Hello,

Even if we mark an up with do not delete (in order for csf not to automatically remove the IP during it's retention of keeping a number of IPs), when we enable reCaptcha unblock the malicious user connecting from a do not delete IP can delete it from csf_deny list.

Hi CSF/Way to the Web Limited ,

The report send with Apache Status, PS -aux, netstats sended during overload it's really useful for diagnostic.

Sometime we view something like this:

mysql 31172 8.9 8.7 5326744 2859216 ? Ssl Jul18 1774:17 /usr/sbin/mysqld

I would be great to have the list of MySQL query during overload, possible ?

if ; then
mysql -e SHOW FULL PROCESSLIST
fi

best...

Only enabling http/1.1 with keepalive disabled forces the user to recreate connections to Apache for every request sent to the Messenger host. This reduces the delay between an unban and a successful first request.

Protocols http/1.1
KeepAlive Off

# grep -Rin -E '(Protocol|KeepAl)' /usr/local/csf/lib/ConfigServer/Messenger.pm
493: print $OUT Protocols http/1.1\n ;
494: print $OUT KeepAlive...

ConfigServer Security & Firewall >> csf - CloudFlare

1. When listing rules for users in the table output, please add support for the following additional columns;
Domain Name (as cPanel/WHM addon domains may not be obviously named according to the linux account username).
CloudFlare Rule Scope: Is the rule specific to a single domain in CloudFlare, or is it across the entire user's CloudFlare...

Request: Please provide an option for CSF when blocking an IP locally in CSF, to also block the IP in CloudFlare under the server configured default account. I understand this would only work for a single cloudflare account, but it would be nice for those of us who do use it in this way.

Thus if someone is probing my server for vulnerabilities over SSH, POP, SMTP, etc... and get blocked, they...

Suggestion - block Exim attacks that are designed to degrade server performance:

Log files below of the issue (IP used is arbitrary). CENTOS 7 server.

Log directory:
/var/log/exim_mainlog

2019-02-13 18:51:46.727 no MAIL in SMTP connection from :53797 I= :25 D=10s
2019-02-13 18:51:57.453 no MAIL in SMTP connection from :57662 I= :25 D=10s
2019-02-13 18:52:08.176 no MAIL in SMTP connection from...

Hello,

If Csf has already blocked in cluster an IP of C-Class, then it should not send one more request of an ip deny with -cd or even accept locally -d. I have a huge problem that there are doubles, one from 0/24 and then hundreds of IPs belonging to this chain.

Consequently, there are thousands of IPs in the csf.deny file.

I have csf on Centos 7.3. The C-Class blocking is activated after...

Just wanted to make two small suggestions for some of the cluster functionality:

1. When using cluster ignore or allow the entry added to the cluster members is missing the date and time at the end of the entry (like when the cluster deny is used). It would be nice if this was added.

2. The cluster ignore function allows you to add duplicate entries. It would be nice if it a check like the...

Hello.

We suggest to add to the csf.blacklist.

Thank you!

Have you considered integrating DDoS Deflate from: ?

Hi,

I was wondering if it would be feasible to implement smarter blocking for login failures as per the following logic:

Do not consider multiple login attempts that use the same IP address, username, and password as separate failures if they occur within the same six-hour period.

We find that we spend a significant proportion of support-time helping customers get unblocked after they set a...

First of all, great plugin!

One of our resellers asked if it would be possible to have a simple 'add to whitelist' for ip addresses window in the Direct Admin plugin. That would allow resellers to add their end users (who seem to be unable to type passwords) to the whitelist.

Is there any way to accomplish this?

EDIT: safe to delete this thread. After researching a bit more I found out I can accomplish this by adding do not delete to an entry

Currently I have my deny list set at a maximum of 500 entries, but a larger number of entries wouldn't solve this issue anyway. The problem is that I want some addresses blocked permanently and never rotated out.
It would be nice if there would be two separate deny...

I have a suggested patch as I have a cluster of 3000 servers and putting 3000 IP addresses in the csf.conf file seems to be a really ugly solution.
My suggestion is to include the possibility of an include file as follows:
1.) If you have only a few servers in your cluster, configure the CLUSTER_SENDTO and CLUSTER_RECVFROM as normal.
2.) If you have many, start the config of CLUSTER_SENDTO...

Hello to you the ConfigServer team.

Firstly I want to congratulate you for the excellent work that you realized this year, it is very appreciated! I hope that the year 2019 will be as good in features :-)

This topic about a small issue/overload increase on a VPS node at midnight , after checking it would appear to be the CRON defined in /etc/cron.d/lfd-cron

# cat /etc/cron.d/lfd-cron...

Hi. Not sure if this is a question or suggestion but after having configured csf in various host and container machines it would be of great help to be able to overwrite only those tunned directives and make those survive updates.

What I mean, and not sure if its already possible is to have an include conf.d/*.conf directive so I can have my configurations overwrite the default csf ones like in...

Hi all,

I suggest that if it's possible to add an option in the CSF to block the desire email address only on many wrong SMTP/IMAP/POP3 logins instead of blocking the whole IP , in both directadmin and CPanel . It can be an email address suspension with a notification email .

Since the current blocking the whole IP causes all other company employees under the same IP to be blocked also , and...

Some time ago I briefly deactivated CSF because there was something not quite right on my server, and I was wondering if CSF might be the culprit (It wasn't). After testing was complete, I clicked reactivate , saw a message that said DONE! and went to continue with other tasks.

Today I found out that my firewall was down during all this time, putting my server at an unnecessary risk. Why?...

It looks like the regex for courier-imaps and courier-pop3s regex on centos 7 isn't working (The old version doesn't match imaps or pop3s:

Some samples:

Nov 29 04:15:43 master courier-imaps: LOGIN FAILED, user=xxxx@xxxx.com, ip=
Nov 29 06:58:12 master courier-imaps: LOGIN FAILED, user=xxx@xxxx.de, ip=

The fix

#courier-imap (Plesk)
if (($config{LF_POP3D}) and...

Based on my inquiry and discovery that such a feature does not yet exist in the form I'd like, I'd like to officially request this.

Original thread:

I would love to be able to use an allow list to retrieve the CloudFlare IP addresses regularly at these URLs, then apply my own advanced allowed rules to these IP addresses.

Similar to the feature of the Block Lists text file, where one can...