ConfigServer Community Forum

Good morning,

I wish to rate limit by outgoing trafic using some IPTables rules like this:
iptables -A OUTPUT -m hashlimit --hashlimit-upto 5000/sec --hashlimit-burst 10000 --hashlimit-mode dstip --hashlimit-name loutput_ip --hashlimit-dstmask 24 -j RETURN

If I just add these rules in IPTables, will it break CSF? Or is there a way to add some custom iptables rules inside CSF?

Hi :confused:

I noticed this content mentioned on readme
Local IP addresses cannot connect to the UI (i.e. all IP addresses configured on the server NICs)

That seems as asking feathers from tortoise but reasonable to me and my favorite firewall. you guys can give me a feather :cool:

I dont want to go through public IPs to access to GUI often So i'm asking is there any trick or workround to...

Hi,

I customized blocklist and add some urls like this:

and:

But after restart the csf, it tries to download this list but final file size on /var/lib/csf/csf.block.NAME will be 0 byte for such url
although for others is ok

Appreciate for any help

Hi,

I am blocking China via CC deny plus some manual rules as well, but some connections are still getting through.

It appears blocking is active as a csf grep for the IP address shows it as blocked:

csf -g 111.202.101.113
No matches found for 111.202.101.113 in iptables
IPSET: Set:chain_DENY Match:111.202.101.113 Setting: File:/etc/csf/csf.deny
IPSET: Set:cc_cn Match:111.202.101.113...

Hi Everyone,

I am getting a lot of spam from quite a large US hosting company, Eonix, it seems they are a spammers paradise from what I can see.

I can get a list of all their IP's

I would like to some how create my own custom RBL list with all their IP's on if that possible? I dont want to totally block the emails just assign them a high SA score.

What is the best way to do this in...

Hello,

in csf.pignore

instead of this:

exe:/opt/cpanel/ea-php56/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php70/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php71/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php72/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php73/root/usr/bin/lsphp
exe:/opt/cpanel/ea-php74/root/usr/bin/lsphp

can I add this?

exe:/opt/cpanel/ea-php*/root/usr/bin/lsphp

Thanks!

Hello,

I am having trouble with this. Please can someone help me with the custom Regex. I tried to whitelist user in pignore, but not working. Basically I dont want these suspicious file notices as they are false positive, so I need a regex or to know how to whitelist this user:...

We have dedicate server and which centos with cpanel and multiple domains hosted on it

Our dedicate ip is 95.216.42.246

We have installed csf firewall on it

We are getting issue since 2 weeks

our ip get blacklisted again again

on CBL and spamhaus and they give reason as given below

Technical details of the matsnu detection

This was detected by a tcp connection from 95.216.42.246 on port...

I apply the ports I want to open and, when restarting CSF, it opens all ports:

TCP_IN =
1:65535

Has anyone here created a PHP script in order to blacklist IP addresses in CSF to the Sucuri blacklist using their API as can be done with Cloudflare?

Hi,
i have a exploit i cannot remove. i hace updated website and change all password. i also try to ban ips but csx continue to report it to me. fortunately it block and send it to quarantine. i want to remove it definily if possible.tjis is a wp website

Scan Status Fingerprint
Scan Time Tue Jan 19 10:01:00 2021
Scan Type Web
Original File...

You must install ClamAV (Clamavconnector on cPanel) or ensure clamd is running to use this product correctly
If the clamd socket is not automatically detected, and to clear this message, you must set clamdsock=/path/to/socket in /etc/cxs/cxs.defaults to the live socket location

how to solve this.

Is it possible to redirect all blocked ips to a new address liked siteaddress.com/blocked to notify if a user is being blocked.

I get a lot of clients who get blocked due to incorrect email login attempts so would like to show the users they've been blocked instead of the sites showing a 500 error.

Ran into an odd issue today, CSF was reporting that it couldn't restart. This was the error in the startup logs:

Error: FASTSTART: (csf.allow IPv4) [] . Try restarting csf with FASTSTART disabled, at line 5587

I disabled FASTSTART and that did allow CSF to start, but I have no idea what that means. Any idea?

Good morning,

I have two IPs in my cPanel server, one for web purposes and a secondary IP for outgoing email. To avoid malicious things use the secondary IP, I wish to restrict this secondary IP to only SMTP ports. How can I achieve that with the CSF plugin in my cPanel?

Thanks in advance.

Hi,

Started noticing suricata alerts based on this ET.
ET DNS Query for .su TLD (Soviet Union) Often Malware Related

network.data.decoded .............ns2.magicgenericmart.su.....

UDP traffic

(..5.?._X..............ns2.magicgenericmart.su..............W. .ns1...admin..w..@...X......u.....

Exploring tcpdump to pcap gives an indication that it still hits the cPanel host even though...

I've set up CSF within Virtualmin, including the admin module successfully using the documentation instructions to the letter. Virtualmin is running on a fully patched Ubuntu 18.04.5 running on AWS with a firewall rule in AWS set to block SSH port 22 to only accept connections from my IP address, no other rules in AWS firewall. All seems to work well. Virtualmin is set up with one domain running...

I have 2 VPS both managed by WHM-cPanel
One of them is very old and works fine, while new one just installed Centos7 and cPanel.
On both VPSs run same CSF v14.08.
I am facing a strange bug on the new VPS cPanel installation.
The TCP_IN: List is not applied at all
That means, what ever port i add to this list, does not open.
The List that the i get from the View Listening Ports button, has nothing...

Hi. We'd like to only allow FTP access to users who connect via a specific hostname like: portal4321.vps22.hostingserver.com.

And block everything which tries to connect to the FTP in a different manner, like ones who use the server IP or vps22.hostingserver.com directly.

Is this possible in CSF? If yes, great, how do i set it up?

Thanks!

I'm guessing this is a modsec question, but please let me know if I'm in the wrong place.

We have the problem of hackers trying to submit forged payment requests. They return the url /checkout?payment_failed=1 when their attempts fails.

How can we block their ip IF they visit that url more than 3 times?

Many thanks in advance.