I am getting this error when restarting/reloading the CSF firewall:

csf -r
*WARNING* ip6tables nat table not present - disabling DOCKER for IPv6

This happends on 2 servers with Debian version 8. No such errors on servers with older versions of Debian.

I tired to enable the new docker support after upgrading to CSF 12.00 and remove our old csfpost.sh but I get this when I try to restart CSF on our Plesk server (using csf generic). It looks like the docker0 device isn't being passed to the new rules? In our upgraded csf.conf there was no DOCKER_DEVICE setting present in the config file.

# csf -r
Bad argument `MASQUERADE'
Try `iptables -h'...

I've just enabled MESSENGERV2 on two servers and tested it, I get this php error: Warning: file_put_contents(/var/log/lfd_messenger.log) : failed to open stream: Permission denied in /home/csf/public_html/index.php on line 69

File permissions:
-rw------- 1 csf csf 0 Feb 18 03:51 /var/log/lfd_messenger.log

I think the problem is that php runs under the user of the domain on which the error...

It seems like there is some issues with MESSENGERV2 using the wrong SSL to show the recapcha.

Thank you.

It looks like there was a change in the cPanel ACLs of 'software' to 'thirdparty' - - going from version 66 to 68. The ACL that CSF tries to set is currently 'software-ConfigServer-csf', but the 'software' ACL is no longer available.

This has broken reseller access to the CSF UI in WHM.

If any additional information is needed, please let me know.

The mod_security v2 (apache) regex (line 335 of RegexMain.pm) has a bug that prevents it from working with IPv6 addresses.

The rule matches the first block in the log entry, which contains the source port appended to the client IP. The rule does attempt to remove this source port, but only does so if splitting the IP by the ':' character returns a list of size 2. Obviously, this won't work for...

Hey chirpy,

It looks like there is a javascript error on the cloudflare UI page on CSF v11.01 which prevents the UI from working properly. In Firefox and chrome I see this in the browser console on the cloudflare UI page:

TypeError: $(...).chosen is not a function yMq3wnv0pfUc5kjFZIOxejZkGj:44:3

Once javascript breaks the code below doesn't get a chance to re-enable all buttons even...

Hi,

it is stipulated in readme.txt:

27. CloudFlare
6. URLGET must be set to 1 (i.e. LWP) must be used

the problem is that 1 is HTTP::Tiny and 2 is LWP::UserAgent

so what is the correct setting?

thanks

I think that the readme.txt is missing some info at the end?

7. To add a temporary block that blocks in csf as well as CloudFlare:

Then it ends.

Hello all,

I tried Fedora for the first time today, and CSF failed to install correctly (I've been successful with Centos for quite some time).

Basically the systemd unit files, and the binaries get placed with incorrect SELinux context. I fixed the contexts in /usr/lib/systemd/system/ before I could copy them, but in /usr/sbin they were erroneously:

unconfined_u:object_r:user_home_t:s0...

With MESSENGERV2 and MESSENGER_HTTPS enabled, any time a SSL certificate path changes (which with AutoSSL could be any time the AutoSSL process runs), the csf.messenger.conf file is then pointing to a non-existant file, which causes Apache to throw a syntax error and not start.

Unfortunately, it seems like there isn't currently a cPanel hook that will always catch every instance of an SSL...

I noticed that the new lfd_messenger.log has messenger spelled as Child Messanger :

Jul 29 00:00:03 www0 lfd : Child Messanger (HTTPS): TERM
Jul 29 00:00:03 www0 lfd : Child Messanger (TEXT): TERM
Jul 29 00:00:03 www0 lfd : Child Messanger (HTML): TERM
Jul 30 00:00:06 www0 lfd : Child Messanger (HTTPS): TERM

We noticed random servers in our csf cluster were not responding when sent DENY commands.

Restarting at cli with csf -ra reopens the port:

[ root@cp1 ~># csf -p|grep 7777
7777/tcp -/- - (9359/root) lfd Cluster Server /usr/local/cpanel/3rdparty/perl/524/bin/perl

But just a few minutes later, it closes again:

[ root@cp1 ~># csf -p|grep 7777

[ root@cp1 ~>#

There doesn't...

We have device names with a dash in them:
# ifconfig
eth-internet: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
-- SNIP --

eth-local: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
-- SNIP --

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
-- SNIP --

eth-local is a management interface and I want it to be skipped by csf, so I set ETH_DEVICE_SKIP to eth-local,...

Helo,

We just had a case that server crashed because of messenger memory usage (160+ GBs or memory)...

Here is the relevan part of the process list...

Output from ps:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 11754 0.2 0.0 280872 49724 ? Ss 00:00 2:04 lfd - sleeping
csf 11772 0.0 3.5 4917012 4678416 ? D 00:00 0:37 \_ lfd HTTPS messenger
root 14216 25.9 3.5 4915512...

Receiving permissions error via CRON on daily basis:

/etc/cron.daily/logrotate:

error: failed to open config file lfd: Permission denied
error: found error in file lfd, skipping

setroubleshoot reports:

SELinux is preventing /usr/sbin/logrotate from read access on the file lfd.

***** Plugin catchall (100. confidence) suggests **************************

If you believe that logrotate...

The Log Scanner Report emails contain lines of data from the log that appear to be continuations of previous multi-lined log entries.
It appears that the format of the log entries looks like:
-------------------------------
begin with the date/time in brackets
a space
the type of log entry ( info, warning, error)
a space
a source ( program or procedure ) of the log entry in brackets
a...

Hi,

On my system (Debian 7) the day is padded with a space when the day is a single digit.
Then this line #262 in RegexMain.pm will not match:
if (($config{LF_FTPD}) and ($globlogs{FTPD_LOG}{$lgfile}) and ($line =~ /^\S+ \S+ \d+ \S+ \d+ \ \ FAIL LOGIN: Client (\S+) /)) {

Might be a typo. It works for all two digit days.

I changed it like that and it works: ^\S+ \S+\s+\d+ \S+ \d+ \ \...

Hi,

I'm finishing new adaptation of CSF to Webmin. I just found a small bug that breaks the table output:

Deny Server IPs->Change (this button's container is `td` and it has `colspan= 3 ` when it has to be `colspan= 2 `)