I have been running CSF for a long time and recently upgraded from MariaDB 10.1 to 10.2. As part of the upgrade, I decided to clean up the my.cnf commands, including moving to underscores instead of dashes.
This morning, I received a warning during CSF's check stating:
Check MySQL LOAD DATA disallows LOCAL
You should disable LOAD DATA LOCAL commands in MySQL by adding the following to the...
for some time we are working on a new application called StreamFlow
the successor of RequestServer, on our server we use:
ConfigServer Security & Firewall - csf v12.04
where we have to enter all stream IP addresses of our customers manually
this will result in delays for the customer as you may understand.
now we want to automate this, only there is no php script for this
do you have any...
Attempting to start LFD while in TESTING mode does not report the correct error *Error* lfd will not run with TESTING enabled in /etc/csf/csf.conf . Instead, /usr/sbin/lfd attempts to close and unlink the $pidfile /var/run/lfd.pid using an undefined file handle $PIDFILE at line 7186. This causes the error: Can't use an undefined value as a symbol reference at /usr/sbin/lfd line.7186 .
Now I have a server under my hand with csf with DENY_TEMP_IP_LIMIT=250.
250 entry is enough for about 4 minute denys, and there are rotated out.
But it's should deny IPs for 120/60/30/5 minutes...
Is there a way to support ipset for longer denies?
lxc.service (lxc containers) comes with its own set of iptables which are loaded when lxc.service starts. since csf is flushing the iptable entirely when restarted the lxc container(s) loosing connectivity.
lxc.service does not provide for a reload but only restart which in turn is killing any active container and thus interrupting any service provided by a lxc container. Which is most...
Problem: Unable to get updates automatically using csf -u, although manually downloading and reinstalling works. Both mode 1 and mode 2 updates fail. LWP and Tiny are installed, and all other software (wget, cpan, apt) use the proxy successfully.
The csf code is not reading or using the environment set proxy information. Calls to get the updated package occur in URLGet.pm - funtion urlgetLWP...
CSF is blocking SMTP login attempts fine, but LF_EXIMSYNTAX=10 and LF_EXIMSYNTAX_PERM=1 don't seem to be stopping EXIM attacks. Below is an excerpt from my exim_mainlog. These two IP addresses (181.214.206.20 and 181.214.206.133) have been hitting the server with these requests hundreds of times but haven't been blocked. Shouldn't multiple list matching forced to fail: failed to find...
I noticed in your readme.txt about Cloudflare that Automatic blocks via lfd are limited to LF_MODSEC and LF_CXS triggers as only through these can the domain name be determined.
However in csf.cloudflare we can also specify entries with DOMAIN:any to catch all relevant triggers regardless of domain. I'm guessing this is for people who manage all domains on their server via one cloudflare...
I'd like to see LF_NETBLOCK extended to work like the LF_ _PERM triggers, where this can either be a permanent or a temporary ban of a configured length.
Additionally, I'd like to see CC_LOOKUPS info included in the LF_NETBLOCK alert.
Both of these changes can go a long way to help prevent/detect issues where a netblock that impacts legitimate traffic gets blocked, and some intervention...
fw3 (firewall), as deployed in openWRT, is rather bare bones compared to CSF and yet with the increasing sophistication of attacks on residential ip/routers it would be helpful to have a more sophisticated firewall like CSF ported for openWRT routers.
It seems that csf runs csfpost.sh with sh instead of just using the shebang that was specified. This causes some unexpected behaviour if you need more logic in these files.
I can only reproduce this on Ubuntu, CentOS has no problems. I've added the following code to csfpost.sh:
#!/bin/bash
if ; then
echo Please do not use sh to run this script ($0)
fi
Hi,
I had an issue with the firewall blocking a client who's password was changed and her phone kept trying to login triggering the bad login attempts. Since the firewall on the server changed, it took me a while to figure out that is what was happening.
I think the firewall should not have blocked her IP over the cell phone issue. If making a brute force attack, one would not use the same...
We tried DirectAdmin and found out that the index.raw link is not very useful. It opens in the same windows and effectively removes all menu from directadmin (only showing the csf itself).
We can only go back with back button which is pretty cumbersome...
However we discovered that without index.raw it actually works very nice and decently. Any reason not to do it like this?
I would like an easier way to have the RBL Checker simply check the main IP of the server. I do not want to waste time checking other IPs, as we route all mail out through the main IP, even for customers with dedicated IPs.
Correct me if I'm wrong, but currently, the only way to do this is to edit /etc/csf/csf.rblconf and specifically list every single IP on the server as disableip:1.1.1.1 and...
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum