ConfigServer Community Forum

For some reason its seems that cluster members do not always respond properly when denying an IP address.

Cluster Ping (They all respond fine):

csf --cping
Sent request to 10.0.0.10, replied:
Sent request to 10.0.0.20, replied:
Sent request to 10.0.0.30, replied:
Sent request to 10.0.0.40, replied:
Sent request to 10.0.0.50, replied:
Sent request to 10.0.0.60, replied:
Sent request to...

I’ve a running CSF installation with messenger service on CloudLinux 8, I’ve migrated it from iptables to ipset to use blocklists, works wonderfully. But now I have a problem which I cannot solve: if I use the variable CC_MESSENGER_ALLOW and enter any country code or more then I can no longer reach the messenger (v3) page from a blocked IP. I have made sure that CSF recognizes my country...

After enabling CT_LIMIT on a Centos 8 server I started getting these alerts:

Time: Tue Aug 25 20:00:54 2020 -0600
IP: ::ffff:d88a:c0e6 (Unknown)
Connections: 504
Blocked: Temporary Block for 1800 seconds
 
Connections:
tcp6: 0:0:0:0:0:ffff:d88a:c0e6:51064 -> 0:0:0:0:0:ffff:d88a:c0e6:7081 (TIME_WAIT)
tcp6: 0:0:0:0:0:ffff:d88a:c0e6:49206 -> 0:0:0:0:0:ffff:d88a:c0e6:7081 (TIME_WAIT)
tcp6:...

The include option in /etc/csf/csf.allow no longer loads the rules

csf: v14.17
MESSENGER config by default with MESSENGER v2 enabled

I'm receiving these mail alerts from the Messenger recaptcha:

Subject: lfd on server.domain.com: recaptcha ?ôЄÿê/¶7Ô³Æ >ßv¬£þlÄ ¡ƒÃƒà¤õ-qJ7L-°¤Úwyµ#w@/V{Õ[7ÀTÀKÕˆ=RN”¯c?‘æø˝5Ô¬Œ•šñ+é>þGãïo&ŽÌÒoskäÊcìƒÙnePü[|š§AñÂDõ¯|¤ð¸£ãº7 (Unknown)

Time: Mon Aug 21 11:50:34 2022 +0200
IP: ?ôЄÿê/¶7Ô³Æ >ßv¬£þlÄ...

Hello,

When viewing the CSF firewall in cpanel WHM there is a CSS style error noticeable at the top of the Juniper theme page for the Search field.

Console shows error:
Source map error: Error: request failed with status 404
Resource URL:
Source Map URL: bootstrap.min.css.map

If I fix this on my end will updates overwrite my fix?

Hi,
Refer to above matter,
Recently our server have kernel panic.
We notice it is related with LFD.

CPU: 28 PID: 12607 Comm: lfd - (child) c Kdump: loaded Not tainted 3.10.0-1160.62.1.el7.x86_64 #1
RIP __list_del_entry+0x29/0xd0
RAX: 0000000000000000 RBX: ffff8a929d9712a0 RCX: dead000000000200

MEMORY: 64 GB
PANIC: BUG: unable to handle kernel NULL pointer dereference at (null)
PID:...

# csf --version
csf: v14.16 (cPanel)

Because excessive attacks against the SMTP port, I was forced to activate the SMTPAUTH_RESTRICT to filter sending countries.

However, it shows a wrong (and worrying) behavior by blocking legitimate users from authorized countries

Steps:
/etc/csf/csf.conf
SMTPAUTH_RESTRICT = 1
CC_ALLOW_SMTPAUTH = DE,NL

exim needed mods, rebuild exim & restart. All...

Hi,

seems that the bug reported in this previous topic is happening again.

On several of our servers it was not working until we did apply the same fix.

Under heavy attacks the login failure daemon will constantly restart with the error: *Error* Excessive number of children (344), restarting lfd... Unfortunately some times LFD doesn't come back after restarting and errors with: *Error* pid mismatch or missing, at line 1161

Here is a sample from the logs:

Jan 24 15:24:50 server lfd : (opencart) Failed opencart login from 54.64.139.233...

Seems that command line help ( -h --help -?) does not work any more.
csf: v14.15 (cPanel)

Hello,

since one of the last updates, I suspect the very last one 2 days ago, LF_SU_EMAIL_ALERT is not working anymore.
This would be very important as working on a prod server.
LF_SSH_EMAIL_ALERT is working normally, but both LF_SU_EMAIL_ALERT as also LF_SUDO_EMAIL_ALERT (which I never use but enabled shortly for testing) do no send or even try to send an email at all. I followed the postfix...

Since upgrading to cPanel/WHM version 100, some (all?) dovecot login failures are no longer being caught by lfd. It appears that the log entries have changed eg

vps dovecot: imap-login: Aborted login (auth failed, 2 attempts in 17 secs):

has become:

vps dovecot: imap-login: Disconnected: Aborted login by logging out (auth failed, 2 attempts in 11 secs):

There is a reference to this in...

Login page can't login with reverse proxy.
After that, I modify source code to add remote ip address as a ip address instead of localhost ip address, it work but only in firefox, and after login it still in login screen although i press F5 button. Only when i press Ctrl+Shift+R it will redirect to admin page but when i click a function it redirect to login page, only when i press Ctrl+Shift+R it...

In my testing I wasn't able to get the LF_BIND login failure trigger to work. After checking some Centos7 and Centos 8 servers it looks like the BIND trigger in RegexMain.pm doesn't account for the hex value e.g. (@0x7f18041004f0) that is logged in Bind 9+ servers.

Broken (Currently used):

Fixed (I just added the (?: \S+)? to add a non-capturing group that is optional):

I hope this helps!

In my testing I wasn't able to get the MESSENGERV3 to work correctly on Debian/Ubuntu servers (It can't find the SSL certificates). It looks like there is a bug in the Messenger.pm conftree function because it can't process the relative includes used by default on Debian/Ubuntu.

The config used in /etc/csf/csf.conf :

MESSENGERV3 = 1
MESSENGERV3LOCATION = /etc/apache2/conf-enabled/...

Hi guys,
When you search for an IP using the Search for IP / Search iptables for IP address function and it picks up an IP that is blocked, an Unblock button appears below the search results.

However, when the same IP is inside the temporary or full Allow IP list, the Unblock button not only removes the IP from the blocked list, but from the allow list as well.
Please make it so that the Unblock...

In my testing I wasn't able to get the LF_APACHE_404 login failure trigger to work. I'm not sure if this is just a Plesk server issue or if this bug applies to Cpanel servers too.

From the stackoverflow post below it looks like in Apache 2.4.1 the 404 error code was demoted from the core:error to core:info log level as 404 errors are not logged to the error_log by default unless you set LogLevel...

For CSF messenger, the index.php file that handles unblocking, uses curly braces for array indexes/offsets and throws:

Array and string offset access syntax with curly braces is deprecated.

For example:

$lang{ warning };

Should be

$lang ;

-PHP: PHP 7.4.12
-OS: CentOS Linux release 7.9.2009 (Core)
-CSF: csf: v14.08 (cPanel)

Hello!

Since las Tuesday, CSF can't geolocate Spanish IP addresses when executing this:

csf -i 81.202.228.230

This commando retusn this:

# csf -i 81.202.228.230
81.202.228.230 (81.202.228.230.dyn.user.ono.com)

while in other countries it works welll, for example...:

## csf -i 8.8.8.8
8.8.8.8 (US/United States/dns.google)

We noticed that if we modify the database file like this:

echo...