First of all, great plugin!

One of our resellers asked if it would be possible to have a simple 'add to whitelist' for ip addresses window in the Direct Admin plugin. That would allow resellers to add their end users (who seem to be unable to type passwords) to the whitelist.

Is there any way to accomplish this?

EDIT: safe to delete this thread. After researching a bit more I found out I can accomplish this by adding do not delete to an entry

Currently I have my deny list set at a maximum of 500 entries, but a larger number of entries wouldn't solve this issue anyway. The problem is that I want some addresses blocked permanently and never rotated out.
It would be nice if there would be two separate deny...

I have a suggested patch as I have a cluster of 3000 servers and putting 3000 IP addresses in the csf.conf file seems to be a really ugly solution.
My suggestion is to include the possibility of an include file as follows:
1.) If you have only a few servers in your cluster, configure the CLUSTER_SENDTO and CLUSTER_RECVFROM as normal.
2.) If you have many, start the config of CLUSTER_SENDTO...

Hi CSF/Way to the Web Limited ,

The report send with Apache Status, PS -aux, netstats sended during overload it's really useful for diagnostic.

Sometime we view something like this:

mysql 31172 8.9 8.7 5326744 2859216 ? Ssl Jul18 1774:17 /usr/sbin/mysqld

I would be great to have the list of MySQL query during overload, possible ?

if ; then
mysql -e SHOW FULL PROCESSLIST
fi

best...

Hello to you the ConfigServer team.

Firstly I want to congratulate you for the excellent work that you realized this year, it is very appreciated! I hope that the year 2019 will be as good in features :-)

This topic about a small issue/overload increase on a VPS node at midnight , after checking it would appear to be the CRON defined in /etc/cron.d/lfd-cron

# cat /etc/cron.d/lfd-cron...

Hi. Not sure if this is a question or suggestion but after having configured csf in various host and container machines it would be of great help to be able to overwrite only those tunned directives and make those survive updates.

What I mean, and not sure if its already possible is to have an include conf.d/*.conf directive so I can have my configurations overwrite the default csf ones like in...

Hi all,

I suggest that if it's possible to add an option in the CSF to block the desire email address only on many wrong SMTP/IMAP/POP3 logins instead of blocking the whole IP , in both directadmin and CPanel . It can be an email address suspension with a notification email .

Since the current blocking the whole IP causes all other company employees under the same IP to be blocked also , and...

Some time ago I briefly deactivated CSF because there was something not quite right on my server, and I was wondering if CSF might be the culprit (It wasn't). After testing was complete, I clicked reactivate , saw a message that said DONE! and went to continue with other tasks.

Today I found out that my firewall was down during all this time, putting my server at an unnecessary risk. Why?...

It looks like the regex for courier-imaps and courier-pop3s regex on centos 7 isn't working (The old version doesn't match imaps or pop3s:

Some samples:

Nov 29 04:15:43 master courier-imaps: LOGIN FAILED, user=xxxx@xxxx.com, ip=
Nov 29 06:58:12 master courier-imaps: LOGIN FAILED, user=xxx@xxxx.de, ip=

The fix

#courier-imap (Plesk)
if (($config{LF_POP3D}) and...

Based on my inquiry and discovery that such a feature does not yet exist in the form I'd like, I'd like to officially request this.

Original thread:

I would love to be able to use an allow list to retrieve the CloudFlare IP addresses regularly at these URLs, then apply my own advanced allowed rules to these IP addresses.

Similar to the feature of the Block Lists text file, where one can...

Request: Please provide an option for CSF when blocking an IP locally in CSF, to also block the IP in CloudFlare under the server configured default account. I understand this would only work for a single cloudflare account, but it would be nice for those of us who do use it in this way.

Thus if someone is probing my server for vulnerabilities over SSH, POP, SMTP, etc... and get blocked, they...

Usually LFD detects modified binaries that have been updated by yum / apt on the integrity check.

It would be quite useful if you send the last lines of the yum / apt log (last 24 hs) attached or appended to these e-mails to quickly check if those changes correlate with the modified files or not.

Hi All,

Just my thought.

I noticed from LF_Xxx notification that when an IP is blocked by CSF, it will 99.99% appear in some kind of Blacklists (RBLs).

I know RBLs is an entirely different area of discussion here, but since when an IP source trying to Bruteforce and its IP got blocked by CSF also appear in Blacklists (RBLs), I wonder if there will be any future development to make use of the...

Debian 9.4 server
kernel 4.9.0-6-amd64
iptables ipv4 v1.6.0
unbound 1.6.0
csf 12.02 (DNS strict off / Paket Filter on)

unbound, being the local resolver, is issuing DNS over TLS requests to the upstream resolver over TCP with destination port 853. The response from the upstream resolver is getting blocked as invalid packets

Firewall: *INVALID* IN=eth0 OUT=...

ConfigServer Security & Firewall >> csf - CloudFlare

1. When listing rules for users in the table output, please add support for the following additional columns;
Domain Name (as cPanel/WHM addon domains may not be obviously named according to the linux account username).
CloudFlare Rule Scope: Is the rule specific to a single domain in CloudFlare, or is it across the entire user's CloudFlare...

I just recently switched cPanel AutoSSL provider from Let's Encrypt to cPanel via Comodo .

The SSL cert requests stayed in queue for an excessive time, and I wound up logging a paid support request with cPanel.

It was discovered that the DCV was failing and thus blocking cert delivery due to either 1) because I had a number of the remote domain query from addresses blocked (Russia, China,...

Hello,

Is it good to automatically deny IP with multi ports on the same service in one line instead of separate to two or three lines in case of LF_SELECT=1.

For example,
Normal:
tcp|in|d=25|s=1.1.1.1
tcp|in|d=465|s=1.1.1.1
tcp|in|d=587|s=1.1.1.1

To be:
tcp|in|d=25,465,587|s=1.1.1.1

This will help decrease number of line in csf.deny and not reach DENY_IP_LIMIT too fast.

Thanks.

Hello,

Actually, it's not a suggestion but a feature requests.
It would be a nice to have an option to use Messenger service (both v1 & v2) with global deny lists like CC_DENY for example.

I know it's resource extensive, but it could save some time - instead of manually block subnets (so messeger will work).

Best regards,
Sdarot.

Here is an updated processdistsmtpline function in RegexMain.pm that adds Distributed SMTP Login (LF_DISTSMTP) support for Postfix:

Successful Postfix SMTP_AUTH log file example

Sep 23 11:45:31 el7p17 postfix/smtpd : CB957400A36E: client=unknown , sasl_method=PLAIN, sasl_username=test@example.com

Regex Text

RegexMain.pm function processdistsmtpline on line 795

sub...

Hey Guys,

I am sitting with a strange issue, we have a major problem with spam being sent from places like russia, india and so forth...
So to mitigate this, The simplest solution, is to block those countries. Obviously you can block places like russia, but then you get places like the EU, US, UK which poses another problem cause you have ligitimate traffic from there aswell which you cannot...