ConfigServer Community Forum

Hello,

I run CSF on a cPanel server. CSF has MaxMind GeoLite2 Country Database MM_LICENSE_KEY and CC_SRC = 1 set and working ok. Example:

csf -i 66.165.246.164
66.165.246.164 (US/United States/waytotheweb.com)

I use CC_ALLOW option to add a couple of countries I want to whitelist but the problem is I'm still getting those countries IPs blocked (in temporary block list).

Now I created a...

Hello,

After upgrading to Rocky Linux and latest cPanel install, they wont allow Host Access Control anymore. So, I am trying to block all SSH connection except allow IP in the hosts.allow:

=============================
ALL : 1.1.1.1 : allow
sshd : 1.2.3.4 : allow
sshd : ALL : deny
=============================

What rule in the CSF can be defined to achieve the above SSH to block all incoming...

I am a victim of (D)DoS attacks for at least 2 years now from a very persistent attacker. The attacks are coming from spoofed IPs and the attacks are so low that it isn't distinguishable from normal traffic according to my provider (Hetzner).
CSF is able to detect them and block it according to the logs from what I can see in the /var/log/syslog file as the attacking IPs are there. Yet CSF is not...

On March 22, I discovered that SOME emails to users on my server were being returned to senders. Some were definitely coming through, but some weren't. I ended up having to disable CSF, at which time hundreds of emails started to come in.

This problem didn't happen on March 21, so it was a new issue after I hadn't changed anything. So it had to be something automated.

These IPs were in my Temp...

Hi everyone,

I'm having problems with PID.
Every hour I receive emails telling me:

Excessive resource usage
Resource: Process Time
Exceeded: 81271 > 5000 (seconds)
Executable: /usr/lib/systemd/systemd
Command Line: (sd-pam)
PID: 908897 (Parent PID:908891)
Killed: No

I get emails like this about lots of other PIDs. I've already tried to kill them or increase the duration of the PIDs in my...

Hello everyone, I hope you are well!
I've been having problems with CSF for a few months, even though it's the only firewall working on a cPanel server, when using the rules below:

tcp,udp|in,out|d=2087|d=0.0.0.0/0
tcp,udp|in,out|d=2087|d=::/0
tcp,udp|in,out|d=2086|d=0.0.0.0/0
tcp,udp|in,out|d=2086|d=::/0
tcp,udp|in,out|d=2084|d=0.0.0.0/0
tcp,udp|in,out|d=2084|d=::/0...

So I turned on PT_All_Users option check and started getting excessive usages warning emails:

Time: Sun Mar 17 13:36:39 2024 -0500
Account: mailman
Resource: Process Time
Exceeded: 3155 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/python/2.7/bin/python2.7
Command Line: /usr/local/cpanel/3rdparty/bin/python2 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s...

We just ran updates on servers and now on multiple servers I have seen this issue. Customers are having issues connecting to ports that are only available with whitelisting. When I check IP's I see this

csf -g XXX.XXX.XXX.XXX

Table Chain num pkts bytes target prot opt in out source destination
No matches found for XXX.XXX.XXX.XXX in iptables

ip6tables:

Table Chain num pkts bytes target prot...

Every once in awhile, something on my server will get hung up and cause a temporary load spike up to about 10. And then every once in a blue moon, something will REALLY get hung up and cause a load spike up to 100!

I've always had CSF to email me when the load is over 6:

PT_LOAD = 30
PT_LOAD_AVG = 5
PT_LOAD_LEVEL = 6
PT_LOAD_SKIP = 3600

I'd like to keep that in place, but I'd also like to use...

I'm running CentOS v7.9.2009 with WHM/cPanel. I use Cloudflare and CSF with the Cloudflare extension.

A few weeks ago, my sites started throwing intermittent Cloudflare 520 errors. The server load was fine and there was nothing in the Cloudflare logs, but I saw tons of these in /var/log/messages:

Feb 5 20:12:08 xxxx kernel: Firewall: ICMP_IN Blocked IN=venet0 OUT= MAC= SRC=13.234.35.125...

I really much appreciated and want to thank you for the implementation of iptables-nft support.

As CPanel's Host Access Control dialogue on Rocky Linux 9.2 and WHM 114 showed errors I solved that by removing firewalld and installing iptables-nft. CSF and Host Access Control both work now without problems.

While reading about nftables I stumbled about the following Redhat documentation stating...

On April 1st 2024, Google will implement a new pricing model that will significantly reduce the free tier usage of reCAPTCHA and introduce new prices for the reCAPTCHA Enterprise service.

A different firewall that we use has developed their own bot protection technology in preparation for this change, which will replace Google's reCAPTCHA.

Are there any plans to replace reCAPTCHA or support...

Hi,

I'm trying to figure out what configuration setting within ConfigServer Security & Firewall is causing SMTP emailing with 3rd party providers (in our case Mailgun) from working... If I disable ConfigServer Security & Firewall then the email sending works fine.

WordPress SMTP Mail Log

Versions:
WordPress: 6.4.3
WordPress MS: No
PHP: 7.4.33
WP Mail SMTP: 3.11.1

Params:
Mailer: smtp...

Hello,

I see one IP address blocked on CSF:
# csf -g xxx.xxx.xxx.xxx
(...)
IPSET: Set:bl_CXS_LF_HTACCESS Match:xxx.xxx.xxx.xxx Setting:CXS_LF_HTACCESS file:/etc/csf/csf.blocklists
(....)

As I see on LFD log, the IP was blocked by LFD for htpasswd fail.

However, I'm unable to unblock it from SSH by csf -tr or csf -dr command. Which command I should use to unblock this IP address?

Thanks.

We have this error on direct admin csf install:

Security Error: Invalid parent
Information saved to

Contents of /var/lib/csf/da1709071834.error:

To disable DirectAdmin session checks, create a touch file called /var/lib/csf/csf.da.skip

Security Error: Invalid parent

Session ID =
Session File ...exists.

Environment data:
REMOTE_ADDR =
SESSION_KEY =
SESSION_ID =

Session data:
ip = []...

Hi
there is one of my accounts in the server that keep getting his IP blocked by the firewall because of multiple time failed logins to his email.. we tried to solve the issue by changing his passwords and removing his email accounts from all devices but it still its happening
is there a way to tell the firewall to not block this 1 account no matter what happen?? I tried to look around...

Hi,
either I don't know how to use it or csf.pignore is not working as it should, this is what I tried so far:

# stop monitoring wordpress breakdance /tmp files
dir:/tmp/systemd-private-*-ea-php*-php-fpm.service-*/tmp/
dir:/tmp/systemd-private-*/*
dir:/tmp/systemd-private-*
dir:/tmp/systemd-private-*-ea-php81-php-fpm.service-*/tmp/breakdance-ffea200c/twig-auto-generated-cache/*
and
# stop...

I’m getting a number of emails from CSF for “Suspicious process running under user ____” for Wordfence logs.

Command Line (often faked in exploits):
php-fpm: pool website_url

Files open by the process (if any):
/dev/null
/tmp/.ZendSem.NCrsJg (deleted)
/home/server/public_html/website_url/wp-content/wflogs/ips.php
/home/server/public_html/website_url/wp-content/wflogs/config.php...

Hi there,

for the geolocational blocking module for CSF, if I was to only allow the UK, Would this also include the south of Ireland (Republic of Ireland)?

Hello,
I have a new VM cPanel server runing AlmaLinux 8.9, and after installation of the CSF the server wont start after a reboot.
I have reinstalled the OS and cPanel multiple times, ad it runs fine until i instal CSF and than rebott the server.

I realy need advice in this problem.

Beste regards