ConfigServer Community Forum

Wondering if someone could explain how Mailscanner handles contact forms?
Probably a dumb question but I didn't find an answer from my searches.
Have been seeing an increase of copy paste stuff into contact boxes on some sites and wondering if using Learn as Spam would affect all the contact forms sent or just the content of the forms ?

Greetings, within /etc/csf/lfd.pl, we have this little tidbit of code within the getlogfile section (between lines 2194 to 2248).

if ($totlines > ($config{LF_PARSE} * 1000)) {
my $text = *Error* Log line flooding/looping in $logfile. Reopening log file ;
logfile( $text );
if ($config{LOGFLOOD_ALERT}) {
my @alert = slurp( /usr/local/csf/tpl/logfloodalert.txt );
my @message;
foreach my...

How can we disable the passive mode that we had previously enabled as well as activate the SPI that we had disabled.
Thank you very much in advance for your help

The default CSF configuration files allow UDP in/out ports 20 and 21:

UDP_IN/UDP6_IN = 20,21...
UDP_OUT/UDP6_OUT = 20,21...

I believe this is a mistake. The FTP RFC defines it as a TCP-only protocol.

We were also unable to locate any implementation of ports 20,21/UDP in the field.

Viewing in WHM> ConfigServer Security & Firewall - csf v14.20 and it says enabled and also confirmed in lfd.log but it references mod_cloudflare which is no longer supported, so I'm using mod_remoteip. Is this integration still working? If so, how to verify?

Hello, every 5 minutes I receive this email. What I can do ? You never did this before and the configuration is the same as when you did it several years ago, I have not modified anything since then

Time: Wed Jul 10 10:31:06 2024 -0400
Type: LOCALHOSTRELAY, IPv4 localhost - 127.0.0.1
Count: 101 emails relayed
Blocked: No

Sample of the first 10 emails:
******

What I can do ?

Below is a sample of these recent attacks:
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- PCCz
juli 5, 2024 4:58f m 185.190.24.99 (Panama) Blocked for SQL Injection in POST body: Display_FAQ = 1575') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- zFlw...

Hello.

I've been trying to find out exactly what IS faststart. All I can find are references to how to start it or stop it. I can't find out within the csf configserver tech notes WHAT IT DOES?

What am I missing?

Thanks

I am attempting to lower my signal to noise ratio on LFD notices so they don't start getting ignored when I get them. For the most part I have done a decent job with the csf.pignore file for weeding out legitimate processes. However, I just got one for LiteSpeed Enterprise web server process itself, and I think it is too generic. If I ignore it as provided in the notice, I would be allowing...

Hey guys,

I'm currently trying to block all incoming traffic to my server that does NOT come from my CDN IP addresses, and I'm hoping to do that with some kind of Allowlist, while denying all others.

My only concern is that I use Atomic Secured Linux (Atomic Protector) for my mod_security rules, and I don't want to create any kind of conflicts that might exist when running two different...

Hello,

In CSF, SMTP AUTH FAILURE block the IP of user instead of USER LOGIN.

For example, a company with 10 users, if 1 of them do wrong auth failure, the IP of company is blocked.

I would like to block only the user and not the company.

Hello,
recently I used mysqltuner.pl to optimize MariaDB on my server.

Is it safe to change mailscanner database from MyISAM to InnoDB?

-------- MyISAM Metrics ----------------------------------------------------------------------------
Consider migrating 13 following tables to InnoDB:
* InnoDB migration request for mailscanner.mcp_rules Table: ALTER TABLE mailscanner.mcp_rules...

Hello,
we use CSF on several cPanel servers. It would be amazing, if CSF could send notifications as POST request to a specific URL with data in JSON, so we could gather it, store in a database and have option to display it in out customer management system and let customers whitelist (that is another part). As it is now - we receive emails and that is often very inconvenient and hard to automate...

I have validate an old server and a new server where will be installed update CSF.
It seems CSF regex.custom.pm almost completely blank.

An example:
# SECTION:OS Specific Settings
# Note: File globs are only evaluated when lfd is started
Is it automatic added settings when it is installed and restarted system like Linux and CloudLinux 8?

hi
i found bundle mailscanner version not include this fix
i patched file manually but can you update the at least at next version with this fix included ?
Thanks

We followed suggested steps to install CSF:

wget
tar -xzf csf.tgz
./install.cpanel.sh
I see it should be cd csf if you like t install.
/etc/init.d/csf restart is not executed. Which command should be set inside root access for cPanel?

The last steps is not working. How to manage this?

Hi,

I’m looking for some advice on how to achieve a specific configuration using CSF.

I have a server that is currently getting hammered by junk web traffic from a whole load of IP addresses all beginning 18.xxx.0.0/16 (where xxx can be any of about 20 values).

I had initially just blocked those ranges entirely in CSF but with it being such a wide block that’s not really feasible - we have...

Latest Debian 12

I use TMUX a lot, but lately it doesn't keep the sessions when you restart the server or if you are inactive for a long time.
I suspect it may have something to do with CSF.
Very annoying when you have configured many things.
Have to start from scratch every time.

Very grateful for help.

Hi there everybody thank you for this community and software Csf, like the title say:

Can I execute all features options of web user interface via CLI ?

Hi all,

I would like to ask if there is a feature in csf/lfd where if a user keeps running multiple queries from same IP to be banned and if I can adjust that?

I've got a website of a non profit organization with a large db and getting attacks from multiple IPs from a specific country.
I blocked the country but is a matter of time to use another country to keep going etc so this is not a...