ConfigServer Community Forum

Has anyone here created a PHP script in order to blacklist IP addresses in CSF to the Sucuri blacklist using their API as can be done with Cloudflare?

Hi,
i have a exploit i cannot remove. i hace updated website and change all password. i also try to ban ips but csx continue to report it to me. fortunately it block and send it to quarantine. i want to remove it definily if possible.tjis is a wp website

Scan Status Fingerprint
Scan Time Tue Jan 19 10:01:00 2021
Scan Type Web
Original File...

You must install ClamAV (Clamavconnector on cPanel) or ensure clamd is running to use this product correctly
If the clamd socket is not automatically detected, and to clear this message, you must set clamdsock=/path/to/socket in /etc/cxs/cxs.defaults to the live socket location

how to solve this.

Is it possible to redirect all blocked ips to a new address liked siteaddress.com/blocked to notify if a user is being blocked.

I get a lot of clients who get blocked due to incorrect email login attempts so would like to show the users they've been blocked instead of the sites showing a 500 error.

Ran into an odd issue today, CSF was reporting that it couldn't restart. This was the error in the startup logs:

Error: FASTSTART: (csf.allow IPv4) [] . Try restarting csf with FASTSTART disabled, at line 5587

I disabled FASTSTART and that did allow CSF to start, but I have no idea what that means. Any idea?

Good morning,

I have two IPs in my cPanel server, one for web purposes and a secondary IP for outgoing email. To avoid malicious things use the secondary IP, I wish to restrict this secondary IP to only SMTP ports. How can I achieve that with the CSF plugin in my cPanel?

Thanks in advance.

Hi,

Started noticing suricata alerts based on this ET.
ET DNS Query for .su TLD (Soviet Union) Often Malware Related

network.data.decoded .............ns2.magicgenericmart.su.....

UDP traffic

(..5.?._X..............ns2.magicgenericmart.su..............W. .ns1...admin..w..@...X......u.....

Exploring tcpdump to pcap gives an indication that it still hits the cPanel host even though...

I've set up CSF within Virtualmin, including the admin module successfully using the documentation instructions to the letter. Virtualmin is running on a fully patched Ubuntu 18.04.5 running on AWS with a firewall rule in AWS set to block SSH port 22 to only accept connections from my IP address, no other rules in AWS firewall. All seems to work well. Virtualmin is set up with one domain running...

I have 2 VPS both managed by WHM-cPanel
One of them is very old and works fine, while new one just installed Centos7 and cPanel.
On both VPSs run same CSF v14.08.
I am facing a strange bug on the new VPS cPanel installation.
The TCP_IN: List is not applied at all
That means, what ever port i add to this list, does not open.
The List that the i get from the View Listening Ports button, has nothing...

Hi. We'd like to only allow FTP access to users who connect via a specific hostname like: portal4321.vps22.hostingserver.com.

And block everything which tries to connect to the FTP in a different manner, like ones who use the server IP or vps22.hostingserver.com directly.

Is this possible in CSF? If yes, great, how do i set it up?

Thanks!

I'm guessing this is a modsec question, but please let me know if I'm in the wrong place.

We have the problem of hackers trying to submit forged payment requests. They return the url /checkout?payment_failed=1 when their attempts fails.

How can we block their ip IF they visit that url more than 3 times?

Many thanks in advance.

Hi.

After upgrading machines that uses CSF to cPanel v92, this notification started coming every second:

lfd on host.domain.com: SUDO login alert - Successful login from wp-toolkit to root

Setting Account Tracking to root or even disabling it seems not to work.

The binary has been whitelisted in pignore.

What could be done to stop this notification as it clogs the pipeline and eats up email...

Hi I am trying to configure lfd Clustering in csf, however the fields are all gray outed and unable to fill any number.
I use cPanel + immunify360.
Has anyone overcome same issue? :confused:

I have an email address that is repeatedly checking my server, but that account is invalid (non-existant account), and I know that the person doing it is not malicious, but only stubborn for not updating their settings, can i skip that email address from being checked by CSF and dont block their IP?

I use directadmin by the way.

Good morning,

Is there a way to rate limit efficiently cPanel account with daily limits with ConfigServer Mail Queue ?

In csf.conf I have
LF_IPSET = 1
LF_IPSET_HASHSIZE = 1024
LF_IPSET_MAXELEM = 65536

I have several public blocklists enabled, namely ABDE, BDEALL, SPAMDROP, etc., all of which have been working correctly on csf with ipset for several years. At this point, I don't recall precisely what I had to do to set it up initially. I thought all I did was uncomment a line in /etc/csf/blocklists to enable...

Good morning,

Is there a way to check if From header matches authenticated user and block via MailScanner or OSM if it is not matching?

Thanks in advance.

I have private custom ipset-managed blocklists on my system that get wiped out whenever csf is restarted,because, of course, csf is unaware of them. This poses a management problem.

Is there some way to inform csf of the existence of these ipsets? I am only aware of the support in /etc/csf/csf.blocklists, which is geared entirely to public lists dowloaded from external URLs.

The kind of...

Hello Everyone,
Does anyone know if CSF process is monitored by Cpanel server manager? As some mornings i find CSF randomly stopped i want to make sure that the service restarts should this happen?

Thanks

Rockyuk

Am I getting the error below after last update, anyone else?

UPGRADE:
Tue Nov 10 16:17:08 2020:
1605035828_pre_v14_08_upgrade

ERROR:
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Error: Error processing command for line (6 times): , at line 866

I enabled LF_IPSET and WAITLOCK, but it didn't work.