It seems that csf runs csfpost.sh with sh instead of just using the shebang that was specified. This causes some unexpected behaviour if you need more logic in these files.

I can only reproduce this on Ubuntu, CentOS has no problems. I've added the following code to csfpost.sh:

#!/bin/bash
if ; then
echo Please do not use sh to run this script ($0)
fi

Running /etc/csf/csfpost.sh
Please...

Has any thought been considered into allowing Include statements in the ignore files (csf.ignore, csf.pignore, etc)?

The current Include system seems to only work in the csf.allow and csf.deny files.

Hello,

The address for the blocklist has changed to SSL only - Accessing it using http: results in an error page.

WIth http: address:

Apr 3 15:35:45 mail1 lfd : Unable to retrieve blocklist GREENSNOW - Unable to download: No Host option provided
Apr 3 15:40:44 mail1 lfd : Unable to retrieve blocklist GREENSNOW - Unable to download: No Host option provided
Apr 3 15:45:44 mail1 lfd : Unable to...

Hi,
I had an issue with the firewall blocking a client who's password was changed and her phone kept trying to login triggering the bad login attempts. Since the firewall on the server changed, it took me a while to figure out that is what was happening.

I think the firewall should not have blocked her IP over the cell phone issue. If making a brute force attack, one would not use the same...

Hi,

We tried DirectAdmin and found out that the index.raw link is not very useful. It opens in the same windows and effectively removes all menu from directadmin (only showing the csf itself).

We can only go back with back button which is pretty cumbersome...

However we discovered that without index.raw it actually works very nice and decently. Any reason not to do it like this?

Please see...

csf -r return code is 0 if CSF is disable

This cause issue with config management and scripting
trying to remote reload csf after config change but if CSF is disable the csf -r still return 0

Thank you.

I would like an easier way to have the RBL Checker simply check the main IP of the server. I do not want to waste time checking other IPs, as we route all mail out through the main IP, even for customers with dedicated IPs.

Correct me if I'm wrong, but currently, the only way to do this is to edit /etc/csf/csf.rblconf and specifically list every single IP on the server as disableip:1.1.1.1 and...

Just wanted to give you a heads up in case you haven't seen this yet:

Previously when I last looked at the new databases they didn't support ASN lookups but it looks like they have added GeoLite2 ASN support now (in a separate database):

Hello,
The option for block distributed SMTP Logins is very usefull, but is necessary some advanced option to permit the automatic block of one email account involved in more than X continous distributed smtp logins.

For example, I have configured the distributed smtp logins detection to 3 diferent IP. Recently i recived from my server over 15 continuous mails alerting for distributed smtp...

I know that this has been bounced around in the forums for a while so I thought it should go in the suggestions area. We are seeing more and more servers with docker installed and it would be nice if CSF played nice with it out of the box. Basically all that needs to be done is detect if docker0 interface is present then add rules like the ones below. These are the rules that we normally add to...

Now with the recent added cluster actions the only action that we are missing is cluster ignore . Would it be possible to add? (I'm thinking the reason that it wasn't added was because the login failure daemon would have to be restarted after )

See

Dear ConfigServer team,

We're using CSF + LFD on many servers, with great effect ;)

One thing that could be improved in my opinion, is the detection and blocking of slow brute-force attackers, i.e. logins with long intermittent pauses, but continuing over long periods of time.

We know the effectiveness of detection of burst attacks, when more than LF_ login failures occur within LF_INTERVAL....

Would it be possible to somehow put GeoIP in regex.custom.pm?
Something to filter IP by countries and work differently by countries?

Thank you.

One class of malicious user/uncooperative person is the prober. This is the source of most traffic on my websites, and consists of trying to find weaknesses to exploit.

Typical accesss are to files and directories with names like these:

wp-login.php, wordpress, wp-includes, PMA2017, admin, mysql, db, database, phpmyadmin, program, myadmin...

Why can't csf add an option to look for sequences...

I'm not sure exactly how to call it.
I have the same problem on multiple server, we are giving email services to a company which has 10+ person working in an office . The office connects to the internet via a NATing router, so everybody is seen coming from a single IP.
Now if a single person fails his password a couple time from , that IP will be banned, and everybody will loose access .
So...

The following is a list of features that I think are necessary to improve CSF and LFD integration; most of them are related to CSF blocking IPs:

- CSF should add the same information on manual blocks (csf -d) to the csf.deny files as LFD does (date, geolocation and hostname)

I'm requesting this, since when spammers strike our servers from many IPs a little bit at a time (instead of just a...

Hello,

Currently we are using CSF on our servers and we are testing with the recaptcha ability to unblock the IP address.

Now our customers are possible to unblock their IP it could be handy if they know why they are being blocked.
Is there any way to make this work?

Example, I am blocked and try to visit the server it shows me the message that I am blocked.
There is an option to unblock by...

Right now, the page is served out with status 200, which means that if for example a search engine crawler gets blocked, it will update its index with the blocked page content. I've added the following to the top of index.php in ~csf/public_html/index.php for now: but an .htaccess rule could also be set up to do the same thing.

We have using this useful tools, we found totally helpfull,

we suggest to add a option to maintain a ip blocked even if we flush the all the blocks, like adding a new file called (ex : csf.unignore) any ip in this file will not deleted from the ip_tables and will be permanently in the block unless we remove it from the file,

i hope the suggestion has a meaning for you.