ConfigServer Community Forum

Mailscanner and calmav are doing a decent job of blocking a recent wave of virus.
But is it possible to have the IP blacklisted in CSF once a vrus has been detected.
This might slow down sebsequent receipts for a short while.

I did see that i may have been possible many years ago, but don't see this feature today.

I am running a server to provide DNS to my public IP subnet. I want the server to be able to get NTP, OS updates, send email, etc, but only allow incoming tcp/udp/53 from my public subnet. My goal is to block all incoming requests and only allow DNS requests incoming from my subnet 1.2.3.0/24.

Since by default it blocks all and only allows ports I open, I believe it have the ports configured...

I have really weird issue i installed csf to a new server. when user run pm2 to run node app. it runs successfully as soon as the user logout of the cpanel the process disappear.

kindly note that this only happen with cpanel user if i run the command with the root and log out it will work fine

Hi, Is there a way to permanently set up an email to receive warnings about firewall attacks or problems that could endanger the system?
I'm new to ConfigServer firewall & security, so I need to share your experience.
Thanks!

CC_ALLOW_FILTER not working.

# An alternative to CC_ALLOW is to only allow access from the following
# countries but still filter based on the port and packets rules. All other
# connections are dropped

OS: AlmaLinux 8.5 cPanel 102.0.14
also using it with Proxmox Virtual Environment 7.2.
Debian 11.3 Bullseye but using a newer Linux kernel 5.15.30,
QEMU 6.2, LXC 4

Both are using- CSF Version:...

Hello

I need to block all UPD traffic for one host on server. How can I do that ?

Regards

Reinstalled MSFE after server reload
However MSFE is showing blank screen
CPanel 102.0.12

Anything that needs to be adjusted?

Hi,

I have just installed CXS in my server

1) How do I check that CXS does not delete or blocks infected files from websites found in the daily/weekly scan? I want to be alerted by email but no that the files are deleted or quarantied

2) Can I perform a manually scan when I want for ALL the sites? The same questions biy apply the scan for ONE domain?

Thanks,
Francisco

When doing Learn as Spam & Report to learn and report multiple messages, I occasionally get this error on a few of the messages:
SpamCop report to vmx.spamcop.net failed: Net::SMTP error

How can I best debug this and investigate it further? Perhaps there is a more verbose logging option for the spamcop reporting portion that I can use?

I could not access my sites so I used a VPN to see what is wrong and I discovered that my own IP was listed as

temporary Blocks: IP:xxxxxxx Port: Dir:in TTL:3600 (lfd - *Port Scan* detected from xxxxxxx. 21 hits in the last 105 seconds)

Before that I tried 4-5 numbers in order access cpanel like domain.name:2083, 2082 etc

Hello.

We're facing an issue ever since cPanel/WHM update from v100 to v102 where SpamAssassin keeps marking domains with a DMARC record with KAM_REJECT_DMARC on every single outgoing mail. Currently we've mitigated the worst with a temporary score setting. This has its own obvious drawbacks.
Has anyone faced this issue? What was your solution? Ideally we'd like to keep outgoing spam filter, but...

I keep receiving the following errors when trying to run CSF on my cPanel OpenVZ server.

# /etc/csf/csftest.pl
Testing ip_tables/iptable_filter...FAILED - Required for csf to function
Testing ipt_LOG...FAILED - Required for csf to function
Testing ipt_multiport/xt_multiport...FAILED - Required for csf to function
Testing ipt_REJECT...FAILED - Required for csf to function
Testing...

Hello.

I'm using cPanel & WHM v102.0.8 (STANDARD) and CSF Firewall v14.16.
Today I changed some settings: SMTP_ALLOWUSER (added another user) and also added some ports to TCP_OUT list. Then I restarted the firewall and tested the new rules. Everything worked fine.
Some minutes later, the connections stopped working. Reviewed the configuration again and found that the changes I made were lost....

Hello, I have some virtualized dedicated servers with Virtualizor with KVM , I have CSF installed and everything works fine... but every time I make a change and I have to restart the LFD and CSF the internet of the VPS KVM is blocked... I have to place the command:

/sbin/iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT

I would like to know if there is a way to make this command...

Hi.
On the Front-End Settings under Server Spam Whitelist, that I use a lot, I see that if I add a domain to the Server Spam Whitelist like this:
*@*.domaing.tld

it only allows the following:
anyword@word1.fixeddomain.tld

it doesn't allow any of the following:
anyword@fixeddomain.tld
anyword@word1.word2.fixeddomain.tld
anyword@word1.word2.word3.fixeddomain.tld

and in order to allow any of the...

Similar to existing ST_APACHE and PT_APACHESTATUS, it would be nice to be able to collect nginx and PHP FPM statistical data based on status information they provide:

# csf --version
csf: v14.16 (cPanel)

Because excessive attacks against the SMTP port, I was forced to activate the SMTPAUTH_RESTRICT to filter sending countries.

However, it shows a wrong (and worrying) behavior by blocking legitimate users from authorized countries

Steps:
/etc/csf/csf.conf
SMTPAUTH_RESTRICT = 1
CC_ALLOW_SMTPAUTH = DE,NL

exim needed mods, rebuild exim & restart. All...

Had suggested this some years back.

Would be super handy if the Email ID form field was replicated at the very top of the front-end, perhaps in the Mailscanner Service section.

The Lookup button could be optional, simply having the form submitted when clicking in the box after typing (or pasting in) the ID.

Don't know about other folks, but I primarily use search to look up by ID, based on...

We are running an Elastix SIP phone server and we have been using CSF firewall for the past 7 years with no issues. We have employees that want to start using software based phones from their mobile devices (iPhone and Android phones) to access our company phone system while they are traveling outside of the office.

How can I allow mobile phones with dynamic IP's through CSF?

Hi,
I'm using Amazon Simple Email Service to send newsletters.
If I stop CSF all works fine. If CSF is on I cannot send the newsletter (connection refused 111).
I found this old topic:
Following the hint to dig amazon url, I solve temporary the problem but after some days it occurs again.
Do you know hot to put in white list amazon service definitively?
Thank you very much