ConfigServer Community Forum

The CC_DENY_PORTS setting should only block access to TCP and UDP IN, but it applies to OUT as well.

In the description in the conf file, it informs TCP_IN and induces to think that it will be only for IN(put)

# This option uses the same format as TCP_IN/UDP_IN. The ports listed should
# NOT be removed from TCP_IN/UDP_IN
#
# An example would be to list port 21 here then countries listed in
#...

Hello,

I hope everyone is well.

I have a need to block countries, but allow dns querries into the server from everywhere, including those countries I've blocked.

What is the simplest solution with CSF for this?

Thanks in advance for any help.

Every day we receive a message from RBL's checks informing us that no responses were received from some spam checklists.

The content of said message shows us several errors similar to this:

Error: open resolver;

The IP address at the end of the URL is an IP address that belongs to Cloudfliare.

This only happens with 2 of the 3 servers that I manage, in these 3 servers the RBL verification is...

Hello,

I recently enabled the ipsum blocklist (which seems to be updated regularly) inside csf.blocklists,
which for now seems to be working, but from what I understood, the ip lookup happens in the generated csf.block.blocklistname file inside /var/lib/csf folder.
So it happened that this file didn't update on a daily basis, but the public list on the web did, which makes the detection of bad...

Hello,

In installed it in 3 different directadmin servers and didn't work in any. I have used the usual process: I created the user, selected the options, restarted both services, etc.

Is still working? Do you know if works with Directadmin servers?

Thank you.

If RU is added to the CC_DENY, CSF won't start, with error message:
Error: FASTSTART: (CC_DENY IPv4) [] . Try restarting csf with FASTSTART disabled, at line 5781

Hello, it's possible to read the country code in a the customer regex?

In my case, I want to block xmlrpc attacks on all countries except spain.

Something like this will run?

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] \w*(?:GET|POST) and ($cc != ES) \/xmlrpc\.php.* /)) {
return ( xmlrpc attack ,$1, xmlrpc , 20 , 80,443 , 3600 );
}

Thanks!

Good morning, I manage a couple of whm servers on centos 7 with imunify360 and csf, within the last couple of days the servers have become really unstable. To the best of my ability it seems like I have isolated the cause to be is LFD causing the servers to run out of memory and the way was able to prove it is the following.

A couple of days ago I was receiving e-mails from one of my servers...

I installed this VPN script on a CentOS 7 WHM system with CSF

While I am able to connect to the VPN successfully, I cannot connect to any website or service over the VPN until I execute this command via SSH
systemctl restart iptables

But if I execute above command, it ignores csf.deny IP addresses. So I go and restart the CSF and I'm back to the previous paragraph scenario.

Appreciate any...

I travel a lot and find myself at a location where the IP address allocated to me changes every few minutes/hours. I am struggling to enter the correct instructions in the WHM/CPanel firewall to allow an entire block of IP addresses. I would like to allow all IP addresses at :-
98.186.XXX.XX
&
172.56.xxx.xxx

How can I do this?
regards

Hello,
I'm new in csf and trying it.
According to I added to NL CC_DENY for a moment.
csf restart
But maillog still outputs
Mar 6 18:58:24 host postfix/smtpd : connect from unknown
Mar 6 18:58:31 host postfix/smtpd : warning: unknown : SASL LOGIN authentication failed: authentication failure
Mar 6 18:58:31 host postfix/smtpd : disconnect from unknown ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4...

Host: CentOS Linux release 7.9.2009 (Core)
cPanel: 108.0.11
CSF: 14.17

CSF runs for a while (days) then I get an e-mail that lfd is down (becase it can't restart csf). When I check csf, it is zombied. Almost any command that starts 'csf...' hangs. I can either kill it and let it restart, or I can do a csf -r (or a -f and -s) and wait 10 minutes for it to reload (There are a lot of blocks in the...

Hi,

What would be the reason the chkutmp process would be running at 100% cpu for hours?

Regards,
Tommy

Folks,

I had problems with the Country Code CIDR lists from DB-IP, ipdeny.com, or iptoasn.com.

The CIDR lists contained US IP Addresses for Google.com, Googleapis.com, YouTube.com and various ISPs.

I was blocking these Country Codes:

CN,RU,KR,TW,VN,BZ,HK,BR,UA,KZ,CO,AR,BY,KG,PE,VE,TH,TN,AM,BG,TR,DZ,EG,CL,IQ,AZ,AL,LA,NG

Best Regards,

Jim

Hi all,

is it possible to configure LFD to report SSH alerts only from unknown IP addresses or Mac addresses via email?

Disabling SSH login alerts completely is out of the question, as I really appreciate this feature. However, it is also annoying when I have to log in several times myself and end up getting spammed about my own logins.

Kind regards