ConfigServer Community Forum

Here are the ^PT_ related settings:
# grep ^PT_ /etc/csf/csf.conf
PT_LIMIT = 60
PT_INTERVAL = 60
PT_SKIP_HTTP = 0
PT_ALL_USERS = 1
PT_DELETED = 1
PT_DELETED_ACTION =
PT_USERPROC = 10
PT_USERMEM = 1024
PT_USERRSS = 256
PT_USERTIME = 1800
PT_USERKILL = 1
PT_USERKILL_ALERT = 1
PT_USER_ACTION =
PT_LOAD = 30
PT_LOAD_AVG = 5
PT_LOAD_LEVEL = 6
PT_LOAD_SKIP = 3600
PT_APACHESTATUS =...

Good morning,

I've set weekly scan on my cPanel server with CXS. At this time, the log is stored at /var/log/cxsreports/cxs.scan . As I see, this file is erased after each new scan.

Is there a way to set a new logfile per scan (such as /var/log/cxsresports/cxs-20210517.scan ) ?

Thanks in advance.

It is possible to edit the file that sends the email to include other parameters such as:
Client IP
Page title
Because then I will know which client is doing something wrong in the system.

Original email I receive:

Time: Tue May 11 20:40:43 2021 -0300
Account: xxxxxx
Resource: Process Time
Exceeded: 1813 > 1800 (seconds)
Executable: /usr/local/bin/php-cgi
Command Line:...

I used to have this enabled and had made the necessary changes to the exim configuration to make it work. I have now disabled it in both CSF and exim configuration, and restarted both firewall and lfd, and exim. I have ports 465, 587 and 25 enabled and open for SMTP auth.

But I can't connect to the server from Apple Mail for SMTP. Apple reports: Unable to verify account name or password.

I...

Hello,

I see everyday similar action. How can I block with CSF firewall ? For example more than 50 packet per IP blocked. CT_LIMIT not help this problem.

From 205.209.159.201 - 1548 packets

Regards,

I get this alert every 5 minutes:

File: /tmp/systemd-private-c187857224034146b6d5778aa1a95646-ea-php73-php-fpm.service-Va0Oin/tmp/config.tmp.phlT82
Reason: Script, file extension
Owner: x:x (1009:1011)
Action: No action taken

What should I do about it?

Hello All,

I got all of the settings double checked to setup the CSF Cluster, I have all nodes sharing both send and receive and the firewalls are open on each, so when I cping test it comes back with pong, so communications is happening.

My test was to add an ip on a deny list and then check if that IP is on the deny list on all the servers in the cluster.
I added a comment as well, so I was...

Hello,

I have a 6 domain on me server. I need to block all icmp and ping one IP on my server. I tried this way.

icmp|in|d=ping|d=xxx.xxx.xxx.xxx

But not blocked ping, any idea ?

Regards,

Hello,

Everyday I can see a lot of bad IP in logwatch list like that. How can I block that IP automaticly ?

From 139.162.225.221 - 1256 packets
To xxx.xxx.xxx.xxx - 126 packets
Service: echo (tcp/7) (Firewall: *TCP_IN Blocked*) - 1 packet
Service: echo (udp/7) (Firewall: *UDP_IN Blocked*) - 1 packet
Service: discard (tcp/9) (Firewall: *TCP_IN Blocked*) - 1 packet
Service: discard (udp/9)...

Hi,

Currently the ModSecurity Log page doesn't update automatically, it would be nice to have a way to auto refresh the page just like the Watch Logs feature within ConfigServer Security & Firewall.

The next improvement that would make a huge difference is simply adding a column for Status to tell us if it's a 200, 403... etc. The same way how cPanel's Mod Security Hits list has the column...

Hello. It can be done to configure Mailscanner to send email to server administrator of the Other Bad Content Detected emails but configure it to each domain?. Thanks.

Kind regards.

Hello,

I've been receiving the following nightly errors.

ERROR: getpatch: Can't download daily-26096.cdiff from database.clamav.net
ERROR: Can't download daily.cvd from database.clamav.net

Any guidance would be greatly appreciated.

Thank you,
Tim

Hi,

I tried first installing CSF from the guideline provided on your website: but this created a huge problem for us. Our server was filled up with 60k+ processes like this:

root 2398 0.0 0.0 124500 1620 ? Ss Apr27 0:01 /usr/sbin/crond -n
root 13451 0.0 0.0 222996 3648 ? S 00:00 0:00 \_ /usr/sbin/CROND -n
root 13468 0.0 0.0 113280 1200 ? Ss 00:00 0:00 | \_ /bin/sh -c /usr/sbin/csf --lfd...

Hello,

For some reason i’m getting the digest email twice each time it runs (to the same email address0. Where can i check to see how/why this happens and correct it.

Thanks in advance.

hello -

i am having trouble being able to UNblock by a specific port, in this case, 3306.

in my csf.allow file, when i have just the following:

123.123.123.123

i can certainly access port 3306 as expected.

HOWEVER when i only have the following: ( i included ALL i could think of just to see if that helped)

tcp|in|d=3306|s=123.123.123.123
tcp|out|d=3306|s=123.123.123.123...

Hello,

Please add csf.deny.bak function when we press `Flush All Block` button. Because no any warning for faulty pressing. Today I lost more than 4000 bad IP address.

Regards

Hello,

My server has a 8 domain and one mail IP. I need block all connection to this IP exept mail ports 587,993 etc. Not need whole server.

Regards,

Hello
As a server admin I would find it usefull if it was possible to interact with the MailScanner interface via an API, or via CLI commands, so some things could be scripted or integrated with existing custum user interfaces.
Thanks
Best regards,
Yves

Hello
WireGuard and Tailscale becomes used alot.
If I make no mistake anabliing it needs setting up things outside of the CSF UI or standard cfs.conf
Suggestion : integration as a checkbox option in the UI or config
Thanks
Best regards,
Yves

Would it be possible to have the From: (Header) added to the options of where to search in MailScanner FE? The number of messages that take forever to find because MSFE does not look at the From Header field is very frustrating.