ConfigServer Community Forum

Hello
WireGuard and Tailscale becomes used alot.
If I make no mistake anabliing it needs setting up things outside of the CSF UI or standard cfs.conf
Suggestion : integration as a checkbox option in the UI or config
Thanks
Best regards,
Yves

Hello,

Suddenly csf stopped working because one table in iptables was missing. Then, it created a file csf.error and poured in some smart detection text to tell the admin, why and how he could be smarter. My server remained exposed for more than six hours. I could only notice when I tried to block an offending IP in the cluster and the affected csf installation refused to connect.

Then, csf was...

Hestia CP is fork of Vesta CP.

Vesta CP - Support added in CSF v13.05 ( changelog )
Hestia CP - Support will be added in which CSF version?

I was able to get CSF working on Hestia CP using the following simple sed snippet (from within the install directory):
find . -type f -exec sed -i 's/VESTA/HESTIA/g' {} + && \
find . -type f -exec sed -i 's/Vesta/Hestia/g' {} + && \
find . -type f -exec...

Hi :confused:

I noticed this content mentioned on readme
Local IP addresses cannot connect to the UI (i.e. all IP addresses configured on the server NICs)

That seems as asking feathers from tortoise but reasonable to me and my favorite firewall. you guys can give me a feather :cool:

I dont want to go through public IPs to access to GUI often So i'm asking is there any trick or workround to...

Hi all,

I suggest that if it's possible to add an option in the CSF to block the desire email address only on many wrong SMTP/IMAP/POP3 logins instead of blocking the whole IP , in both directadmin and CPanel . It can be an email address suspension with a notification email .

Since the current blocking the whole IP causes all other company employees under the same IP to be blocked also , and...

I have private custom ipset-managed blocklists on my system that get wiped out whenever csf is restarted,because, of course, csf is unaware of them. This poses a management problem.

Is there some way to inform csf of the existence of these ipsets? I am only aware of the support in /etc/csf/csf.blocklists, which is geared entirely to public lists dowloaded from external URLs.

The kind of...

CSF is great but I'm missing a LF_TEMPBLOCK_ALERT = x option.

You can use the LF_EMAIL_ALERT or LF_PERMBLOCK_ALERT options, but since permblocks won't be automatically removed (normally) and I do want to be alerted about other options (which I guess more people would like), the tempblock option is missing.

Temblocks will be removed automatically and generate a lot of email alerts, which in a...

We're 2 years further now and with Centos 8 this is really starting to get interesting.
In fact it lies in the netfilter's idea's to in time replace iptables with nftables.

Are there any plans from configserver to create a CSF firewall which works with nftables? Any insights on this?

This IP is pounding one of our servers

These are from exim_mainlog:
2020-02-26 17:50:18 dovecot_login authenticator failed for ( ) :49078: 535 Incorrect authentication data
2020-02-26 17:50:20 dovecot_login authenticator failed for ( ) :43772: 535 Incorrect authentication data
2020-02-26 17:50:24 dovecot_login authenticator failed for ( ) :19374: 535 Incorrect authentication data
2020-02-26...

Hi fan of the product and thanks for offering it for free !

I had just a question/suggestion is it possible to list the ports separate from the config.
Or a port per line?

To have to go into the whole config to open ports is a bit confusing and the overview is lost since there is no order in the text line it allows for easy mistakes.
It's not a biggie just wondering if it can be formatted...

Two accounts need to regularly login to my server via SSH and sync, so I end up getting a ton of emails all day long.

Can we add an option to ignore certain users when they login via SSH? (i.e., no email alert)

As it stands now, I'm going to have to disable LF_SSH_EMAIL_ALERT entirely, which will weaken security to my other accounts.

Just installed on a new Ubuntu 20 desktop. It turns out that Ubuntu has the iptables binaries in /usr/sbin/ now instead of /sbin/ .

On installing csf with the install.sh script, it failed to pick this up and the iptables locations in the csf.conf file were left as /sbin/

When these were changed manually the perl test script still fails to locate iptables.
sudo perl...

Hello,

Has the idea of a rule cluster been explored?

I think it would great if we could use cPanel API tokens to have servers share their deny/allow rules or deny IP list with others servers in a cluster of servers since attacks often travel along IP ranges and what not.

Maybe a caching system that you can set the frequency of deny IP sharing.

And to stack on top of the idea of clustering,...

I think it will be a long time before counties are assigned IP blocks :) so you may want to change the spelling to 'Country's' on the config file for CSF:
An example would be to list port 21 here then counties listed in
CC_DENY_PORTS cannot access FTP

on cpanel I can set LF_CPANEL_ALERT to get a mail if a user login into cpanel. On the DA version I can't find such an option.

can this function also be made available for DA? would be very practical.

thanks

This option can mask a users real IP address and hinder security. You should disable WHM > Tweak Settings > Proxy subdomains

This option does not find out in cPanel v86.0.18

DSHIELD blocklist is now secured (http s ) at:

/etc/csf/csf.blocklists
# DShield.org Recommended Block List
# Details:
#DSHIELD|86400|0|

Apr 8 11:27:50 server lfd : Unable to retrieve blocklist DSHIELD - Unable to download: Can't connect to www.dshield.org:80 (Connection timed out)
Apr 8 11:32:50 server lfd : Unable to retrieve blocklist DSHIELD - Unable to download: Can't connect to...

Tried to find something that allowed checking of IPs against AbuseIPDB and then if found then block, but couldn't find anything out there.
Hence writing this up.

Hello.

We suggest to add to the csf.blacklist.

Thank you!

We are using the csf RELAYHOSTS setting to prevent lfd from creating temporary firewall entries for customers who successfully check email. We are not on cPanel, so the setting isn't normally there, but it works perfectly once added. We have a separate daemon that maintains /etc/relayhosts with the IPs of recent successful connections.

The problem is that during a csf upgrade it seems to strip...