ConfigServer Community Forum

If you have one particular IP address that is either dropped or accepted through the firewall that you think should not be, then you can use the new WATCH_MODE in csf.

Before enabling this option and using the CLI command to watch an IP address, check whether it is explicitly listed first using:

csf --grep 11.22.33.44

Where 11.22.33.44 is the IP address you're tracking. If that comes back...

To enable file upload scanning for web scripts, ModSecurity needs to have the option SecRequestBodyAccess enabled (as explained in the install document).

This option configures whether request bodies will be buffered and processed by ModSecurity.

You will need to ensure that other any ModSecurity rules that you have have been correctly written to deal with POST_PAYLOADS. If they have not, then...

There are two files that you need to modify to allow blocking:

For FTP: /etc/cxs/cxsftp.sh

For Web Scripts: /etc/cxs/cxscgi.sh

1. If you simply want to delete suspicious uploads, add the --delete switch to cxsftp.sh and/or cxscgi.sh

2. If you want to quarantine files, then you need to pre-create the quarantine directory, e.g.:

mkdir /home/quarantine
chmod 1777 /home/quarantine

Then you...

When you run cxs you will invariably encounter false-positives that trigger one or more of the scanning options.

We do not recommend that you simply stop using the option that triggers, rather it would be better to simply ignore the false-positive files using an ignore file as per the documentation.

The best way to generate the ignore file is to create it first, e.g.:
touch...

So long as you use the default configuration and only change the TESTING parameter in csf.conf then csf should work.

If it doesn't, it suggests a problem with the server environment (kernel, iptables or in the case of a VPS, the host node configuration of the VPS).

If the issue appears to be broken iptables connection tracking in the kernel (e.g. blocking allowed ports such as port 80 for...

1. If you're seeing legitimate spamd processes on cPanel being reported and want to ignore them, the following can be added to /etc/csf/csf.pignore:

cmd:spamd child

Then restart lfd.

2. If you're seeing legitimate awstats processes on cPanel being reported and want to ignore them, the following can be added to /etc/csf/csf.pignore:

pcmd:/usr/local/cpanel/3rdparty/bin/awstats\.pl.*...

Welcome to the ConfigServer MailScanner Front-End Forum. Please note that this thread is for general questions about the MailScanner Front-End script. If you need urgent assistance and have had us perform the MailScanner service on your server in the past, you should log a support ticket on our helpdesk at .

Welcome to the ConfigServer MailScanner Forum. Please note that this thread is for general questions about MailScanner, SpamAssassin, and ClamAV. If you need urgent assistance and have had us perform the MailScanner service on your server in the past, you should log a support ticket on our helpdesk at .

If you get iptables errors when trying to start csf on a VPS then you most likely have missing iptables modules for your VPS.

If your hosting provider wants to know how to configure iptables correctly on a VPS server, then you should point them to this Parallels FAQ and have them follow it (plus to add ip_conntrack_ftp to the list of required modules):

csf requires at least these iptables...