This forum is only for reproducible bugs with csf and lfd (i.e. not iptables problems, lack of understanding how to use a feature, etc). Posts must be accompanied with full technical details of the problem and how it can be recreated. Any posts not adhering to this, or not considered bugs, will be moved to the General Discussion (csf) forum.
Recently I enabled LF_Netblock for Class C and NetBLock Count=2 after seeing many scrapers/bots coming from the same networks. I also enabled notifications.
After restarting CSF/LFD I got my first notification (as expected) in minutes.. Then, it went silent, not blocking any other Class C's even though in the logs I could see many hits that should have triggered a NetBlock.
Using csf v8.21 (cPanel) on CloudLinux 6.7 I am given a warning when trying to deny (-d) an ip address if I use an address raised on a local interface however I am not given a similar warning when trying to tempdeny (-td) the same address. Is this behavior to be expected or should there be similar checks done by the tempdeny (-td) option?
So this has started hitting us after the latest update (v8.20).
What is happening is that our LFD is stuck in a restart loop. This is due to a misconfiguration in the csf.conf value GENERIC on our side combined with a logic error in lfd.pl. We had this value set to 1 (probably due to our use of clustering and it copying from a server that didn't have cPanel installed).
This bug is back in version 8.16. The current problem is that if you have a DENY_IP_LIMIT set when an IP address is pushed out of the list it is not being removed from /var/csf/csf/tempip. Since the record has the PERM flag set the bad IP address will never be banned again. Here's the code from CSF that removed the IP address from /etc/csf/csf.deny:
Following a few spam episodes gone undetected by the Relay Tracking in CSF/LFD, we have determined that mails sent from cPanel Webmail are not tracked at all by CSF/LFD.
Relay Tracking is working for mails sent from email clients (we have tested this). But mails sent from Webmail are not tracked. We have tested this with all the email software in cPanel (Horde, RoundCube and Squirrel)...
Though regexes for port-scan detection at the start of pslinecheck are OK, a couple lower down do not allow for the square brackets which can follow the kernel: prefix. I can't remember now whether I was experiencing too many or too few blocks, but something wasn't working for sure! The patch below fixes it. I hope you're able to include this or a similar change in CSF/LFD.
Hoping someone can help point me in the right direction...
I've developed a solution to generate a global list for both allowing IP's & denying IP's. Populating the csf.gdeny works perfectly, every seven (7) minutes the server calls for the file reads it and blacklists the IP's.
Unfortunately, the server does not seem to be releasing IP's that have been removed from the list. csf.gdeny no...
we're mounting a backup drive over NFS on a private network. This network is connected through a separate VLAN on a failover bond with two interfaces. When I add bond0.821 to csf.conf:ETH_DEVICE_SKIP I get this error message on csf -r :
*WARNING* ETH_DEVICE_SKIP device not listed in ifconfig
*WARNING* RESTRICT_SYSLOG is disabled. See SECURITY WARNING in /etc/csf/csf.conf.
root@host03 #...
Do not check double of the added IP address (-p port).
csf -td 89.222.186.1 -p 80
DROP tcp opt -- in !lo out * 89.222.186.1 -> 0.0.0.0/0 tcp dpt:80
csf: IPSET adding to set
csf: 89.222.186.1 blocked on port 80 for 3600 seconds inbound
csf -td 89.222.186.1 -p 80
DROP tcp opt -- in !lo out * 89.222.186.1 -> 0.0.0.0/0 tcp dpt:80
csf: IPSET adding to set
csf: 89.222.186.1 blocked on port 80 for...
Whenever changes are made, applied (via Change ), and you select the Restart csf+lfd option (button) the GUI crashes and cannot load. Here's where it gets interesting.
If you do systemctl restart csf.service and systemctl restart lfd.service no dice still.
For some reason you have to revert back to the old service csf restart and service lfd restart to bring the GUI back online as systemctl...
Recent integration with systemd doesn't work properly on latest Debian Testing, which results in broken startup and lack of lfd after update.
In the log, we can clearly see that:
„lfd.service” -> „/usr/lib/systemd/system/”
cp: nie można utworzyć zwykłego pliku „/usr/lib/systemd/system/”: Nie jest katalogiem
„csf.service” -> „/usr/lib/systemd/system/”
cp: nie można utworzyć zwykłego pliku...
In csf ver 7.59 on CentOS 6.6 with WHM 11.46.2 (build 4), when we try to compare profile configurations by selecting protection_high as first config and /etc/csf/csf.conf (current config) as second config, it doesn't show anything! However, if we select protection_medium or protection_low, it then shows the table of comparision. Is this a bug or are we doing something wrong?!!
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum