ConfigServer Community Forum

Our CSF don't block udp ddos attacks.
OS: Debian10 buster.
Last version CSF has been installed.
csf.conf link:

Hello,

I have use VPS with CPanel I receive this message continuously.
I receive between 150-200 messages a day.

Time: Sat Jul 27 16:00:43 2019 +0200
Account: mailman
Resource: Process Time
Exceeded: 986557 > 1800 (seconds)
Executable: /usr/bin/python
Command Line: /usr/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:1 -s
PID: 31036 (Parent PID:31029)
Killed:...

I want to allow all ports to the US
but I want to only allow certain ports to the world. ie port 80 http, & https. incoming mail, etc

thanks
Robert Harvey

On our old servers we only every got a daily csx email if there was something to be alerted about. On our new server we get an email everyday even if there are no issues - a blank /empty email with just the command at the top.

----------- SCAN REPORT -----------
TimeStamp: Fri, 26 Jul 2019 00:00:02 -0400
(/usr/sbin/cxs --allusers --nobayes --clamdsock /var/clamd --ctime 25 --dbreport...

I'm trying to come up with a solution to get a developer that has a dynamic IP through the firewall whenever he tries to access the server. I thought I could give him access to the web UI so he could add his IP whenever it changes but that requires his IP to get access in the first place. Is there some other solution?

This option can mask a users real IP address and hinder security. You should disable WHM > Tweak Settings > Proxy subdomains

This option in WHM doesn't seem to exist anymore or has since been renamed because I'm not able to find it. Very few results for proxy with none of them to do with what I'm actually looking for.

Any ideas?

Hello,

Since csf/lfd is very important for my server security, I would like with a monitoring script to ensure that csf and lfd are both running and operational. Is there a recommended way to do this ? I am running CentOS 7.
I am thinking about:
- either parsing the output of command systemctl status csf lfd and detect that they are active, and also running for lfd.
- either parsing the output...

Did this get resolved? Did they issue an update or did you find a fix yourself?

Changes:

Regex checking expanded for determining the FTP IP address to make it much more reliable
Documentation updated to reflect the more reliable nature of the IP address
Ensure cxs UI sets permissions on cxs.defaults and cxs.ignore to 644
Added perl module check for IPC::Open3
Tidied up cxs POD documentation

Changes:

Improved PHP script detection
Added --block option to block FTP IP addresses using csf (CGI IP addresses can be blocked using lfd and LF_MODSEC or LF_SUHOSIN as appropriate)
Fixed UI rendering problems viewing Quarantine files
Fixed UI rendering problems viewing/editing Other Files
Fixed problem with viruses not being detected correctly due to changes in the stats summary

A reminder, please, to all testers who haven't expressed an opinion to respond to:

Changes:

Fixed problem with --virusscan not showing the full path to the infected file in the Scan Report
Removed option -- scripts and replaced it with --options T
Added back Suspected exploit file (h) exploit scan option
Added new option --voptions
Scanning speedups
Documentation updates
Added more...

Changes:

Modified licensing to allow for NAT'd IP addresses
Improved messaging for invalid licenses
Fixed problem with UI --options default not being saved correctly
Fixed problem with --background being applied to all functions, not purely scans

Changes:

Updated documentation if you allow files > 128MB you will need to use the mod_security directive SecRequestBodyLimit (some doubt as to whether that mod_security setting actually works)
Added new option --cleanlog to log clean Web script or FTP uploaded files (for use within cxscgi.sh or cxsftp.sh)
Added cxs logo
Added installation note that suhosin can be used instead of...