I have a suggested patch as I have a cluster of 3000 servers and putting 3000 IP addresses in the csf.conf file seems to be a really ugly solution.
My suggestion is to include the possibility of an include file as follows:
1.) If you have only a few servers in your cluster, configure the CLUSTER_SENDTO and CLUSTER_RECVFROM as normal.
2.) If you have many, start the config of CLUSTER_SENDTO...

I just recently switched cPanel AutoSSL provider from Let's Encrypt to cPanel via Comodo .

The SSL cert requests stayed in queue for an excessive time, and I wound up logging a paid support request with cPanel.

It was discovered that the DCV was failing and thus blocking cert delivery due to either 1) because I had a number of the remote domain query from addresses blocked (Russia, China,...

Hello,

Is it good to automatically deny IP with multi ports on the same service in one line instead of separate to two or three lines in case of LF_SELECT=1.

For example,
Normal:
tcp|in|d=25|s=1.1.1.1
tcp|in|d=465|s=1.1.1.1
tcp|in|d=587|s=1.1.1.1

To be:
tcp|in|d=25,465,587|s=1.1.1.1

This will help decrease number of line in csf.deny and not reach DENY_IP_LIMIT too fast.

Thanks.

Hello,

Actually, it's not a suggestion but a feature requests.
It would be a nice to have an option to use Messenger service (both v1 & v2) with global deny lists like CC_DENY for example.

I know it's resource extensive, but it could save some time - instead of manually block subnets (so messeger will work).

Best regards,
Sdarot.

Here is an updated processdistsmtpline function in RegexMain.pm that adds Distributed SMTP Login (LF_DISTSMTP) support for Postfix:

Successful Postfix SMTP_AUTH log file example

Sep 23 11:45:31 el7p17 postfix/smtpd : CB957400A36E: client=unknown , sasl_method=PLAIN, sasl_username=test@example.com

Regex Text

RegexMain.pm function processdistsmtpline on line 795

sub...

Hi All,

Just my thought.

I noticed from LF_Xxx notification that when an IP is blocked by CSF, it will 99.99% appear in some kind of Blacklists (RBLs).

I know RBLs is an entirely different area of discussion here, but since when an IP source trying to Bruteforce and its IP got blocked by CSF also appear in Blacklists (RBLs), I wonder if there will be any future development to make use of the...

Some time ago I briefly deactivated CSF because there was something not quite right on my server, and I was wondering if CSF might be the culprit (It wasn't). After testing was complete, I clicked reactivate , saw a message that said DONE! and went to continue with other tasks.

Today I found out that my firewall was down during all this time, putting my server at an unnecessary risk. Why?...

Hey Guys,

I am sitting with a strange issue, we have a major problem with spam being sent from places like russia, india and so forth...
So to mitigate this, The simplest solution, is to block those countries. Obviously you can block places like russia, but then you get places like the EU, US, UK which poses another problem cause you have ligitimate traffic from there aswell which you cannot...

Hi CSF/Way to the Web Limited ,

The report send with Apache Status, PS -aux, netstats sended during overload it's really useful for diagnostic.

Sometime we view something like this:

mysql 31172 8.9 8.7 5326744 2859216 ? Ssl Jul18 1774:17 /usr/sbin/mysqld

I would be great to have the list of MySQL query during overload, possible ?

if ; then
mysql -e SHOW FULL PROCESSLIST
fi

best...

Hi,

I really enjoy using your software but I'm running into a problem now.
We are moving to the public cloud and are using DHCP.
On the server security page there is a notification about dhclient because we are using floating IP's.
We are using KVM OpenStack virtual machines.

You can check if the user is running inside OpenStack with the following command:
dmidecode -s 'system-product-name'...

I have been running CSF for a long time and recently upgraded from MariaDB 10.1 to 10.2. As part of the upgrade, I decided to clean up the my.cnf commands, including moving to underscores instead of dashes.

This morning, I received a warning during CSF's check stating:

Check MySQL LOAD DATA disallows LOCAL
You should disable LOAD DATA LOCAL commands in MySQL by adding the following to the...

Further information in this Cpanel thread:

Usually LFD detects modified binaries that have been updated by yum / apt on the integrity check.

It would be quite useful if you send the last lines of the yum / apt log (last 24 hs) attached or appended to these e-mails to quickly check if those changes correlate with the modified files or not.

Best,

for some time we are working on a new application called StreamFlow
the successor of RequestServer, on our server we use:
ConfigServer Security & Firewall - csf v12.04

where we have to enter all stream IP addresses of our customers manually
this will result in delays for the customer as you may understand.

now we want to automate this, only there is no php script for this
do you have any...

Attempting to start LFD while in TESTING mode does not report the correct error *Error* lfd will not run with TESTING enabled in /etc/csf/csf.conf . Instead, /usr/sbin/lfd attempts to close and unlink the $pidfile /var/run/lfd.pid using an undefined file handle $PIDFILE at line 7186. This causes the error: Can't use an undefined value as a symbol reference at /usr/sbin/lfd line.7186 .

Also...

Hi,

Now I have a server under my hand with csf with DENY_TEMP_IP_LIMIT=250.
250 entry is enough for about 4 minute denys, and there are rotated out.
But it's should deny IPs for 120/60/30/5 minutes...
Is there a way to support ipset for longer denies?

Regards

Debian 9.4 server
kernel 4.9.0-6-amd64
iptables ipv4 v1.6.0
unbound 1.6.0
csf 12.02 (DNS strict off / Paket Filter on)

unbound, being the local resolver, is issuing DNS over TLS requests to the upstream resolver over TCP with destination port 853. The response from the upstream resolver is getting blocked as invalid packets

Firewall: *INVALID* IN=eth0 OUT=...

lxc.service (lxc containers) comes with its own set of iptables which are loaded when lxc.service starts. since csf is flushing the iptable entirely when restarted the lxc container(s) loosing connectivity.

lxc.service does not provide for a reload but only restart which in turn is killing any active container and thus interrupting any service provided by a lxc container. Which is most...

Hi

Problem: Unable to get updates automatically using csf -u, although manually downloading and reinstalling works. Both mode 1 and mode 2 updates fail. LWP and Tiny are installed, and all other software (wget, cpan, apt) use the proxy successfully.

The csf code is not reading or using the environment set proxy information. Calls to get the updated package occur in URLGet.pm - funtion urlgetLWP...

I would be great to have a link, along with block/unblock in Temporary IP entries to search IP in the logs.