ConfigServer Community Forum

Hello,

Everyday I can see a lot of bad IP in logwatch list like that. How can I block that IP automaticly ?

From 139.162.225.221 - 1256 packets
To xxx.xxx.xxx.xxx - 126 packets
Service: echo (tcp/7) (Firewall: *TCP_IN Blocked*) - 1 packet
Service: echo (udp/7) (Firewall: *UDP_IN Blocked*) - 1 packet
Service: discard (tcp/9) (Firewall: *TCP_IN Blocked*) - 1 packet
Service: discard (udp/9)...

Hi,

Currently the ModSecurity Log page doesn't update automatically, it would be nice to have a way to auto refresh the page just like the Watch Logs feature within ConfigServer Security & Firewall.

The next improvement that would make a huge difference is simply adding a column for Status to tell us if it's a 200, 403... etc. The same way how cPanel's Mod Security Hits list has the column...

Hello. It can be done to configure Mailscanner to send email to server administrator of the Other Bad Content Detected emails but configure it to each domain?. Thanks.

Kind regards.

Hello,

I've been receiving the following nightly errors.

ERROR: getpatch: Can't download daily-26096.cdiff from database.clamav.net
ERROR: Can't download daily.cvd from database.clamav.net

Any guidance would be greatly appreciated.

Thank you,
Tim

Hi,

I tried first installing CSF from the guideline provided on your website: but this created a huge problem for us. Our server was filled up with 60k+ processes like this:

root 2398 0.0 0.0 124500 1620 ? Ss Apr27 0:01 /usr/sbin/crond -n
root 13451 0.0 0.0 222996 3648 ? S 00:00 0:00 \_ /usr/sbin/CROND -n
root 13468 0.0 0.0 113280 1200 ? Ss 00:00 0:00 | \_ /bin/sh -c /usr/sbin/csf --lfd...

Hello,

For some reason i’m getting the digest email twice each time it runs (to the same email address0. Where can i check to see how/why this happens and correct it.

Thanks in advance.

hello -

i am having trouble being able to UNblock by a specific port, in this case, 3306.

in my csf.allow file, when i have just the following:

123.123.123.123

i can certainly access port 3306 as expected.

HOWEVER when i only have the following: ( i included ALL i could think of just to see if that helped)

tcp|in|d=3306|s=123.123.123.123
tcp|out|d=3306|s=123.123.123.123...

Hello,

Please add csf.deny.bak function when we press `Flush All Block` button. Because no any warning for faulty pressing. Today I lost more than 4000 bad IP address.

Regards

Hello,

My server has a 8 domain and one mail IP. I need block all connection to this IP exept mail ports 587,993 etc. Not need whole server.

Regards,

Hello
As a server admin I would find it usefull if it was possible to interact with the MailScanner interface via an API, or via CLI commands, so some things could be scripted or integrated with existing custum user interfaces.
Thanks
Best regards,
Yves

Hello
WireGuard and Tailscale becomes used alot.
If I make no mistake anabliing it needs setting up things outside of the CSF UI or standard cfs.conf
Suggestion : integration as a checkbox option in the UI or config
Thanks
Best regards,
Yves

Would it be possible to have the From: (Header) added to the options of where to search in MailScanner FE? The number of messages that take forever to find because MSFE does not look at the From Header field is very frustrating.

In my testing I wasn't able to get the LF_BIND login failure trigger to work. After checking some Centos7 and Centos 8 servers it looks like the BIND trigger in RegexMain.pm doesn't account for the hex value e.g. (@0x7f18041004f0) that is logged in Bind 9+ servers.

Broken (Currently used):

Fixed (I just added the (?: \S+)? to add a non-capturing group that is optional):

I hope this helps!

A user submitting the wrong login details to the mail service or htaccess login can easily result in their IP address being added to the CXS reputation list. Their access to the server will be blocked, and access to other servers using CXS reputation list.

When a user reports the problem, the first thing we do is search for & remove the IP address in CSF (as I presume most server admins will...

Hey, i´m stuck.

Mailscanner is breaking my DKIM check, mailscanner disable all good. I dont know why but mailscanne ris always adding a = at the End of my text, but only on the plain text part of the email.

here is the part of the email on my outgoing mail:
Content-Type: text/plain; format=flowed; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Test3

And thats the part on the...

We have been using CSF on cPanel quite successfully for years and over the last couple of years, we have started using them on Virtualmin/Webmin servers as well. The difference we see is that while CSF is very well optimized for cPanel with lot of additional custom configuration like monitoring unwanted scripts, monitoring exim login attempts and blocking them if necessary, monitoring service...

Hello,

my /usr/local/cpanel/logs/login_log is full of failed whm login attempts from ip addresses in verry strange countrys but it looks like the attackers know the defending mechanism against this type of attack because they stop after two failed attempts and a few hours hours later they try again.

I know this would be a working as designed status as my LF_CPANEL is set to 5 so it only...

Is the intended behavior that csf /lfd will only email upon the first WHM root access from the same IP within so many hours?

I'm trying to figure out why lfd only sent one email WHM/Cpanel root access alert when I logged in and out and then in again a few times to WHM. The cpanel login_log shows all three WHM logins, but lfd only emailed once and only logged the first whm login to...

Hello, i facing a little issue, everything work fine.
but when I run a Test on the iptables i get missing modules:

Testing iptables...

Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing ipt_recent...OK
Testing xt_connlimit...OK
Testing...

whoops... silly error. I was placing my ignore commands under IP Blocking rather than process blocking ... completely missed the drop-down list of ignore options.