ConfigServer Community Forum

Hello!
Help me please to get rid of hundreds firewall messages in bash, like this:

New messages appears every few seconds, so in a minute screen is full of them. It's hard to type any command in bash.
Is it possible to redirect output of this messages to some log file instead?

Thank you!

How an I increase the RSS Memory size? Running on WHM/cpanel

Time: Wed Mar 10 07:12:25 2021 -0500
Account: xx
Resource: RSS Memory Size
Exceeded: 501 > 256 (MB)
Executable: /opt/cpanel/ea-php73/root/usr/bin/php-cgi
Command Line: /opt/cpanel/ea-php73/root/usr/bin/php-cgi /home/xx/public_html/wp-cron.php
PID: 5945 (Parent PID:30682)
Killed: No

Hi there. Lately I was getting a lot of errors like
*Error* pid mismatch or missing, at line 1160
daemon stopped
This error is caused by trying to block some IP address, which triggered csf of lfd rule few times in a row. After that csf is disabled, but it was reenabled by cron job, which monitors services state

This is from lfd.pl (including line 1160, where an error is triggered)
while (1)...

Hello,

we have a server that needs to be able to access mysql with the root user.

We have blocked port 3306 globally.

And allowed the authorized IP in csf.allow with the following format:
tcp|in|d=3306|s=x.x.x.x

We check that it works fine, but we have found a strange log:

cat /var/log/mysqld.log | grep Access denied
2021-03-03T09:27:40.493517Z 574416 Access denied for user...

Hi

We tried to install csf on a server running the Ubuntu 18 system and you blocked countries from accessing the server
But it appears that the server works in countries that have been blocked

I don't know what the problem is

What was applied to the composition:

1-===========

dpkg --configure -a

2-===========

cd /usr/src
rm -fv csf.tgz
wget
tar -xzf csf.tgz
cd csf
sh install.sh

3...

I try to set restriction to user and not general SMTP restriction.
As I understand SMTP_BLOCK should be ON and additional per user
2. SMTP_ALLOWUSER XXXuser

Is this correct?

Hello,
I am new using ConfigServer security & firewall and can use some guidance.

I am trying to set it up so that I receive alerts when certain actions take place for example when the server load is high.

My first question is can alerts only be sent via email? Or are there other ways of sending alerts such as SMS or post to url?

Can you point out where in CSF you specify these settings, for...

Hi
i am working IPTV and i need the the firewall for my main server
but i have some question
1. CFS can block DDOS attacks?
2. Do I need a dedicated server for firewall? i don't want run it on main server
3. has CFS any monitoring panel for delete ip or add ip and check statues during attacks?

Hallo
I use Juggernaut Danami's overlay for CSF ,
I'm using it on Debian 10 and Plesk, everything seems to be working fine
except for one thing: Custom Login Failure Triggers but only for MSQL
others work very well

What I know and it works is:
Login error logs are saved at /var/log/mysql/error.log

2021-02-26 10:33:06 49476 Access denied for user 'dsd' @ 'localhost' (using password: YES)
regex...

Hello and I hope everyone is healthy and safe.

I manage a server which gets a lot of malicious hits from outside US. I use CC_DENY which works well. However, as mail is being sent out and oftentimes some foreign recipients do a dns check for dns on the server, it is also blocking that which degrades service.

What must I do to continue to use my CC_DENY list whilst also allowing foreign dns...

Hi! hope this message finds you well. For the last 2 weeks, we have been in a problematic situation, we have designed a custom website 2 months ago but from last 2 weeks, we have noticed unauthorized access to our website which is having a big impact on our general and real visitors. for example the slow loading to our page.

Good morning,

I wish to rate limit by outgoing trafic using some IPTables rules like this:
iptables -A OUTPUT -m hashlimit --hashlimit-upto 5000/sec --hashlimit-burst 10000 --hashlimit-mode dstip --hashlimit-name loutput_ip --hashlimit-dstmask 24 -j RETURN

If I just add these rules in IPTables, will it break CSF? Or is there a way to add some custom iptables rules inside CSF?

Hi :confused:

I noticed this content mentioned on readme
Local IP addresses cannot connect to the UI (i.e. all IP addresses configured on the server NICs)

That seems as asking feathers from tortoise but reasonable to me and my favorite firewall. you guys can give me a feather :cool:

I dont want to go through public IPs to access to GUI often So i'm asking is there any trick or workround to...

Hi,

I customized blocklist and add some urls like this:

and:

But after restart the csf, it tries to download this list but final file size on /var/lib/csf/csf.block.NAME will be 0 byte for such url
although for others is ok

Appreciate for any help

Hi,

I am blocking China via CC deny plus some manual rules as well, but some connections are still getting through.

It appears blocking is active as a csf grep for the IP address shows it as blocked:

csf -g 111.202.101.113
No matches found for 111.202.101.113 in iptables
IPSET: Set:chain_DENY Match:111.202.101.113 Setting: File:/etc/csf/csf.deny
IPSET: Set:cc_cn Match:111.202.101.113...

Hi Everyone,

I am getting a lot of spam from quite a large US hosting company, Eonix, it seems they are a spammers paradise from what I can see.

I can get a list of all their IP's

I would like to some how create my own custom RBL list with all their IP's on if that possible? I dont want to totally block the emails just assign them a high SA score.

What is the best way to do this in...

Hello,

in csf.pignore

instead of this:

exe:/opt/cpanel/ea-php56/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php70/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php71/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php72/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php73/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php74/root/usr/bin/lsphp

can I add this?

exe:/opt/cpanel/ea-php*/root/usr/bin/lsphp

Thanks!

Hello,

I am having trouble with this. Please can someone help me with the custom Regex. I tried to whitelist user in pignore, but not working. Basically I dont want these suspicious file notices as they are false positive, so I need a regex or to know how to whitelist this user:...

We have dedicate server and which centos with cpanel and multiple domains hosted on it

Our dedicate ip is 95.216.42.246

We have installed csf firewall on it

We are getting issue since 2 weeks

our ip get blacklisted again again

on CBL and spamhaus and they give reason as given below

Technical details of the matsnu detection

This was detected by a tcp connection from 95.216.42.246 on port...

I apply the ports I want to open and, when restarting CSF, it opens all ports:

TCP_IN =
1:65535