ConfigServer Community Forum

So I'm an idiot. What can I say?

I've set my customlog1 as follows:
CUSTOM1_LOG = /var/log/nginx/access_log
Yes, that is the correct path.

The format looks like:
118.126.124.10 - - HEAD /manager/html HTTP/1.1 404 0 - Python/3.6 aiohttp/3.8.3

I'm looking for 5 404's from the same IP in the specified time period in order to give them the boot. Truthfully, if they're appearing in that log,...

Hello,
i am facing a big problem?
I am using csf with cpanel / whm .
Please take a look at this part of the exim_mainlog which indicates some of the 4000 dovecot failed logins over the last 5 days. :
Line 118101: 2023-09-15 06:54:10 dovecot_login authenticator failed for 107.40.3.213.static.wline.lns.sme.cust.swisscom.ch :43582: 535 Incorrect authentication data (set_id=abuse@domain.com)
Line...

Advisement from MaxMind sent out today:

MaxMind will begin requiring HTTPS for GeoIP download requests in March 2024. To help customers get ready for this change, we will have a planned, temporary enforcement of this policy on October 17, 2023.

Could the devs kindly advise if CSF is interacting with MaxMind over HTTPS already?

Thank you.

When adding a new ip to the allow list using csf -a, the rule seems to be isnerted into IPTables, however, its not being honored. We still see blocking messages in syslog.

Rebooting is the only way I have found to clear it. Disabling fasstart did not work, enable/disable did not work.

Any ideas on this?

Hello all!
I have problem with CFS. almal 8.8+DA. CSF shows:
You should consider disabling commonly abused php functions, e.g.:
disable_functions = show_source, system, shell_exec, passthru, exec, popen, proc_open
Some client web scripts may break with some of these functions disabled, so you may have to remove them from this list:
Affected PHP versions:
/usr/local/php56/lib/php.ini...

Hello

If an IP starts gobbling up server resources by hitting a website multiple times, can we use CSF to rate limit them ? What I mean is, to slow the resource allocation to that IP if it is hitting the server multiple times.

I currently have an Apache box with linux CentOS7 and I also use Mod Sec.

I cannot decide which will I use for a cPanel server. Imunify360 or CSF? What makes Imunify or CSF better?

Hello,
i recently was checking lfd.log ( i am using CSF/LFD with WHM/cPanel) and it caught my eye that although my server is constantly being targeted by potential perpetrators for trying to login by SMTP there are no entries in the lfd.log that indicate that lfd picks up these failed attempts.
Here is a grepped part of my exim_mainlog indicating failed smtp login attempts :
2023-09-13...

Good morning,

We currently have a custom blocklist and we managed to implement a webui for asking an unblock. But as the blocklist can only be reloaded each 3600s, the user have to wait a maximum time of 3600s to get unblocked.

Is there a way to trigger a blocklist reload within CSF/LFD from SSH? In this way we'll be able to unblock instantly an user.

RH Linux server
Kernel 3.10.0-1160.88.1.el7.x86_64
WHM/Cpanel 108.0.15
csf v14.17

Things had been working fine but after recent kernel update, upcp script for nightly maintenance does not run properly.
Yum updates fail.

If I drop the firewall, everything runs as it should, but when CSF is back up maintenance fails and exits.
Seems like it is blocking access to repos - MariaDB103,...

Sorry to re-open an old thread but it's related, I added several IPS to the csf.ignore file and this seems to not work as these ips still get blocked by these exim syntax errors. Is there another file I need the IPS in so they are not blocked by CSF?
Thanks
Currently on up to date version V14.19

This is obvious, no?

Is there any documentation available on how to do this?

Hello,

A few weeks ago I received an email stating that I'm sending requests to rather than for MaxMind database downloads and that in the coming months http is going to be removed.

I believe CSF is doing the http requests to Maxmind as I just checked and found the following:

# grep -r download.maxmind.com/app/geoip_download *
Config.pm: $config{cc_country} =
Config.pm: $config{cc_city} = ;...

Hello,

I know this is my first post here, however I must do it since there is no support for CSF on Help Desk. Long story short I have a few ARM64 servers with AlmaLinux, Alibaba Cloud linux, Ubuntu 22; and CSF and LFD does not function properly. For instance, the CSF service on all of them:

● csf.service - ConfigServer Firewall & Security - csf
Loaded: loaded...

Hello everyone,

I'm inquiring about the possibility of utilizing CSF to block all bots while allowing an exception for Google bots. Google has kindly provided us with a list of whitelisted IPs at the following links:

Googlebot IPs:
Special Crawlers IPs:
User-Triggered Fetchers IPs:
Google IPs:
I've attempted to research this on various forums but haven't been able to find a solution. Most...