Hello all,

I tried Fedora for the first time today, and CSF failed to install correctly (I've been successful with Centos for quite some time).

Basically the systemd unit files, and the binaries get placed with incorrect SELinux context. I fixed the contexts in /usr/lib/systemd/system/ before I could copy them, but in /usr/sbin they were erroneously:

unconfined_u:object_r:user_home_t:s0...

With MESSENGERV2 and MESSENGER_HTTPS enabled, any time a SSL certificate path changes (which with AutoSSL could be any time the AutoSSL process runs), the csf.messenger.conf file is then pointing to a non-existant file, which causes Apache to throw a syntax error and not start.

Unfortunately, it seems like there isn't currently a cPanel hook that will always catch every instance of an SSL...

I noticed that the new lfd_messenger.log has messenger spelled as Child Messanger :

Jul 29 00:00:03 www0 lfd : Child Messanger (HTTPS): TERM
Jul 29 00:00:03 www0 lfd : Child Messanger (TEXT): TERM
Jul 29 00:00:03 www0 lfd : Child Messanger (HTML): TERM
Jul 30 00:00:06 www0 lfd : Child Messanger (HTTPS): TERM

We noticed random servers in our csf cluster were not responding when sent DENY commands.

Restarting at cli with csf -ra reopens the port:

[ root@cp1 ~># csf -p|grep 7777
7777/tcp -/- - (9359/root) lfd Cluster Server /usr/local/cpanel/3rdparty/perl/524/bin/perl

But just a few minutes later, it closes again:

[ root@cp1 ~># csf -p|grep 7777

[ root@cp1 ~>#

There doesn't...

We have device names with a dash in them:
# ifconfig
eth-internet: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
-- SNIP --

eth-local: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
-- SNIP --

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
-- SNIP --

eth-local is a management interface and I want it to be skipped by csf, so I set ETH_DEVICE_SKIP to eth-local,...

Helo,

We just had a case that server crashed because of messenger memory usage (160+ GBs or memory)...

Here is the relevan part of the process list...

Output from ps:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 11754 0.2 0.0 280872 49724 ? Ss 00:00 2:04 lfd - sleeping
csf 11772 0.0 3.5 4917012 4678416 ? D 00:00 0:37 \_ lfd HTTPS messenger
root 14216 25.9 3.5 4915512...

Receiving permissions error via CRON on daily basis:

/etc/cron.daily/logrotate:

error: failed to open config file lfd: Permission denied
error: found error in file lfd, skipping

setroubleshoot reports:

SELinux is preventing /usr/sbin/logrotate from read access on the file lfd.

***** Plugin catchall (100. confidence) suggests **************************

If you believe that logrotate...

The Log Scanner Report emails contain lines of data from the log that appear to be continuations of previous multi-lined log entries.
It appears that the format of the log entries looks like:
-------------------------------
begin with the date/time in brackets
a space
the type of log entry ( info, warning, error)
a space
a source ( program or procedure ) of the log entry in brackets
a...

Hi,

On my system (Debian 7) the day is padded with a space when the day is a single digit.
Then this line #262 in RegexMain.pm will not match:
if (($config{LF_FTPD}) and ($globlogs{FTPD_LOG}{$lgfile}) and ($line =~ /^\S+ \S+ \d+ \S+ \d+ \ \ FAIL LOGIN: Client (\S+) /)) {

Might be a typo. It works for all two digit days.

I changed it like that and it works: ^\S+ \S+\s+\d+ \S+ \d+ \ \...

Hi,

I'm finishing new adaptation of CSF to Webmin. I just found a small bug that breaks the table output:

Deny Server IPs->Change (this button's container is `td` and it has `colspan= 3 ` when it has to be `colspan= 2 `)

Hi,

In Webmin in all themes AJAX requests (Watch system logs and etc) return header and image, plus broken CSS and the loader is always spinning.

Please confirm.

Hello,

I've got CSF and LFD csf v9.11 running on my VPS server without problems until a couple of weeks now.
Every couple of hours or sometimes a day LFD create a zombie defunct process on my Directadmin vps server.
When i restart LFD the zombie is gone a couple of hours but then its back again. Is this a bug in LFD?
Is there a way to debug LFD or do you have any idea where to look and to...

I noticed that the Log Scanner Report is not sent on a daily basis as it is configured. So one day i receive the report the other day I do not receive the report.

I observed this behaviour on two servers. I already removed CSF and re-installed it but no way. It still sends the reports randomly.

Checked also the crontab list but did not find any abnormalities.

Do you have any idea where...

Hi,

LFD sends fixed 0 as timeout to the cluster members:

/usr/sbin/lfd line 7496:
if ($config{CLUSTER_BLOCK} and $config{CLUSTER_SENDTO} and !$cluster) {&lfdclient($perm, ,$ip, $port , $inout , 0 )}

It shoud be:
if ($config{CLUSTER_BLOCK} and $config{CLUSTER_SENDTO} and !$cluster) {&lfdclient($perm, ,$ip, $port , $inout , $timeout )}

I'm using csf:v9.11

Regards,
Csurgi

In the csf.conf file, you have the comment:
# Allow incoming IPv6 TCP ports

... but then:
# Allow outgoing TCP ports
# Allow incoming UDP ports
# Allow outgoing UDP ports

You should update the latter 3 to:
# Allow outgoing IPv6 TCP ports
# Allow incoming IPv6 UDP ports
# Allow outgoing IPv6 UDP ports

Sometime yesterday CSF firewall stopped logging AUTHRELAY alerts and stopped sending notifications. I updated to the latest version of CSF but that functionality is still missing.

Hello,
csf -t does not show port:

$ csf -c
csf is already at the latest version: v9.10

$ csf -td 1.2.3.4 -p 22 Comment: TEST
DROP tcp opt -- in !lo out * 1.2.3.4 -> 0.0.0.0/0 tcp dpt:22
csf: 1.2.3.4 blocked on port 22 for 3600 seconds inbound

$ csf -t

A/D IP address Port Dir Time To Live Comment
DENY 1.2.3.4 in 59m 56s Comment: TEST

Of course the command successfully done in the...

Dear Support,
after updating to csf v9.10 custom regex rules stop triggering regex.custom.pm
i use centos 7 with plesk and mod_Security

regex.custom.pm rule:
if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /(\S+) - - \ (GET|POST) \/ HTTP\/\S+ \d+ \d+ \S+\s+ \S+ \(compatible\; (MJ12bot|Baiduspider|AhrefsBot)\/\S+ \S?http\S+\) /)) {
return ( GET POST HEAD Attempt From: $1 ,...