I have set up the following which someone may find useful:

2 x CSF Master in HA with 1 virtual IP - the master config has ALL slave server IP addresses and cluster key
100 CSF slave servers with ONLY the master ip in the clsuter settings + cluster key
A Master script which runs as a daemon and monitors the LFD log to rebroadcast only APPROVED commands to all slaves.

The advantage is that you...

Hello,

If Csf has already blocked in cluster an IP of C-Class, then it should not send one more request of an ip deny with -cd or even accept locally -d. I have a huge problem that there are doubles, one from 0/24 and then hundreds of IPs belonging to this chain.

Consequently, there are thousands of IPs in the csf.deny file.

I have csf on Centos 7.3. The C-Class blocking is activated after...

Would it be possible to specify the period over which the number of failures occurs PER REGEX. Currently, the LF_INTERVAL is used and applies to ALL regexes.

Is there any reason why the csf dev team have not added an md5sum for the csf.tgz download file to enable integrity checking?

It would be nice to have an option to be able to exclude a specific TCP or UDP port so that it is not affected by the CC_DENY filter

Hello,

Even if we mark an up with do not delete (in order for csf not to automatically remove the IP during it's retention of keeping a number of IPs), when we enable reCaptcha unblock the malicious user connecting from a do not delete IP can delete it from csf_deny list.

Hi CSF/Way to the Web Limited ,

The report send with Apache Status, PS -aux, netstats sended during overload it's really useful for diagnostic.

Sometime we view something like this:

mysql 31172 8.9 8.7 5326744 2859216 ? Ssl Jul18 1774:17 /usr/sbin/mysqld

I would be great to have the list of MySQL query during overload, possible ?

if ; then
mysql -e SHOW FULL PROCESSLIST
fi

best...

Only enabling http/1.1 with keepalive disabled forces the user to recreate connections to Apache for every request sent to the Messenger host. This reduces the delay between an unban and a successful first request.

Protocols http/1.1
KeepAlive Off

# grep -Rin -E '(Protocol|KeepAl)' /usr/local/csf/lib/ConfigServer/Messenger.pm
493: print $OUT Protocols http/1.1\n ;
494: print $OUT KeepAlive...

ConfigServer Security & Firewall >> csf - CloudFlare

1. When listing rules for users in the table output, please add support for the following additional columns;
Domain Name (as cPanel/WHM addon domains may not be obviously named according to the linux account username).
CloudFlare Rule Scope: Is the rule specific to a single domain in CloudFlare, or is it across the entire user's CloudFlare...

Request: Please provide an option for CSF when blocking an IP locally in CSF, to also block the IP in CloudFlare under the server configured default account. I understand this would only work for a single cloudflare account, but it would be nice for those of us who do use it in this way.

Thus if someone is probing my server for vulnerabilities over SSH, POP, SMTP, etc... and get blocked, they...

Suggestion - block Exim attacks that are designed to degrade server performance:

Log files below of the issue (IP used is arbitrary). CENTOS 7 server.

Log directory:
/var/log/exim_mainlog

2019-02-13 18:51:46.727 no MAIL in SMTP connection from :53797 I= :25 D=10s
2019-02-13 18:51:57.453 no MAIL in SMTP connection from :57662 I= :25 D=10s
2019-02-13 18:52:08.176 no MAIL in SMTP connection from...

Just wanted to make two small suggestions for some of the cluster functionality:

1. When using cluster ignore or allow the entry added to the cluster members is missing the date and time at the end of the entry (like when the cluster deny is used). It would be nice if this was added.

2. The cluster ignore function allows you to add duplicate entries. It would be nice if it a check like the...

Hello.

We suggest to add to the csf.blacklist.

Thank you!

Have you considered integrating DDoS Deflate from: ?

Hi,

I was wondering if it would be feasible to implement smarter blocking for login failures as per the following logic:

Do not consider multiple login attempts that use the same IP address, username, and password as separate failures if they occur within the same six-hour period.

We find that we spend a significant proportion of support-time helping customers get unblocked after they set a...

First of all, great plugin!

One of our resellers asked if it would be possible to have a simple 'add to whitelist' for ip addresses window in the Direct Admin plugin. That would allow resellers to add their end users (who seem to be unable to type passwords) to the whitelist.

Is there any way to accomplish this?

EDIT: safe to delete this thread. After researching a bit more I found out I can accomplish this by adding do not delete to an entry

Currently I have my deny list set at a maximum of 500 entries, but a larger number of entries wouldn't solve this issue anyway. The problem is that I want some addresses blocked permanently and never rotated out.
It would be nice if there would be two separate deny...

I have a suggested patch as I have a cluster of 3000 servers and putting 3000 IP addresses in the csf.conf file seems to be a really ugly solution.
My suggestion is to include the possibility of an include file as follows:
1.) If you have only a few servers in your cluster, configure the CLUSTER_SENDTO and CLUSTER_RECVFROM as normal.
2.) If you have many, start the config of CLUSTER_SENDTO...

Hello to you the ConfigServer team.

Firstly I want to congratulate you for the excellent work that you realized this year, it is very appreciated! I hope that the year 2019 will be as good in features :-)

This topic about a small issue/overload increase on a VPS node at midnight , after checking it would appear to be the CRON defined in /etc/cron.d/lfd-cron

# cat /etc/cron.d/lfd-cron...

Hi. Not sure if this is a question or suggestion but after having configured csf in various host and container machines it would be of great help to be able to overwrite only those tunned directives and make those survive updates.

What I mean, and not sure if its already possible is to have an include conf.d/*.conf directive so I can have my configurations overwrite the default csf ones like in...