ConfigServer Community Forum

Dear ConfigServer Firewall Community,

I hope this message finds you well. I am reaching out to propose a new feature that I believe would significantly enhance the security and usability of the ConfigServer Firewall (CSF), particularly regarding SSH login alerts.

I'd like to suggest an enhancement to the SSH login alert system. The idea is to implement a conditional alert mechanism that...

Currently connection tracking blocks all ports even if you have CT_PORTS defined.

Similar to LF_SELECT, it would be great to have an option to only block defined CT_PORTS.

Thank you.

I have CSF setup to only block IP access to service ports for which a block occurs.

When running csf -t, I see an entry for each service port that has been blocked, however, the port column shows an aggregate of the ports being blocked.

For instance:

csf -g xxx.68.22.155

Table Chain num pkts bytes target prot opt in out source destination

filter DENYIN 2 0 0 DROP tcp -- ens192 *...

Hello,

The PERL script /etc/csf/lfd.pl which is running as a daemon, when we enable CSF UI, checks incoming headers, and it requires them to be capitalized.

For example:

if ($header{'Content-Length'} > 0) {
if ($header{'Content-Length'} > $maxbody) {
and

if ($header{'Content-Type'} =~ /multipart\/form-data/) {
$client->read($fileinc,$header{'Content-Length'});
} else {...

Hi There,

Today i've received this e-mail from MaxMind about their changes to the API usage:

Hello,

We are decreasing the daily download limit for GeoLite accounts, according to the schedule below:

Date of update
Thursday, February 15, 2024

Thursday, February 22, 2024

Thursday, February 29, 2024

Thursday, March 7, 2024

Thursday, March 14, 2024

Thursday, March 21, 2024

New daily...

Hi,

We appreaciate all the work done on CSF!
However, we are not able to set both source and destination IP address in csf.allow.
Therefor we need another work around and set it manually in iptables.

Please add the option to set both source and destination IP. This would greatly improve on CSF.
Something like
tcp|in|d=443|s=10.0.0.2,d=172.0.0.2 #Allow tcp-in from 10.0.0.2 to port 443 on...

Hi! I am a user of cpanel 10 y. now
Last 1 y. i test some servers with aapanel and after of 9m test i have add it to live server 3 month now!
The csf is one of my favorite tool and is the ONLY TOOL THAT I AM MISSING from cpanel!
Has anyone else tried to install the csf in aapenel? has any one try to add it to difrent system ?

Specifically in my case, I am just having to do a migration to a new OS, and new cPanel.

The IP address of the server will eventually be the same.

Ideally, no systems should even notice.

I would like to preserve my settings and IP block / whitelist tables.

I expect it may be a copy of a number of files. But I don't know which ones are particularly important or even should not be copied over....

SYSTEM INFORMATION
OS type and version Rocky linux 8.8
Webmin version 2.101
Virtualmin version. 7.8.2
Config server Firewall(CSF) verison 14.20(generic)

I want to see alerts of outgoing emails from my server when they cross a certain limit and I have configured everything accordingly but alerts are not coming in my given email. Everything is working fine except Relay Tracking. We are using...

Hello, please add support for Debian 12.

Dear MaxMind customer,

We’re writing because, between July 15 and August 14, we saw GeoIP download requests from your account that are not being sent with HTTPS (see details below). To improve our server infrastructure and allow for better performance and efficiency, MaxMind will begin requiring HTTPS for GeoIP download requests in March 2024. To help customers get ready for this change, we will...

Hi,
Currently in the watch/search log in CSF we only have :
/var/lib/mysql/myserver.myhost.err

Do you think it would be possible to have also the mysql Slow Query Log file access ?
/var/lib/mysql/myserver-slow.log

And why not also the general log ?
/var/lib/mysql/myserver.log

Thanks
Best regards

Hi.
Is possible to have an enable on/off setting that could be set to add white listed IPs in cPhulk as well?

This will be a great addition, right now it should be done manually and most of the time is forgoten and is not white listed in cPhulk.
Also, Could it be possible that when doing a search for a blocked IP that the search could include cPhulk?

Regards,
Sergio

This double not seems like an error:
»
csf.ignore - a list of IP's and CIDR addresses that lfd should ignore and not
not block if detected
«
at

Hestia CP is fork of Vesta CP.

Vesta CP - Support added in CSF v13.05 ( changelog )
Hestia CP - Support will be added in which CSF version?

I was able to get CSF working on Hestia CP using the following simple sed snippet (from within the install directory):
find . -type f -exec sed -i 's/VESTA/HESTIA/g' {} + && \
find . -type f -exec sed -i 's/Vesta/Hestia/g' {} + && \
find . -type f -exec...

Hello,

Having too many data in /etc/csf/csf.deny makes it impossible to edit the file in a web-interface of Directadmin.
It is a built-in limit in DirectAdmin when a loading variable 'POST' is limited to hard-coded 125749 bytes. Whenever a 'POST' request of a bigger size arrives it gets rejected by DirectAdmin and no changes are actually saved.

In Directadmin logs one can see a line of the...

Simple - Add a quick deny form to the top of the page or in the header.

Thanks! Have a great day!

That.Is.All.

Hello ,

Will Plesk panel support come in the near future?

Would it actually be good? I don't know your roadmap but I think plesk panel is really necessary.

Hi,
I have configured below settings in csf.conf
LF_HTACCESS = 5
LF_HTACCESS_PERM = 1
HTACCESS_LOG = /usr/local/apache/logs/error_log
PORTS_htpasswd = 80,443

This settings blocks the IPs which makes brute force attempts to password protected directories through http requests, apache logs :

AH01618: user not found: /manage/
AH01618: user not found: /manage/
AH01618: user not found:...

I'm getting a lot of single IP's hitting multiple domains on a server in a DDOS attack. Something like this - 1x IP (sometimes 3, 4 or more) calling:

domain1/index.php
domain2/index.php
domain3/index.php
domain4/index.php
etc

Often they will call 20 url's on the single domain and hit 5,10,20 domains at once, over loading the server. Some of the URL's exist, some don't.

A simple way to block...