ConfigServer Community Forum

Hi,

SMTP Port 465 Open/Enable in IPv4 & IPv6 Firewall configuration but still it is not allowing to connect Gmail,
Error : SMTP -> ERROR: Failed to connect to server: Connection timed out (110).

When i Disable ConfigServer Firewall, it get successful connect & send email via Gmail/Hotmail(Outlook . com) SMTP.

Hi,
Can anyone help me with this. My server provider have granted themselves root access with the username 'tagsupport'. I have no problem with this, but CSF alerts me of the fact literally every couple of minutes. Is there some way I can whitelist this user and/or suppress the alert?

Hi,

not sure if this happens only to me.
I tried to install csf in WHM 11.42.0 (build 21).

The installation is succesful, but i cant see the CSF icon in the plugins list in WHM.

other plugins like softaculous, clamav, are present.

Is it something to do with the new cpanel version ?

thank you

Hi,
in prior versions of CSF, I declared that any IP that makes eximsyntax errors were permanent blocked after 10 errors but now it is blocked only for 3600 secs without being modified CSF. Tried to find the option on where to set this again to permanent but there is no option.

How may I can set eximsyntax to block the IP permanently, I am using CSF 6.47

Regards,

Sergio

I have a new VPS hosted on an openvz node. I'm getting loads of Excessive resource usage / CPU time emails. E.g.

Time: Mon Mar 10 15:44:59 2014 -0400
Account: syslog
Resource: Process Time
Exceeded: 273300 > 1800 (seconds)

Executable: /sbin/syslogd
Command Line: /sbin/syslogd -u syslog
PID: 410 (Parent PID:410)
Killed: No

I know how to cancel these messages, but the CPU time is a little...

Can CSF be setup to block a HTTP post attack? We are getting tons of these requests:

178.239.58.59 - - POST /wordpress/xmlrpc.php HTTP/1.0 404 20531 - Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)
93.174.93.102 - - POST /wordpress/xmlrpc.php HTTP/1.0 404 19918 - Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)
80.82.64.177 - - POST /wordpress/xmlrpc.php HTTP/1.0 404 19918 - Mozilla/4.0...

Hi,
Let me start with this is a single usage server with one thing on it, an up to date WHMCS install.

All of the sudden for the past 2 days I have been getting variations of this:

Time: Sat Mar 1 21:08:17 2014 -0500
Account: mailman
Resource: Process Time
Exceeded: 29752 > 1800 (seconds)
Executable: /usr/bin/python
Command Line: /usr/local/cpanel/3rdparty/bin/python...

Using the variable CC_DENY I've blocked this range of countries

AL,AM,AZ,BA,BD,BG,BN,BY,CN,CZ,DZ,EE,GE,HK,HU,ID,IQ,IR,JP,KG,KH,KR,KZ,LA,LT,MA,MD,MM,MN,MO,MY,NG,OM,PH,PK,PL,RS,SG,SY,TH,TN,TR,TW,UA,VN,YE,ZA,ZM

Now I have a problem, a client can not connect to your provider, he uses the IP: 74.91.18.20

BUT, ip 74.91.18.20 is of USA , and that country is NOT blocked in my range

when I do a search...

My server is Centos 5.6. I use Webmin to manage it. I have csf installed (can't remember if I installed it or what but it's version 6.37), but haven't been using it. I just use the Linux Firewall configuration tool in Webmin. However, my rules do not appear to be effective (working). In the csf configuration of Webmin, when I click on the View iptables Rules button, it appears that none of my...

Hi,

So just recently my own IP was suddenly blocked by CSF which cause some confusion, I have no idea why this happened but well all done and fixed, not the problem I opened this thread for. So while I was still unaware of this being the cause for me not loading my websites (for me) I was using: just-ping . com website to check my server.

There has a HUGE packet lose rate.. pretty much all...

Hello,Guys

I want to block all the Proxy,VPN and RDP to visit my server.

Anyone has got experiences.

Best Regards

Hi,
This is my first post here so bear with me please.
For the past two days, I have been receiving 4 emails repetitively:
Mail 1:
Suspicious Process running under user exim
Account: exim
Uptime: 610633 seconds

Executable:

/usr/sbin/exim

Command Line (often faked in exploits):

/usr/sbin/exim -bd -q1h

Network connections by the process (if any):

tcp: 127.0.0.1:25 -> 0.0.0.0:0
tcp:...

Hello,
we enabled LF_SU_EMAIL_ALERT and we fill file csf.suignore with our usernames but we still receive notification about su actions for those usernames.

We thought csf.suignore should just let LF_SU_EMAIL_ALERT ignore those logins but on description of csf.suignore was written:

# The following is a list of usernames that are ignored during the LF_EXPLOIT
# SUPERUSER check

So there is no...

Lately I've been seeing a lot of botnet activity so I setup a few IFTTT recipes to fire off emails to abuse departments of major dedicated & cloud hosting providers whenever their IPs get blocked by CSF / LFD.

The rules are basically as follows: If new email from search from:root@ lfd blocked softlayer OR theplanet, then forward email to abuse@softlayer and append the message

SoftLayer Abuse...

Hi I've noticed that some SKY IP ranges are not being correctly identified by the CC checking. On one server we have GB ignored, but I keep seeing LFD blocking them.

Time: Thu Feb 27 22:30:36 2014 +0000
IP: 5.65.121.x (GB/United Kingdom/xxx.skybroadband.com)
Failures: x (smtpauth)
Interval: x
Blocked: Temporary Block

If the country is being correctly identified via the geoip lookup - why is...

Hello,

In three installations of VPS with Centos 6, I have have configured csf to exchange information. All the cluster commands works perfect except the remove command.

My own ip got blocked. During the trial to identify, the C Block of my provider got blocked.

I was logged in Webmin in all servers. I have issued cluster remove ip address.

This did not function.

Hello,

I have updated csf to 4.46.

I found that Connection Tracking does not work although those ips are noted in tempip file.

For a very strick connection tracking, I have the following:

CT_LIMIT = 2
CT_INTERVAL = 200
CT_PORTS = 25,137,445

On the above ports there is constant spamming. The third connection should be imposing a temporary block (perm=0). This occurs very rarely although...

I think I am looking at a solution for this...kind of backward, but is there a way to tell CSF to only let IP addresses from USA log into WHM, CPanel, Email etc??

I really need to read up on CSF and understand it, but I am trying to calm a company down who is worried about the number of attempts they have had with people trying to log into their site.

Any help is apprecaited.

I'm just using the new option for using wildcards in logs as followed:
HTACCESS_LOG = /var/log/httpd/error_log /var/log/httpd/domains/*.error.log

Now we have a regexp.custom.pm like this:
if (($config{LF_HTACCESS}) and ($lgfile eq $config{HTACCESS_LOG}) and ($line =~ /^\ \ \ My protection (.*) banned IP: (\S+)/)) {
return ( Mytrap triggered ,$1, bottrap ,1, 80,443 , 3600 );
}

This makes a...

Probably something simple that I missed here, but I'd love some insight.

I changed the default FTP port on my host, and notified my members of the change. For the sake of conversation, I'll say I changed it to 888. I'm running Pure-FTPD, and change the bind port in pure-ftpd.conf.

I can FTP right in because my client is in the allow file, but nobody else can. I added the new port to csf.conf...