I just recently switched cPanel AutoSSL provider from Let's Encrypt to cPanel via Comodo .

The SSL cert requests stayed in queue for an excessive time, and I wound up logging a paid support request with cPanel.

It was discovered that the DCV was failing and thus blocking cert delivery due to either 1) because I had a number of the remote domain query from addresses blocked (Russia, China,...

Hi All,

Just my thought.

I noticed from LF_Xxx notification that when an IP is blocked by CSF, it will 99.99% appear in some kind of Blacklists (RBLs).

I know RBLs is an entirely different area of discussion here, but since when an IP source trying to Bruteforce and its IP got blocked by CSF also appear in Blacklists (RBLs), I wonder if there will be any future development to make use of the...

Some time ago I briefly deactivated CSF because there was something not quite right on my server, and I was wondering if CSF might be the culprit (It wasn't). After testing was complete, I clicked reactivate , saw a message that said DONE! and went to continue with other tasks.

Today I found out that my firewall was down during all this time, putting my server at an unnecessary risk. Why?...

Hey Guys,

I am sitting with a strange issue, we have a major problem with spam being sent from places like russia, india and so forth...
So to mitigate this, The simplest solution, is to block those countries. Obviously you can block places like russia, but then you get places like the EU, US, UK which poses another problem cause you have ligitimate traffic from there aswell which you cannot...

Hi CSF/Way to the Web Limited ,

The report send with Apache Status, PS -aux, netstats sended during overload it's really useful for diagnostic.

Sometime we view something like this:

mysql 31172 8.9 8.7 5326744 2859216 ? Ssl Jul18 1774:17 /usr/sbin/mysqld

I would be great to have the list of MySQL query during overload, possible ?

if ; then
mysql -e SHOW FULL PROCESSLIST
fi

best...

Hi,

I really enjoy using your software but I'm running into a problem now.
We are moving to the public cloud and are using DHCP.
On the server security page there is a notification about dhclient because we are using floating IP's.
We are using KVM OpenStack virtual machines.

You can check if the user is running inside OpenStack with the following command:
dmidecode -s 'system-product-name'...

I have been running CSF for a long time and recently upgraded from MariaDB 10.1 to 10.2. As part of the upgrade, I decided to clean up the my.cnf commands, including moving to underscores instead of dashes.

This morning, I received a warning during CSF's check stating:

Check MySQL LOAD DATA disallows LOCAL
You should disable LOAD DATA LOCAL commands in MySQL by adding the following to the...

Further information in this Cpanel thread:

Usually LFD detects modified binaries that have been updated by yum / apt on the integrity check.

It would be quite useful if you send the last lines of the yum / apt log (last 24 hs) attached or appended to these e-mails to quickly check if those changes correlate with the modified files or not.

Best,

for some time we are working on a new application called StreamFlow
the successor of RequestServer, on our server we use:
ConfigServer Security & Firewall - csf v12.04

where we have to enter all stream IP addresses of our customers manually
this will result in delays for the customer as you may understand.

now we want to automate this, only there is no php script for this
do you have any...

Attempting to start LFD while in TESTING mode does not report the correct error *Error* lfd will not run with TESTING enabled in /etc/csf/csf.conf . Instead, /usr/sbin/lfd attempts to close and unlink the $pidfile /var/run/lfd.pid using an undefined file handle $PIDFILE at line 7186. This causes the error: Can't use an undefined value as a symbol reference at /usr/sbin/lfd line.7186 .

Also...

Hi,

Now I have a server under my hand with csf with DENY_TEMP_IP_LIMIT=250.
250 entry is enough for about 4 minute denys, and there are rotated out.
But it's should deny IPs for 120/60/30/5 minutes...
Is there a way to support ipset for longer denies?

Regards

Debian 9.4 server
kernel 4.9.0-6-amd64
iptables ipv4 v1.6.0
unbound 1.6.0
csf 12.02 (DNS strict off / Paket Filter on)

unbound, being the local resolver, is issuing DNS over TLS requests to the upstream resolver over TCP with destination port 853. The response from the upstream resolver is getting blocked as invalid packets

Firewall: *INVALID* IN=eth0 OUT=...

lxc.service (lxc containers) comes with its own set of iptables which are loaded when lxc.service starts. since csf is flushing the iptable entirely when restarted the lxc container(s) loosing connectivity.

lxc.service does not provide for a reload but only restart which in turn is killing any active container and thus interrupting any service provided by a lxc container. Which is most...

Hi

Problem: Unable to get updates automatically using csf -u, although manually downloading and reinstalling works. Both mode 1 and mode 2 updates fail. LWP and Tiny are installed, and all other software (wget, cpan, apt) use the proxy successfully.

The csf code is not reading or using the environment set proxy information. Calls to get the updated package occur in URLGet.pm - funtion urlgetLWP...

I would be great to have a link, along with block/unblock in Temporary IP entries to search IP in the logs.

Hi guys,

CSF is blocking SMTP login attempts fine, but LF_EXIMSYNTAX=10 and LF_EXIMSYNTAX_PERM=1 don't seem to be stopping EXIM attacks. Below is an excerpt from my exim_mainlog. These two IP addresses (181.214.206.20 and 181.214.206.133) have been hitting the server with these requests hundreds of times but haven't been blocked. Shouldn't multiple list matching forced to fail: failed to find...

I noticed in your readme.txt about Cloudflare that Automatic blocks via lfd are limited to LF_MODSEC and LF_CXS triggers as only through these can the domain name be determined.

However in csf.cloudflare we can also specify entries with DOMAIN:any to catch all relevant triggers regardless of domain. I'm guessing this is for people who manage all domains on their server via one cloudflare...

Hello,

I'd like to see LF_NETBLOCK extended to work like the LF_ _PERM triggers, where this can either be a permanent or a temporary ban of a configured length.

Additionally, I'd like to see CC_LOOKUPS info included in the LF_NETBLOCK alert.

Both of these changes can go a long way to help prevent/detect issues where a netblock that impacts legitimate traffic gets blocked, and some intervention...

Whilst Outgoing UDP Flood Protection is available there is none for TCP however