ConfigServer Community Forum

The setting LF_MODSECIPDB_FILE suggests /var/cpanel/secdatadir/ip.pag, but there's no such file in that folder. I also checked all the suggested folders in the setting, like /tmp, couldn't find ip.pag anywhere. But I did find cpanelusername -ip.pag in the folder /var/cpanel/secdatadir/

Is that the file LF_MODSECIPDB_FILE is asking for? If it is, how do I handle this situation? It appears that...

I have been trying to get iOS Mail Push Notifications working. The first step was getting the expired certificate renewed.. After much work, that got done. But Push still wasn't working. I read here:

that I would have to ad port 2195 to TCP in CSF which I did, for both IN and OUT. But that hasn't helped. Is it possible there is another CSF configuration preventing Push Notifications?

/var/spool/MailScanner/quarantine/20190916/nonspam has 1,984 messages in the folder.

Anyone know how I can find out why they weren't delivered and what needs to be done to get them delivered?

I am running Mailscanner Front-End 8.27 on cpanel v82.0.15

Hello, last night WHM updated itself to v82 and I started getting emails that mailscanner is not working, a quick google search brought me to this:

I updated the scripts on the server via this: curl -sL | perl

but i am not still getting emails from WHM saying that mailscanner has failed, what can I do?

Hi,

I setup MAILX via gmail for notification alert sending.

How to use this to send CSF alerts too ?

I am seeing this on one of our installs:

Web upload script path : /home/csf/public_html/wp-content
Web upload script URL :
Remote IP : 111.111.111.111
Deleted : No
Quarantined : Yes

NOTE: does not exist on this server. However, ModSecurity is still triggering cxs to scan the attempted uploading of potentially malicious data

What is causing csf to populate instead of the username of the...

Hello, Sarah.
Could it be possible that when we try to block an IP with MailControl, the first POP UP show us if the IP is already blocked?

Until now, if I a see an spammer IP and I want to block it, I click on the red circle, it brings a POP UP with all the info about the IP and a line where I can modify the text of the block.

But some times it happens that the IP that I want to block is...

hello
he has a problem
The site does not send mail
But when you disable *ConfigServer Security & Firewall*
Mail works normal
I use Gmail SMTP

Hi,
I installed CSF Messenger. Everything seems fine. Recaptcha page is working too. When you validate with clicking i'm not a robot button, it says ok.

But when I click Unblock button after that it shows an error.

There has been a problem: Unable to verify with Google reCAPTCHA

I tried almost everything, but it doesn't validate somehow. What could be the problem?

Hello,

When cxs ModSecurity Scanning enabled on a directadmin server which has got openlitespeed with comodo waf, does cxs work?

Anyone knows that are compatible?

Thanks

Could someone kindly point me in the direction of more information regarding the MySQL Data Collection feature? It looks like an interesting feature, based on the description in the config, but it doesn't provide much detail and I'm having configuration challenges.

ST_MYSQL =
The following options are for authentication for MySQL data collection. If the password is left blank and the user set...

When the Watch System Logs page loads, the refresh function is automatically set to five seconds. I rarely find the auto-refresh helpful as I typically am scrolling up through the logs and lose my place when it refreshes.

I've been wanting a feature request for a switch to disable the auto-refresh either on the page or in the config. This could also include customization of the refresh...

I'm trying trying out CSF using vagrant to test out how it works and testing out the configuration I need to do before I apply to my actual VMs.

I deployed two sandbox VMs. 192.168.33.10 (with CSF) and 192.168.33.11 (VM that will try to brute force SSH to 192.168.33.10)

Given /etc/csf.allow

10.10.10.10
192.168.33.1
172.16.1.1/29
192.168.33.11

And /etc/csf.ignore

127.0.0.1
10.10.10.10...

I keep seeing dozens, sometimes hundreds of class B or C IP's coming to the server with 1 connection with no real performance impact. I never let them stay connected long enough (or they don't) to dig deep into what they are actually doing (I need to thought).

My question is, is there a setting in CSF to watch for a scenario like this and block that B or C class block. This latest one is from...

Hi,

We are facing last 1 week our multiple server frequently 443 port is not accessible, When ever port is not accessible once we restart csf then its start working.

Please help us what was the issue and how we can fix it in all the server?

Hi all,

I have started to receive emails from my server like a week ago about suspicious file running on my server. This is an example email sent to me by CSF.

lfd on frodo,.em4hosting.com: Suspicious File Alert

File: /tmp/f7d5859d3fd2dc6
Reason: linux binary
Owner: em4hosting:em4hosting (1003:1005)
Action: No action taken

The system keep sending the same mail several times a day. How can i...

I had issues with a weird attack so I've installed mod_qos on a cPanel server.
It seems to work:

# cat /var/log/apache2/error_log | grep qos
AH00489: Apache/2.4.39 (cPanel) OpenSSL/1.0.2s Apache mod_bwlimited/1.4 mod_qos/11.63 configured -- resuming normal operations
AH00489: Apache/2.4.39 (cPanel) OpenSSL/1.0.2s Apache mod_bwlimited/1.4 mod_qos/11.63 configured -- resuming normal operations...

We are trying to cut down on the number of emails of logs that we receive and are attempting to move everything to pipe all logs from a stack to papertrail. Is it possible to do this for the csf, lfd, cxs, rootkit logs?

Hi.
I use a lot the CMC and the page to see the LOGs, I think it needs a new design. Something like the one that you do with MailControl.

Right now I only can see one or two lines of the log as all the header is so big and consumes a lot of wasted space.

Can you, please take a look at this.

Best Regards,
Sergio

Hello,

I want to config my CSF on Debian to block failed logins for Wordpress websites.

I have a lot failed logins everyday and Im wondering how to block it as if 10 logins failed IP is blocked for several days.

This will help me to solve spammers attack to my websites on Wordpress.

Can you give advide which settings should I change and what values will be good for that case?

Kindly...