We've been getting quite a few Syn Flood attacks lately. This is not a problem when were are present as we can manually enable SYNFLOOD. CSF is a life saver and lets us sleep at night, but the one thing that's missing is the ability to have SYNFLOOD automatically enable itself when it detects an unusually high number of SYN packets occurring. And then disable itself when things return to normal....

Hello,

Would it be possible to include blocks from cPhulk brute force protection on the reCAPTCHA unblocking ?

That would be neat if feasible!
:)

CSF is great but I'm missing a LF_TEMPBLOCK_ALERT = x option.

You can use the LF_EMAIL_ALERT or LF_PERMBLOCK_ALERT options, but since permblocks won't be automatically removed (normally) and I do want to be alerted about other options (which I guess more people would like), the tempblock option is missing.

Temblocks will be removed automatically and generate a lot of email alerts, which in a...

I have set up the following which someone may find useful:

2 x CSF Master in HA with 1 virtual IP - the master config has ALL slave server IP addresses and cluster key
100 CSF slave servers with ONLY the master ip in the clsuter settings + cluster key
A Master script which runs as a daemon and monitors the LFD log to rebroadcast only APPROVED commands to all slaves.

The advantage is that you...

Hello,

If Csf has already blocked in cluster an IP of C-Class, then it should not send one more request of an ip deny with -cd or even accept locally -d. I have a huge problem that there are doubles, one from 0/24 and then hundreds of IPs belonging to this chain.

Consequently, there are thousands of IPs in the csf.deny file.

I have csf on Centos 7.3. The C-Class blocking is activated after...

Would it be possible to specify the period over which the number of failures occurs PER REGEX. Currently, the LF_INTERVAL is used and applies to ALL regexes.

Is there any reason why the csf dev team have not added an md5sum for the csf.tgz download file to enable integrity checking?

It would be nice to have an option to be able to exclude a specific TCP or UDP port so that it is not affected by the CC_DENY filter

Hello,

Even if we mark an up with do not delete (in order for csf not to automatically remove the IP during it's retention of keeping a number of IPs), when we enable reCaptcha unblock the malicious user connecting from a do not delete IP can delete it from csf_deny list.

Hi CSF/Way to the Web Limited ,

The report send with Apache Status, PS -aux, netstats sended during overload it's really useful for diagnostic.

Sometime we view something like this:

mysql 31172 8.9 8.7 5326744 2859216 ? Ssl Jul18 1774:17 /usr/sbin/mysqld

I would be great to have the list of MySQL query during overload, possible ?

if ; then
mysql -e SHOW FULL PROCESSLIST
fi

best...

Only enabling http/1.1 with keepalive disabled forces the user to recreate connections to Apache for every request sent to the Messenger host. This reduces the delay between an unban and a successful first request.

Protocols http/1.1
KeepAlive Off

# grep -Rin -E '(Protocol|KeepAl)' /usr/local/csf/lib/ConfigServer/Messenger.pm
493: print $OUT Protocols http/1.1\n ;
494: print $OUT KeepAlive...

ConfigServer Security & Firewall >> csf - CloudFlare

1. When listing rules for users in the table output, please add support for the following additional columns;
Domain Name (as cPanel/WHM addon domains may not be obviously named according to the linux account username).
CloudFlare Rule Scope: Is the rule specific to a single domain in CloudFlare, or is it across the entire user's CloudFlare...

Request: Please provide an option for CSF when blocking an IP locally in CSF, to also block the IP in CloudFlare under the server configured default account. I understand this would only work for a single cloudflare account, but it would be nice for those of us who do use it in this way.

Thus if someone is probing my server for vulnerabilities over SSH, POP, SMTP, etc... and get blocked, they...

Suggestion - block Exim attacks that are designed to degrade server performance:

Log files below of the issue (IP used is arbitrary). CENTOS 7 server.

Log directory:
/var/log/exim_mainlog

2019-02-13 18:51:46.727 no MAIL in SMTP connection from :53797 I= :25 D=10s
2019-02-13 18:51:57.453 no MAIL in SMTP connection from :57662 I= :25 D=10s
2019-02-13 18:52:08.176 no MAIL in SMTP connection from...

Just wanted to make two small suggestions for some of the cluster functionality:

1. When using cluster ignore or allow the entry added to the cluster members is missing the date and time at the end of the entry (like when the cluster deny is used). It would be nice if this was added.

2. The cluster ignore function allows you to add duplicate entries. It would be nice if it a check like the...

Hello.

We suggest to add to the csf.blacklist.

Thank you!

Have you considered integrating DDoS Deflate from: ?

Hi,

I was wondering if it would be feasible to implement smarter blocking for login failures as per the following logic:

Do not consider multiple login attempts that use the same IP address, username, and password as separate failures if they occur within the same six-hour period.

We find that we spend a significant proportion of support-time helping customers get unblocked after they set a...

First of all, great plugin!

One of our resellers asked if it would be possible to have a simple 'add to whitelist' for ip addresses window in the Direct Admin plugin. That would allow resellers to add their end users (who seem to be unable to type passwords) to the whitelist.

Is there any way to accomplish this?

EDIT: safe to delete this thread. After researching a bit more I found out I can accomplish this by adding do not delete to an entry

Currently I have my deny list set at a maximum of 500 entries, but a larger number of entries wouldn't solve this issue anyway. The problem is that I want some addresses blocked permanently and never rotated out.
It would be nice if there would be two separate deny...