separate deny...

Is there a way to reduce the counter for an LFD trigger in regex.custom.pm?

I have a log which counts displays of a ReCaptcha page which works well but I would really like to reset the counter for the trigger level after a successful validation. This is also logged in the same file.

I would be grateful for any suggestions please.

Hello all,

I want to enable CSF email alert service. This server is an Ubuntu 18.04, Nginx. It's already installed sendmail and it's working properly. I have enabled following services in CSF configuration file and reloaded CSF ( csf -r ).

LF_ALERT_TO = myemail@gmail.com
LF_ALERT_FROM = root
LF_ALERT_SMTP =
RESTRICT_SYSLOG = 3
LF_EMAIL_ALERT = 1
LF_SSH_EMAIL_ALERT = 1

But when I log...

Hello to you the ConfigServer team.

Firstly I want to congratulate you for the excellent work that you realized this year, it is very appreciated! I hope that the year 2019 will be as good in features :-)

This topic about a small issue/overload increase on a VPS node at midnight , after checking it would appear to be the CRON defined in /etc/cron.d/lfd-cron

# cat /etc/cron.d/lfd-cron...

Hi. Not sure if this is a question or suggestion but after having configured csf in various host and container machines it would be of great help to be able to overwrite only those tunned directives and make those survive updates.

What I mean, and not sure if its already possible is to have an include conf.d/*.conf directive so I can have my configurations overwrite the default csf ones like in...