ConfigServer Community Forum

The Log Scanner Report emails contain lines of data from the log that appear to be continuations of previous multi-lined log entries.
It appears that the format of the log entries looks like:
-------------------------------
begin with the date/time in brackets
a space
the type of log entry ( info, warning, error)
a space
a source ( program or procedure ) of the log entry in brackets
a...

Hi,

I'm finishing new adaptation of CSF to Webmin. I just found a small bug that breaks the table output:

Deny Server IPs->Change (this button's container is `td` and it has `colspan= 3 ` when it has to be `colspan= 2 `)

Hi,

In Webmin in all themes AJAX requests (Watch system logs and etc) return header and image, plus broken CSS and the loader is always spinning.

Please confirm.

Hello,

I've got CSF and LFD csf v9.11 running on my VPS server without problems until a couple of weeks now.
Every couple of hours or sometimes a day LFD create a zombie defunct process on my Directadmin vps server.
When i restart LFD the zombie is gone a couple of hours but then its back again. Is this a bug in LFD?
Is there a way to debug LFD or do you have any idea where to look and to fix...

I noticed that the Log Scanner Report is not sent on a daily basis as it is configured. So one day i receive the report the other day I do not receive the report.

I observed this behaviour on two servers. I already removed CSF and re-installed it but no way. It still sends the reports randomly.

Checked also the crontab list but did not find any abnormalities.

Do you have any idea where to...

Hi,

LFD sends fixed 0 as timeout to the cluster members:

/usr/sbin/lfd line 7496:
if ($config{CLUSTER_BLOCK} and $config{CLUSTER_SENDTO} and !$cluster) {&lfdclient($perm, ,$ip, $port , $inout , 0 )}

It shoud be:
if ($config{CLUSTER_BLOCK} and $config{CLUSTER_SENDTO} and !$cluster) {&lfdclient($perm, ,$ip, $port , $inout , $timeout )}

I'm using csf:v9.11

Regards,
Csurgi

Sometime yesterday CSF firewall stopped logging AUTHRELAY alerts and stopped sending notifications. I updated to the latest version of CSF but that functionality is still missing.

Hello,
csf -t does not show port:

$ csf -c
csf is already at the latest version: v9.10

$ csf -td 1.2.3.4 -p 22 Comment: TEST
DROP tcp opt -- in !lo out * 1.2.3.4 -> 0.0.0.0/0 tcp dpt:22
csf: 1.2.3.4 blocked on port 22 for 3600 seconds inbound

$ csf -t

A/D IP address Port Dir Time To Live Comment
DENY 1.2.3.4 in 59m 56s Comment: TEST

Of course the command successfully done in the...

Dear Support,
after updating to csf v9.10 custom regex rules stop triggering regex.custom.pm
i use centos 7 with plesk and mod_Security

regex.custom.pm rule:
if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /(\S+) - - \ (GET|POST) \/ HTTP\/\S+ \d+ \d+ \S+\s+ \S+ \(compatible\; (MJ12bot|Baiduspider|AhrefsBot)\/\S+ \S?http\S+\) /)) {
return ( GET POST HEAD Attempt From: $1 ,...

This is actually in reference to another bug that was recently fixed.

9.07 - Fixed removal of complex allow and deny rules

It appears that these changes are preventing complex rules from being removed when using the IP address itself. This complicates things when iptables rules generated for LFD automated blocks are entered. As an example:

tcp|in|d=2078|s=1.2.3.4 # lfd: (cpanel) Failed...

Hi,

Its look like there come some problems when my installation upgrade to 9.07

cPanel Monitoring
Jul 05 13:57:29 web1.myserver.com systemd : Starting ConfigServer Firewall & Security - lfd...
Jul 05 13:57:30 web1.myserver.com lfd : Error: You have an unresolved error when starting csf. You need to restart csf successfully before starting lfd (see /etc/csf/csf.error)
Jul 05 13:57:30...

Hello,

Recently I enabled the IPv6 support in my office and because of that I decided to also start to enable IPv6 support on my servers too.

But after I configured everything I notice that the connection to ports that are in CC_ALLOW_PORTS_TCP are always going through IPv4 and never through IPv6. So I listed in IP6TABLES and IPTABLES I notice that the Chain CC_ALLOWPORTS is empty in...

Did the new updates break csf -ar and csf -dr functionality? They don't appear to be working for me.

Hello,

At the end of a fresh installation I get the message :

*Error* File does not exist: at /usr/sbin/csf line 1941.

Here see the version of my system :

*** Viewing versions of system software components (VM=wtest-99) ***
System : Ubuntu 16.04 LTS
Kernel : 4.4.0-24-generic
Language : en
iptables : 1.6.0
csf : 9.05
Apache : 2.4.18 (compatible TYPO3 6.2.x and 7.0.x)
Bug or mistake...

Dear Support,

i have multiple Servers, all with CSF/LFD + CXS working on Cpanel.
After Updating the Mod_security LF_MODSEC Trigger no longer working (no IP ban on configured Trigger)

I have CPANEL/WHM, 56.0 Build 24 on CENTOS 6.8 x86_64 running on Servers.
I use classic Apache/2.4.18 compiled with EasyApache3 under CP.
I run common Atomicorp Modsec Rules Subscriptions on Servers.

In classic...

We have a few resellers setup as follows:

XXXXXX:1:USE,UNBLOCK,GREP

After the upgrade to 9.x they try to unblock but it does not actually work. On the web page they get the CSF manpage. In the email we get the search for the IP, it not getting unblocked and then the CSF manpage.

Thanks for looking into this

In the server I have set:
RESTRICT_SYSLOG = 3
LF_TRIGGER = 0
LF_TRIGGER_PERM = 1
LF_SELECT = OFF

LF_EXIMSYNTAX = 10
LF_EXIMSYNTAX_PERM = 3600

LF_IMAPD = 10
LF_IMAPD_PERM = 1

But even with that set, /var/log/messages shows, please note that I don't have those IP white listed:

EXIM SYNTAX, ignored:
Jun 13 12:23:07 serverX lfd : Exim syntax errors from 123.123.123.123 - ignored
Jun 13 12:25:18...

Hello,

There is a problem in removing IPV6 with double colon at the start or end of IPV6 from csf.deny or csf.allow

Line 1339 and 1424 of csf.pl, it seems \b is not compatible with some IPV6 in the perl regular expression.

Regards

#### Tested on CentOS 7 - Perl v5.16.3

$ csf -c
csf is already at the latest version: v8.26

$ csf -d 2001:41d0:1000:f6a1::
Adding 2001:41d0:1000:f6a1:: to...

Hello,

current version (8.25) does not install /etc/init.d/lfd in systemd systems so the following command is incorrect:
/etc/init.d/lfd restart
You should make some change in the installer to install a compatible cron job like:
systemctl restart lfd.service

Regards