Possible root compromise: File /lib64/libkeyutils.so.1.9 exists and /lib/libkeyutils.so.1.9 exists.

For more information see:

This file is part of keyutils, part of the Linux kernel. If lfd is not checking the hash of the file matches a compromised version (it doesn't), then don't report it. This library has been around and been installed for years. Only when I updated to the 1.9 so version of...

Hi StopForumSPAM !

We are using ConfigServer Security & Firewall (csf) on server and we load the STOPFORUMSPAM with csf.blocklists

Since one week we have slow/strange/random issue with resolving domains:

(XID 5mjkwh) The system failed to send an HTTP “GET” request to “ because of an error: Could not connect to 'verify.cpanel.net:443': Name or service not known at...

Today I was delighted to realize that one can enter ASNs in the firewall and the respective ranges will be looked up and added. I had been looking up and adding ranges manually which is quite time consuming. But I was disappointed when it didn't work:

Aug 28 15:43:28 server lfd : CC: Retrieving GeoLite2 CSV ASN database
Aug 28 15:43:29 server lfd : CC: Processing GeoLite2 CSV Country/ASN...

When the Watch System Logs page loads, the refresh function is automatically set to five seconds. I rarely find the auto-refresh helpful as I typically am scrolling up through the logs and lose my place when it refreshes.

I've been wanting a feature request for a switch to disable the auto-refresh either on the page or in the config. This could also include customization of the refresh...

The directadmin installation suggests that CSF config should be managed by the directadmin and we have to set some bruteforce settings to 0 or disable them. By doing this, the CSF will trigger few warning messages.

From what I've known, CSF use a special installation config file for directadmin called csf.directadmin.conf and it contains a generic variable DIRECTADMIN=1

If we can use this...

Hello,

I'd like to request that the automated abuse reports produced contain the destination (attacked) IP address in their opening line.

The reason for this is that CSF only takes the hostname as written in /etc/hostname , which is not an FQDN on many Linux distributions.

There is plenty of (unrelated) discussion about as to whether this file should contain an FQDN or only system name, but...

We've been getting quite a few Syn Flood attacks lately. This is not a problem when were are present as we can manually enable SYNFLOOD. CSF is a life saver and lets us sleep at night, but the one thing that's missing is the ability to have SYNFLOOD automatically enable itself when it detects an unusually high number of SYN packets occurring. And then disable itself when things return to normal....

Hello,

Would it be possible to include blocks from cPhulk brute force protection on the reCAPTCHA unblocking ?

That would be neat if feasible!
:)

CSF is great but I'm missing a LF_TEMPBLOCK_ALERT = x option.

You can use the LF_EMAIL_ALERT or LF_PERMBLOCK_ALERT options, but since permblocks won't be automatically removed (normally) and I do want to be alerted about other options (which I guess more people would like), the tempblock option is missing.

Temblocks will be removed automatically and generate a lot of email alerts, which in a...

I have set up the following which someone may find useful:

2 x CSF Master in HA with 1 virtual IP - the master config has ALL slave server IP addresses and cluster key
100 CSF slave servers with ONLY the master ip in the clsuter settings + cluster key
A Master script which runs as a daemon and monitors the LFD log to rebroadcast only APPROVED commands to all slaves.

The advantage is that you...

Hello,

If Csf has already blocked in cluster an IP of C-Class, then it should not send one more request of an ip deny with -cd or even accept locally -d. I have a huge problem that there are doubles, one from 0/24 and then hundreds of IPs belonging to this chain.

Consequently, there are thousands of IPs in the csf.deny file.

I have csf on Centos 7.3. The C-Class blocking is activated after...

Would it be possible to specify the period over which the number of failures occurs PER REGEX. Currently, the LF_INTERVAL is used and applies to ALL regexes.

Is there any reason why the csf dev team have not added an md5sum for the csf.tgz download file to enable integrity checking?

It would be nice to have an option to be able to exclude a specific TCP or UDP port so that it is not affected by the CC_DENY filter

Hello,

Even if we mark an up with do not delete (in order for csf not to automatically remove the IP during it's retention of keeping a number of IPs), when we enable reCaptcha unblock the malicious user connecting from a do not delete IP can delete it from csf_deny list.

Hi CSF/Way to the Web Limited ,

The report send with Apache Status, PS -aux, netstats sended during overload it's really useful for diagnostic.

Sometime we view something like this:

mysql 31172 8.9 8.7 5326744 2859216 ? Ssl Jul18 1774:17 /usr/sbin/mysqld

I would be great to have the list of MySQL query during overload, possible ?

if ; then
mysql -e SHOW FULL PROCESSLIST
fi

best...

Only enabling http/1.1 with keepalive disabled forces the user to recreate connections to Apache for every request sent to the Messenger host. This reduces the delay between an unban and a successful first request.

Protocols http/1.1
KeepAlive Off

# grep -Rin -E '(Protocol|KeepAl)' /usr/local/csf/lib/ConfigServer/Messenger.pm
493: print $OUT Protocols http/1.1\n ;
494: print $OUT KeepAlive...

ConfigServer Security & Firewall >> csf - CloudFlare

1. When listing rules for users in the table output, please add support for the following additional columns;
Domain Name (as cPanel/WHM addon domains may not be obviously named according to the linux account username).
CloudFlare Rule Scope: Is the rule specific to a single domain in CloudFlare, or is it across the entire user's CloudFlare...

Request: Please provide an option for CSF when blocking an IP locally in CSF, to also block the IP in CloudFlare under the server configured default account. I understand this would only work for a single cloudflare account, but it would be nice for those of us who do use it in this way.

Thus if someone is probing my server for vulnerabilities over SSH, POP, SMTP, etc... and get blocked, they...

Suggestion - block Exim attacks that are designed to degrade server performance:

Log files below of the issue (IP used is arbitrary). CENTOS 7 server.

Log directory:
/var/log/exim_mainlog

2019-02-13 18:51:46.727 no MAIL in SMTP connection from :53797 I= :25 D=10s
2019-02-13 18:51:57.453 no MAIL in SMTP connection from :57662 I= :25 D=10s
2019-02-13 18:52:08.176 no MAIL in SMTP connection from...