Hello,

I'm using this regex to block wp-login.php POST requests on /etc/csf/regex.custom.pm:

if (($globlogs{CUSTOM2_LOG}{$lgfile}) and ($line =~ /(\S+).*] POST \/wp-login\.php.* 200/)) {
return ( Failed WordPress login from ,$1, wordpress , 5 , 80,443 , 3600 );
}

My CUSTOM2_LOG point to the access_log file in csf.conf correctly.
I restart csf after making the changes
csf -r

Still POST...

Hi,

I've recently noticed in my logs many of these:

Nov 14 01:50:48 server.fqdn phpMyAdmin : user denied: root (mysql-denied) from x.x.x.x

How can I get CSF /LFD to catch these and block the source IP attempts?

Thanks.

Michael.

Hey Guys,

Would anybody be able to assist with a regex rule for CSF that would block attempts on the SMTP gateway ASSP?
It create's lines like this in exim_mainlog : dovecot_plain authenticator failed for ( - 185.222.209.83 -) :60094: 535 Incorrect authentication data (set_id=user@domain.tld)

How can I have these ip's blocked after let's say 5 attempts?

Hello

I´m using CSF in all my servers with WHM/cPanel since LOT years ago.
I not had any problem in all these years. Now..

the CSF page in WHM take a LOT time to load.
Any action i make there (block an IP, unblock an IP, open the config, restart CSF, etc.) take LOT tme.

The servers itself are OK,, low load, etc.

Any clues?.. some config issue?, some WHM version compatibility issue?

Thanks...

Since the last update to csf we've been getting multiple notifications every time a user accesses phpMyAdmin.

lfd on xxxx.xxxxx.com: Suspicious File Alert
File: /tmp/pma_template_compiles_USERNAME/twig/9f/9f2b0868c0ee3bdb8fbcdba6e363515596d67849ea34a2ad71b70607edbb2a33.php
Reason: Script, file extension
Owner: USERNAME:USERNAME (510:507)
Action: No action taken

I would normally just...

Hi.

I recently enabled a couple of RBL's in CSF. I get reports via X_ARF enabling, and it seems that IP's listed in the RBL's defined in csf.rblconf are still getting through and hitting Brute Force, producing the X_ARF report where I can see 5 attempts.

Shouldn't the RBL match of the IP stop even 1 attempt? (assuming the RBL check is working)

Michael.

Hi Everyone,

I've been receiving a lot of these recently and wondered about your suggestion?

Time: Mon Nov 12 00:05:08 2018 +0000
File: /tmp/pma_template_compiles_alnwickc/twig/ba/baac82815d6e45dde565a5232c86fddb501004d0855c31381257e419e482f2a8.php
Reason: Script, file extension
Owner: alnwickc:alnwickc (1172:1174)
Action: No action taken

Hi.

Firstly just to let you know I'm new to CSF but really love it. Thank you for making this tool available.

I've installed it on a couple of CentOS 7 machines, running Virtualmin Pro and Webmin.

All installs and works fine and I install the csfwebmin.tgz into Webmin, however I like to have all iptables logs in a specific file, instead of the normal /var/log/messages file.

I configure...

Hello!

I'm getting this log spamming on my new server:

USER yyyyy: no such user found from 107.150.xxx.xx

My configuration of LF_ is:

LF_TRIGGER = 5
LF_TRIGGER_PERM = 3600
LF_SSHD = 5
LF_SSHD_PERM = 3600
LF_FTPD = 1
LF_FTPD_PERM = 3600
LF_SMTPAUTH = 1
LF_SMTPAUTH_PERM = 3600
LF_EXIMSYNTAX = 1
LF_EXIMSYNTAX_PERM = 3600
LF_POP3D = 1
LF_POP3D_PERM = 3600
LF_IMAPD = 1...

I've decided to start a new thread because I haven't seen any current working solution, or activity on older threads regarding this issue.

I have spent countless hours over the last 3 months trying to solve this issue with email that is getting blocked which comes from Gmail:

DNS Error: 91335 DNS type 'mx' lookup of localinternetads.com responded with code SERVFAIL

I've read through 3 dozen...

I'm having a lot of problems with clients blocking themselves by signing in with the wrong email login details.

All my clients are in Ireland and I was wondering if I was to use CC_ALLOW_FILTER IE would it stop the problem.

2. If I was to do that would it create significant additional load on the server?

Hi Team,

I have added 177.0.0.0/8 # BR/Brazil/NA. do not delete to our deny list of IPs.

Normally when a range is blocked, then I don't continue to get e-mail notifications for that denied range... however recently I am getting notifications for repeated hacks for IP Addresses that are blocked on the deny list of IPs
Is there a way to ONLY get notifications of NEW IP Address hack attempts?...

Hi All,

I was wanting to permanently deny the following IPV6 IPs

QUESTIONS:-
1) Will the following work?
0:0:0:0:0:ffff:65fe:e68c/120/ # CN/China/Beijing, Xuanyu. do not delete
0:0:0:0:0:ffff:6f49:2e21/118 # CN/China/Nanchang. do not delete
0:0:0:0:0:ffff:7276:6175/120 # CN/China/Beijing. do not delete
0:0:0:0:0:ffff:7bf9:d28/119 # /Shenzhen. do not delete
0:0:0:0:0:ffff:d3da:7e8e # KR/Korea...

Hi

I've got a customers IP that has been blocked multiple times due to trying to set up their email with the wrong password. I've unblocked them multiple times and added them to the allow list so that they have time to sort things out their end. However they are still unable to access it.. When I do a search for their IP it brings up the following, which I do not appear to be able to unblock or...

Only a certain reseller does not have access to the Configserver Firewall plugin.
As I did not find any problem that could cause this, I contacted cPanel support. And it looks like there's a bug. Here is the answer from cPanel support:

At this time, all reseller privileges for ablhostc are configured correctly to allow access to the ConfigServer interface, however I do see that ConfigServer is...