ConfigServer Community Forum

Hi! I have a VPS running Virtualmin/Webmin and have CSF installed and mostly tweaked to ignore most of the false positive type of processes. A few weeks back - prior to installing CSF, I had someone exploit one of my wordpress sites and they managed to lay waste to several of my sub servers. Over the weeks - I have wiped most traces that I could find (without standing up a brand new server) and I...

On one server, that has been running fine for a couple of years, I notice now that /etc/csf/csf.deny is empty of all IP listings, though it shows the initial remarked text.

I still receive email LFD notices saying there has been permanent bans of IP addresses, and the latest timestamp of the file was the same as the time of the last LFD email.

Please advise.

CSF, great product, thanks.

I need clarification about the error message I am receiving for a particular client.
dovecot_plain authenticator failed for ( ) :51008: 535 Incorrect authentication data (set_id=xxxxx@xxxx.xxx.xx)

The xx ip address I know is their office IP address, however the IP address 10.242.59.0 I don't recognise, Google search sees it as a private address.
What does the first...

First and foremost, CSF is working as it should. Thanks for a great product!

The problem is that I have many clients getting their IP blocked from failed logins to SMTP. Oddly, it only effects Outlook/Office365.

Full disclosure this is due to the client having bad credentials set in their Outlook client. This is NOT any problem with CSF.

The firewall is correctly blocking these bad logins. As...

When CF_ENABLED is set to 1, Is there a log of CSF's interactions with CloudFlare?

I have mod_remote IP setup and working, mod_security is setup and working, and in the LFD log I can trigger the mod_security rules and see a block come up (I am testing via TOR):

Jul 16 23:01:42 myserver lfd : (mod_security) mod_security (id:210860) triggered by 162.247.74.216 (US/United...

i have problem with *MESSENGERV3* Error: The home directory for csf does not exist
I was useradd csf -s /bin/false and then check lfd.log

Jul 10 23:39:32 lfd : Messenger HTTPS Service starting...
Jul 10 23:39:32 lfd : Messenger HTML Service starting...
Jul 10 23:39:32 lfd : *MESSENGERV3* Error: The home directory for csf does not exist
Jul 10 23:39:32 lfd : Messenger TEXT Service starting......

Hello,

I have a problem with my AWS EC2 VPS.
I have AlmaLinux 8.4 with WHM/cPanel and everything is running very well so far.
But as soon as I enable CSF, my server IPv6 is blocked and my server has no IPv6 anymore.
When I disable it, everything works again.
In CSF I have IPv6 enabled.
Does anyone have any idea what this could be?

I have added a few screenshots

I'm having another issue with CSF blocking inbound emails from Gmail. I logged into multiple gmail accounts and tried to send email to one of our servers and the emails are never received. After I disable CSF firewall i can then receive email from all 3 gmail accounts. I flushed all IP blocks, and added Googles entire IP block 209.85.166.0/255 to CSF ignore. Restarted CSF and still CSF is...

Hello,

I've created a bash script which should be triggered by LF_DIST_ACTION but doesn't appear to be. I've set the execute bit and csf.conf appears to be set OK.

root@server # grep ^LF_DIST_ACTION /etc/csf/csf.conf
LF_DIST_ACTION = /root/LF_DIST_ACTION.sh

If I call the script directly over the command line seems to work fine. It sends me a Pushbullet alert, which is how I know if it has or...

Hello,

I have already bruto force protection for WordPress:
# WP-LOGINS
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] \w*(?:GET|POST) \/wp-login\.php.* /)) {
return ( WP Login Attack ,$1, WPLOGIN , 5 , 80,443 , 1 );

But how can I do this for Magento?
Magento 1: /index.php/admin/
Magento 2: /admin

Hi,

I had to disable cfs because it was completely blocking all the requests coming from a client using IPv6.

I had added the IP to the allowed list but it made no difference.

Does anybody have a clue why this is happening? And more importantly, how to fix it?

Thank you.

Hello, i have an dedicated bare metal server with Hetzner but everyday I'm getting emails for outgoing bruteforce and portscan attacks.
My server is a shared hosting server, we're selling shared and reseller hosting through the server and server have almost 900+ cPanel Accounts.
So how can i find out which account is sending outgoing bruteforce attack and how can i stop it ?
I am mentioning some...

Hello,

I hope everyone is well.

I have a need to block countries, but allow dns querries into the server from everywhere, including those countries I've blocked.

What is the simplest solution with CSF for this?

Thanks in advance for any help.

On one of my servers, lfd keeps crashing with the error shown in
CSF version is v14.10

Any help or insight on how to approach/fix this error would be appreciated.

Jul 2 09:42:12 server lfd : Main Process: Unmatched [ in regex; marked by line 2.
Jul 2 09:44:16 server lfd : Main Process: Unmatched [ in regex; marked by line 2.
Jul 2 09:46:46 server lfd : Main Process: Unmatched [ in regex;...

I am trying to install owncloud on a Ubuntu Servers as a docker container.
I am following this documentation.

If I disable CSF all works, but if it's enabled, it doesn't and I see these messages in the logs.

Now, as I see CSF is blocking the traffic between the docker containers or just the port 8080? It's not clear for me.

Any tips?

I setup CSF with ansible using the following config:...