I would like to exempt alerting for our own activity in SSH - we keep a window open all day for quick access.

This results in wasteful emails all day
Subject: lfd on XXXXXX: Excessive resource usage: XXXXX (19422 (Parent PID:19420))

Time: Mon Oct 2 07:00:11 2017 -0400
Account: XXXXX
Resource: Process Time
Exceeded: 407508 > 1800 (seconds)
Executable: /usr/bin/bash
Command Line: -bash
We don't...

I want to be able to include command separated port numbers in the csf.deny file

For example I have the following:

tcp|in|d=80|s=89.248.160.0/21 scannerbots googlemapsexploit QUASINETWORKS SEYCHELLES - do not delete - Tue Apr 11 14:49:02 2017

And I want to block port 443 too

tcp|in|d=80,443|s=89.248.160.0/21 scannerbots googlemapsexploit QUASINETWORKS SEYCHELLES - do not delete - Tue Apr 11...

Please consider putting the firewall disable button far away from the Flush all Blocks . Or maybe you should add an intermediate question like Are you sure? :)

Today, I happened to want to release the firewall from the phone, by mistake I happened to touch the firewall disable button and with that I was left with the server completely disconnected from the network. :eek: :eek: :eek:

Hello, we are using lot's of nat in 10.0.0.0/8 for our servers. is there a possibility to add bogon network blocking to only some interfaces?

like we have a public ip on eth0 but on eth1 and eth2 we have 10.0.0.0/8 addresses. on eth0 we want bogon network blocking.

greetings from holland and many thanks.

I need an option to not flush nat table in iptables, because I have rules in it, and they are managed by an other software, and it cause big problems if that rules are disappearing for a while (I've thinked about saving in pre script and restoring in post script, but it's not ok if there is just a second when they aren't in the nat table)

Dear developers,

Webmin is switching to SPA. We need to inject certain triggers for module to operate correctly.

At the moment we have in CSF the ability to inject stuff into head section and before the closing tag (footer).

We also need the ability to add `data-*` attributes to ` ` tag and most importantly ability to inject tags/containers into the body tag.

Is this possible that you could...

Im using ConfigServer MailScanner Front-End where client IPS can be blocked by adding an entry into csf.deny. Ive been blocking the IP's for the persistent low scoring spam emails.

It is my understanding that due to the upper limit of IP's in csf.deny, the IP's for blocked emails will eventually get rotated out of the file.

Would it be worthwhile to consider having a separate file that could...

Please allow status of restart to display at the top of the page so we no longer have to scroll all the way down to the bottom of page to see the same.

There's a lot of work and care put into CSF to provide auto-update functionality and more. Has there ever been any push to wrap CSF into an .rpm/.deb for various systems and serve that out? Perhaps provide a repository for major OS's containing just those packages, and provide updates through the system's update functionality rather than a update script?

If the messenger is never enabled then the file /var/log/lfd_messenger.log is never created and you get this cron.daily error emailed to you:

etc/cron.daily/logrotate:
error: stat of /var/log/lfd_messenger.log failed: No such file or directory

I believe that adding the option missingok to the logrotate lfd_messenger.log entry will allow logrotate to skip the log file if it doesn't exist.

Hello,
The 99% of my distributed smtpauth attack alerts are for 535 Incorrect authentication . It would be nice if the alert is sent only when successful access to the email account is detected.

CF has a 403 / 404 block can we consider a 401 block as well please.
too many 401 attempts is a sign of server attack

see

Hello,

In the csf.blocklists file, there's an entry:

OPENBL|86400|0|

I believe this entry should be considered for removal. The base_30days.txt file no longer exists, and by visiting and searching the internet (ie, openbl.org's twitter page), it appears the company has gone under, for financial reasons.

When the openbl.org blocklist is enabled, in the /var/log/lfd.log file, every 30...

Greetings, CSF Team.

In its current form, CSF (when configured to also block outgoing connections) will add IP blocks as a DROP rule for outgoing conncetions. Outgoing connections should never be dropped. This can lead to a myriad of issues in the right environment, and at least a few issues in most environments.

A DROP rule in iptables does not send an error/rejection packet back to the...

How about a feature to permanently block IP by putting them in something like csf.pdeny
Right now if the deny_ip_limit is set at 100 and then if all the 100 IPs are filled up and CSF starts removing from the oldest IP blocked order the ones at the top get removed. But there are certain IPs which I would like to keep permanently blocked even if the limit has been reached and csf removes the oldest...

Here is the snippet from /var/log/secure

Sep 16 10:57:47 s3 proftpd : 10.10.10.10 (119.18.153.66 ) - USER admin (Login failed): Incorrect password
Sep 16 10:57:54 s3 proftpd : 10.10.10.10 (119.18.153.66 ) - USER admin (Login failed): Incorrect password
Sep 16 10:57:58 s3 proftpd : 10.10.10.10 (119.18.153.66 ) - USER admin (Login failed): Incorrect password
Sep 16 10:58:01 s3 proftpd :...

Create a temporary ignore list just as temporary block/allow.

Allow could set the server wide open, but in an ideal situation, we just want a temporary ignore, so an IP of an developer is not blocked for x days, but have the other restrictions in place.

Now we need to specify the ports for a developer and create an temp allow. (or make an option as template you can select for an temporary...

Hello,

each time a new/changed blocklist has to be edited, it's needed to do it on all cluster members.
Any plan to have the cluster master in charge of download all blocklist and to distribute them (as single unduped file) to all cluster members? It would greatly speed up the cluster blocklist update.

Best
Luca

For IP alerts blocked by failed access attempts, it would be nice to be able to indicate that it only alerts when the country of the blocked IP is of interest. For example, in my case I expect to receive alert when a Chile IP (CL) is blocked, but not when blocking IP from China, Thailand, India, etc.

(I take this opportunity to thank you for the development of this firewall. I use it on all my...

Always after patching Dovecot CSF gives:

Cipher list []. Due to weaknesses in the SSLv2 cipher you should /etc/dovecot.conf and set ssl_cipher_list to explicitly exclude it. For example:
ssl_cipher_list = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP

This ssl_cipher_list parameter is set in /usr/local/directadmin/custombuild/custom/dovecot/conf/ssl.conf
And via build dovecot finally also in...