ConfigServer Community Forum

In the Server Services Check section of 'security test', all options are green, so I thought I had passed all checks.

Then I read the descriptions and they seem to _ALL_ be saying that in fact I _AM_ running all of the services and I'd be better off not doing so.

Should those checks not actually show up red as a failure then?

Here's the text displayed in one of them:

On most servers cups is...

CSF 6.47 or maybe a bit earlier version ( I've been on vacation for a several months :) ) seems to have made ALL my carefully researched CIDR block ranges and the few ISO country code blocks I use disappear!!!

I had a few hundred CIDR block ranges in CSF_DENY, and four ISO coutry code blocks established in CSF_config, and now they are totally gone.

ALL the CIDR entries were correctly marked as...

Hi,
just to report the following.

When an IP is added to the temporary list CSF.TEMP, the firewall rules created are as follow:
Chain num pkts bytes target prot opt in out source destination

DENYIN 50 0 0 DROP all -- !lo * 123.123.123.123 0.0.0.0/0

PREROUTING 68 0 0 REDIRECT tcp -- !lo * 123.123.123.123 0.0.0.0/0 multiport dports 80,2082,2095 redir ports 8888
PREROUTING 69 0 0 REDIRECT tcp...

Unable to download: 599 - Net::SSLeay 1.49 must be installed for https support

perl module versions installed:
Net::SSLeay 1.54
IO::Socket::SSL 1.79_01

and yet SSL failure still occurs?

tiny.pm code shows this

sub _assert_ssl {
# Need IO::Socket::SSL 1.42 for SSL_create_ctx_callback
die(qq/IO::Socket::SSL 1.42 must be installed for https support\n/)
unless eval {require IO::Socket::SSL;...

Is there a way to create a block rule, or any way to set it up to auto block based on the port? For example if a customer fails SMTP auth 15 times, can it just block them on port 25? Or if they fail an HTTP authentication X times it blocks them on port 80 only?

Also how about rules just being created for deny, why do we need deny and denyout for every block on an IP created.

Thank for the...

Team

I'm using Centos 5.10 with latest CSF installed. Yesterday I did some changes from UI. I only changed SU/SSH login alerts set to root and it was working great for like 6 hours. Today when I saw my mail box I got around 50 mails with this

===
lfd failed @ Wed Mar 26 06:55:41 2014. A restart was attempted automagically.
===

Then I quickly checked few things, but I was getting these errors...

how to disable Temporary ban i want to Complete disable it and if some one Attack only Ban them ;) is that possilbe

Hi all,

I install CSF for a new server, I'm using it on other servers since 2 years approx.

CONF: CENTOS 6.5 x86_64 standard - WHM 11.42.0 (build 22) - CSF 6.47

I put in the backup directory a backup file from one of my other server, a backup conf file which the conf suits my needs, from 6.47 too.

I select this backup via the interface. It's a good functionality you add to backup the conf!...

Hi

If I enable PT_USERKILL how can I add some users to ignore list? Not to kill their processes?

Thanks

Hello

I have fresh installation of CentOS 6.4 and csf
the issue is that lfd dont' start automatically, I need to do
/etc/init.d/lfd start
and after work fine
this at any reboot
why ?

configuration of csf is standard and seems fine

any suggest ?

Thanks

Hi,

I have the LF_SSH_EMAIL_ALERT = 1 and I was wondering if it is possible to be alerted ONLY at root user login, and not when hosting account users connect SFPT.

Of maybe if I can whitelist certain users to be ignored.

Thanks!

Has this stopped working for anyone else? I don't think I changed any settings that would affect this, and I confirmed that the explicit settings for this feature are enabled, but for the last week or so I haven't been receiving emails for cpanel/root access.

Hello Everybody,

I am new to all this so have one query, How can i enable email alerts of Enable ConfigServer Security & Firewall Alerts to get each process, warnings, alerts via email ?

Thanks In advance for your help.

On March 7th, for the first time, some of the email notifications from lfd started showing up with no IP address. In place of the IP, they have this:

Time: Fri Mar 7 15:15:53 2014 -0800
IP: fe80:0000:0000:0000:0230:48ff:febc:7f1e (-/-/-)
Hits: 11
Blocked: Temporary Block

I'm letting you know this because it appears that someone has found a way around the port blocking (since there's no IP to...

I recently changed a few things on my server to require all ftp logins be 'ftp with tls/ssl (auth tls explicit)'... I noticed that the only way I can connect now is if I whitelist my IP address. What would cause this behavior in CSF and how can I correct the issue?

If memory is correct the only reason I whitelisted my ip was to prevent blocking myself during development/testing and the above...

hi all

i istalled csf and everything is normal but when i turn media proxy on for voip then the sound not passing and dead air hear i even opened all the ports but still the same

waiting for reply

Hi,

I set rules on CSF v6.47 and close ports on a dedicated running CENTOS 5.10 and WHM 11.40.1 with mod_security configured, all was working normally until lfd crashed and started sending notifications every 5 minutes attempting the automagicaly restarts and failures.

Actual Situation:

CSF is running on this machine
Do NOT flush the firewall

root@server #
root@server # /etc/init.d/lfd...

Hi,

it seems proftpd auth fails are not recognized. I've

LF_FTPD = 10
LF_FTPD_PERM = 3600

and ip are not blocked:

ProFTPd 175.44.6.117 USER xxxxx 331
ProFTPd 175.44.6.117 PASS (hidden) 530
ProFTPd 175.44.6.117 USER admin 331
ProFTPd 175.44.6.117 PASS (hidden) 530
ProFTPd 175.44.6.117 USER xxxx 331
ProFTPd 175.44.6.117 PASS (hidden) 530
ProFTPd 175.44.6.117 USER administrator 331
ProFTPd...

Those emails are not from lfd.

I have CSF, the latest version installed. At times I received a notice of an IP is being blocked but with this notification:

Blocked: Permanent Block (IP match in csf.allow, block may not work). However the IP address is not listed in the csf.allow file and they are not blocked. What might be causing this issue?

Brian