ConfigServer Community Forum

csf: v14.16

Geolocation not working with maxmind:

root@server # grep -R 176.80.0.0
zone/es.zone:176.80.0.0/13
Geo/ip2asn-combined.tsv:176.80.0.0 176.80.255.255 3352 ES TELEFONICA_DE_ESPANA
Geo/dbip-country-lite.csv:176.80.0.0,176.87.255.255,ES
Geo/GeoLite2-ASN-Blocks-IPv4.csv:176.80.0.0/16,3352, Telefonica De Espana
Geo/GeoLite2-Country-Blocks-IPv4.csv:176.80.0.0/13,2510769,2510769,,0,0...

Running ConfigServer Security & Firewall - csf v14.16. today the caf will not open in Cpanel.
running Cpanel 102.7
I have tried every troubleshooting tip I could find. I have disabled,
reenable, restart, rebooted but the program will not open in Cpanel it just spins and spins
I get NO warnings or errors appearing.
all I can do is run commands on the terminal. Does anyone have a suggestion or can...

Hello,
Emails as a basic notification system is not enough and even not-contemporary, definitely.
Same messages sent to own log file at-least allow to write own parsing script to process the ones.
It should not be so difficult to implement, I hope...just add two options to /etc/csf.conf
SEND COPY of email body to own log file = 0(not) / 1(yes)
OWNLOGFILEPATH = /var/log/path/lfdown.log/
+ add a...

Accidentally deleted the email, is there any way to recover it or see the history?

Is there any update for version: ?

Thanks in advance

Hello team,

I am using cyber panel to handle my server and along with csf services to secure the server but the server is not getting to SMTP services when csf is enabled on the server, I disabled csf services and tried connecting my WordPress to SMTP services and it worked, I want to use csf services for my server because one service to secure the server, I heard good feedbacks from others...

Hello
maybe a source of confusion.
In Mailcontrol / Search form the Search from Address does not search in the From: header as maybe spontaneous interpreted,
but does search in the Received: header
This is logic with

where is explained that
(..) the address added by the mail server when the email is received during the SMTP protocol exchange. It never uses the From: header field in an email...

Hello,

A few days ago I start getting bounce backs from emails i never sent so i log in to Cpanel to see what is happening.

I look in the Mail Control section and see all these emails generated from my server and all messages marked Blue indicating Not Scanned.

First thing I did was change email password but that did not help.
I created filters on theaccount that worked for a few minutes till...

Hello,
Webmin Bandwidth monitor module reads from file
/var/log/bandwidth
records like
Feb 17 07:00:30 condor3949 kernel: BANDWIDTH_IN:IN=br0 OUT= MAC=ff:ff:ff:ff:ff:ff:d4:5d:64:ab:80:8e:08:00 SRC=148.72.175.248 DST=148.73.156.235 LEN=49 TOS=0x00 PREC=0x00 TTL=128 ID=21965 PROTO=UDP SPT=50799 DPT=32412 LEN=29
These records produced by IPTABLES settings
-A FORWARD -o br0 -j LOG --log-level 7...

Hi,
I have ModSecurity 2.9 and OWASP Rule v3.3.0 running on my box Cloudlinux/nginx proxy/Apache 2.4 (+mod_remoteip)
Some rules ban IPs on CSF , other rules just block on moddesc and no CSF ban...
i have all triggers correctly in apache logs and correct setup in csf
MODSEC_LOG=/usr/local/apache/logs/error_log
LF_MODSEC = 5
LF_MODSEC_PERM = 1

is this a normal behavior? i need to edit some...

Hi,
I have a client with 5 sites on a server. She logs in to all 5 one after another in few minutes.
That behaviour cause csf to block her IP as a login attack even though she login once to each site.
Is there a way to let csf count the login of each site separately?
I white listed her IP but that is not a good solution since her IP is dynamic.
I tried to find an answer here but no success....

Hi,
I'm looking for a way to get the information pushed to an email address (if not directly to a webhook) as soon as a specific file size changes.

I found a way to do something similar - using the lfd Directory File Watching as mentioned here and also mentioned here .

I configured the relevant email address as described here - and I started getting the email alerts - The problem is that I get...

On a VPS running current WHM and CSF/LFD:

Time: Fri Feb 11 18:01:06 2022 -0500

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/bin/mysql_install_db: FAILED
/bin/mysql_install_db: FAILED

Time: Fri...

Hello,

We've been having trouble with Mailscanner getting disabled every night for no apparent reason. Checking all the logs we can find returns no clues as to why it has been disabled.

Mailscanner is still running but shows as disabled within MSFE. Hitting the enable button returns:

mv: cannot stat '/usr/msfe/mailscannerq.conf.disable': No such file or directory
Redirecting to /bin/systemctl...

Hi,
I have some entries in apache log but csf do not want block it.

my csf setup is:
LF_MODSEC =1
LF_MODSEC_PERM=1

an example of hit:

ModSecurity: Warning.
Pattern match \\\\$+(?: *|\\\\s*{.+})(?:\\\\s|\\\\ |{.+}|/\\\\*.*\\\\*/|//.*|#.*)*\\\\(.*\\\\)
at ARGS:trend_format .
[data Matched Data: $s (%2$s) found within ARGS:trend_format : %1$s %3$s (%2$s) ]

, referer:

how can i fox it?

Good morning,

Is there any API or CLI command to disable MailScanner storing messages? At this time, I know only the way using MSFE > MailControl Performance.

I have installed Shadowsocks client (for SOCKS5 proxy) and Privoxy (for convert socks5 to http proxy) on Centos 7 (I use cPanel).

SOCKS5 is running on 127.0.0.1:1080
Privoxy is running on 127.0.0.1:8118

When the CSF is enable, the socks5 and http proxy don't work:

# curl --socks5 127.0.0.1:1080
curl: (35) Encountered end of file

But when I disable CSF (csf -x), It works:

# curl --socks5...

i need to exclude single email login with same To header from distributed attack / permblock

this is sample exim log line
1nBXpM-000DFy-Nx for email@domain.com

if i add this code to csf.logignore should work ?

^.*dovecot_login:email@domain.com.*for email@domain.com

Hello
The spamassassin / mailscanner and configserver mailscanner FE do need some serious processor power.
Has someone find a config / work about, to have the mailaccounts etc continued to be managed by the CPANEL server,
but have the mail send (via secure connection) to a separate server to have there the spamassasin / mailscanner and mailscanner FE work done
before being sending back to the...

Hello friends.

How can we block sites like hackertarget.com/reverse-ip-lookup and host and block all domains on one IP address?

Is there a way to block it through CSF/LiteSpeed?