Hello,

A few weeks ago I upgraded my system from Debian Jessie 8 to Debian Stretch 9 but till yesterday I didn't notice this issue. I tried to connect to an external ftp and I connect but it is not possible to list the directory contents, strange because before the upgrade with the same CSF conf I was able to connect to this ftp. I double check CSF conf and the port 21 is in TCP_OUT, SPI...

I want to redirect the blocked page to the new address

Example :

When the user was blocked Go site2.com

First, thanks for all of your incredible software, especially CSF and Mailscanner, which are amazing! Regarding CSF, I have a usability suggestion - have you ever considered moving the Quick buttons to the top of the page in their own section? Quick Allow, Quick Deny, Quick Ignore, and Quick Unblock. It's just not very quick the way it is right now having to scroll down the page to get to them. I...

Starting yesterday, all of our cPanel servers are getting hit with a massive amount of SMTP Authentication failures, from distributed IP addresses. Yesterday alone, we are seeing over 8000 different unique IPs involved in these distributed attacks.

The flood of LFD emails caused us some email issues. I tried to disable SMTP AUTH failure emails, or at least route them to a different email...

Hello there,

Nearly all of my servers that run Exim are constantly being attacked by remote nodes trying to brute through an AUTH command before advertised. Every day I get a big list of AUTH command used when not advertised in logwatch.

On a daily basis I'm blacklisting these remote nodes, because I know for certain they are scanning for open relays. Quite a big giveaway is also the HELO being...

can CSF be updated to use the new Cpanel mod-evasive Apache module

CSF is absolutely fantastic, we use it on many of our servers, but on our cPanel servers in a cpanel DNS cluster we are constantly bombarded by emails about WHM/Cpanel root access alert due to each of the 5 servers in the cluster remotely pulling various DNS data as part of cPanel's built in DNS cluster management. Every time a domain is edited by a customer or by management, every server reports...

I find the style of csf's Off/On setting buttons confusing at times. I am not sure if a button is Off or is On. I am used to the Off/On button styling used on the iPhone which uses a round white slider with button background of green=on and white=off (with optional 1/0 indicators in the background)..

Perhaps make csf's buttons status clearer by styling the current state with bold red text and...

it's possible to do this from a simple bash command but it might be useful to less skilled users to have an option where LFD can also add an ip ban to cloudflare when the user provides an api key

might be too much to maintain for permanent rules, maybe make it part of the tempban feature?

when the feature is enabled, csf -td or csf -tr could also do the api call to cloudflare

note that...

EXPECTED:
PT_SSHDHUNG is supposed to kill sshd: unknown and sshd: unknown processes.

PROBLEM:
It doesn t kill sshd: unknown

SOLUTION:
Change the following line in lfd and add a test with SPACE at the end just like this sshd: unknown <-- note the space at the end.

from
if ($cmdline eq sshd: unknown or $cmdline eq sshd: unknown ) {
to
if ($cmdline eq sshd: unknown or $cmdline eq sshd:...

While mailscanner does not provide protection for outgoing spam I guess it could send some alerts when the EXIM queue size reaches a size that could suggest spam is being sent

Your netblock function counts number of block episodes within a class.
I would like one that counts by number of unique IP addresses within a class.

So this didn't work as *I* had intended- by your mentioning ddos mitigation it is clear that you meant this to be use against rapid fire bombardment. I, on the other hand, thought it would be useful to block repeat offender bullet-proof type hosting...

It would be great to have a mysqladmin processlist attached on the warning emails (if it's detected to be installed), since I see on the PS that mysqld was active but I don't know what it was doing. Perhaps a different command from DB Governor can be used instead if it was installed on the server.

Also an iostat -xdk command would be helpful on cases that there's a high IO wait state.

I would like to exempt alerting for our own activity in SSH - we keep a window open all day for quick access.

This results in wasteful emails all day
Subject: lfd on XXXXXX: Excessive resource usage: XXXXX (19422 (Parent PID:19420))

Time: Mon Oct 2 07:00:11 2017 -0400
Account: XXXXX
Resource: Process Time
Exceeded: 407508 > 1800 (seconds)
Executable: /usr/bin/bash
Command Line: -bash
We don't...

I want to be able to include command separated port numbers in the csf.deny file

For example I have the following:

tcp|in|d=80|s=89.248.160.0/21 scannerbots googlemapsexploit QUASINETWORKS SEYCHELLES - do not delete - Tue Apr 11 14:49:02 2017

And I want to block port 443 too

tcp|in|d=80,443|s=89.248.160.0/21 scannerbots googlemapsexploit QUASINETWORKS SEYCHELLES - do not delete - Tue Apr 11...

Please consider putting the firewall disable button far away from the Flush all Blocks . Or maybe you should add an intermediate question like Are you sure? :)

Today, I happened to want to release the firewall from the phone, by mistake I happened to touch the firewall disable button and with that I was left with the server completely disconnected from the network. :eek: :eek: :eek:

Hello, we are using lot's of nat in 10.0.0.0/8 for our servers. is there a possibility to add bogon network blocking to only some interfaces?

like we have a public ip on eth0 but on eth1 and eth2 we have 10.0.0.0/8 addresses. on eth0 we want bogon network blocking.

greetings from holland and many thanks.

I need an option to not flush nat table in iptables, because I have rules in it, and they are managed by an other software, and it cause big problems if that rules are disappearing for a while (I've thinked about saving in pre script and restoring in post script, but it's not ok if there is just a second when they aren't in the nat table)

Dear developers,

Webmin is switching to SPA. We need to inject certain triggers for module to operate correctly.

At the moment we have in CSF the ability to inject stuff into head section and before the closing tag (footer).

We also need the ability to add `data-*` attributes to ` ` tag and most importantly ability to inject tags/containers into the body tag.

Is this possible that you could...

Im using ConfigServer MailScanner Front-End where client IPS can be blocked by adding an entry into csf.deny. Ive been blocking the IP's for the persistent low scoring spam emails.

It is my understanding that due to the upper limit of IP's in csf.deny, the IP's for blocked emails will eventually get rotated out of the file.

Would it be worthwhile to consider having a separate file that could...