ConfigServer Community Forum

Hi,
either I don't know how to use it or csf.pignore is not working as it should, this is what I tried so far:

# stop monitoring wordpress breakdance /tmp files
dir:/tmp/systemd-private-*-ea-php*-php-fpm.service-*/tmp/
dir:/tmp/systemd-private-*/*
dir:/tmp/systemd-private-*
dir:/tmp/systemd-private-*-ea-php81-php-fpm.service-*/tmp/breakdance-ffea200c/twig-auto-generated-cache/*
and
# stop...

I’m getting a number of emails from CSF for “Suspicious process running under user ____” for Wordfence logs.

Command Line (often faked in exploits):
php-fpm: pool website_url

Files open by the process (if any):
/dev/null
/tmp/.ZendSem.NCrsJg (deleted)
/home/server/public_html/website_url/wp-content/wflogs/ips.php
/home/server/public_html/website_url/wp-content/wflogs/config.php...

Hi there,

for the geolocational blocking module for CSF, if I was to only allow the UK, Would this also include the south of Ireland (Republic of Ireland)?

Hello,
I have a new VM cPanel server runing AlmaLinux 8.9, and after installation of the CSF the server wont start after a reboot.
I have reinstalled the OS and cPanel multiple times, ad it runs fine until i instal CSF and than rebott the server.

I realy need advice in this problem.

Beste regards

Hello,
i want to use CC_DENY for block high risk countries, But I would like one of these countries to be enabled for only one specific user.
it's possible to do it ?

thanks

Hi,

What would be the reason the chkutmp process would be running at 100% cpu for hours?

Regards,
Tommy

i just ran the csf install script, nothing else. you know:

sudo wget
sudo sh install.sh

after 1 week i notice my ufw firewall is disabled!
i enable ufw, and a few min later, ufw is disabled again!
i remove csf, and the nightmare is over.

so what is happening here? does csf, even in testing mode disabled ufw? what a nightmare.
i repeat i did not change anything, i did not enable csf, testing...

I had an application level attack on a Wordpress site that brought the server to its knees. First time I've had this happen ever running about a half dozen small business websites. Configserver is loading multiple RBLs like FIREHOL, etc. I did a blacklist search and out of like 60 lists the IP only showed up on the Barracuda RBL. However the link to the actual RBL gives a 403 error.

The...

Does anyone use the connection limit protection or port flooding settings that doesn't have network level DDOS protection?

What would be typical reasonable settings for a server that is just running website applications that has maybe max 40 website users at any time plus bot scraping traffic and virtually no FTP and maybe one SSH session open at a time? Nothing else such as external MySQL...

I have that error if I put RU as blocked:

CC_DENY = RU,CN,UA,VN,BY,HK,IL,KZ,KP,SA,KR,SY,TH,TW,JP,ID,BR,AR,BD,CO,MA,SG,KR,ZW,AZ,PL,PY,SD,CI,EG,MZ,MX,PK,NP,TZ,MY,PE

Error: FASTSTART: (CC_DENY IPv4) [] . Try restarting csf with FASTSTART disabled, at line 5790 in /usr/sbin/csf

If I remove RU from CC_DENY list and restart csf everything is fine and work well

hello, I am experiencing a csf and cmm download error with wget and wget respectively.

Connecting to download.configserver.com (download.configserver.com)|94.130.90.175|:443... failed: Connection timed out.

my server does download other files via wget so i guess there is no problem with that, however i have a doubt if your firewall may be somehow blocking my server ip.
thanks.

Does this error indicate a Zone file error? If so, what is the best way to correct it?
*ERROR* line:
Command:
Error:

This network is found in /var/lib/csf/Geo/ip2asn-combined.tsv & /var/lib/csf/zone/us.zone

Hi,
I'm getting a lot of lfd on server: Suspicious File Alert , generated by Breakdance page builder for Wordpress.
Looks like this:
File: /tmp/systemd-private-3d4985084fd3401ca76423f2a737ddb8-ea-php81-php-fpm.service-PysP3o/tmp/breakdance-746d3b64/twig-auto-generated-cache/69/6935f4b89776a7d6e242d5319b554acd.php
The file is always different.

How can I exclude /tmp/ folder or disable...

Hello,
i have a service to run only to 127.0.0.1 (for example 127.0.0.1:25000)
and i want to reach from public ip.

i can't expose service on public ip directly.
so my goal is redirect port 25000 to 127.0.0.1:25000 and apply ruleset from csf.

i try to
nano /etc/csf/csf.redirect
w.x.y.z|25000|127.0.0.1|25000|tcp

but
Error: csf: Incorrect csf.redirect setting ( ): , at line 3226

how i can do...

Hi!

My server uses for instance 1.1.1.1 and I want to redirect port 60000 (1.1.1.1:60000) to another server's 2.2.2.2:3392 TCP port.
For this I put the following in csf.redirect:
1.1.1.1|60000|2.2.2.2|3392|tcp

My problem is that this opens TCP port 60000 from anywhere. It doesn't matter what is in csf.conf TCP-IN section (60000 isn't in it, but if a put !60000 it locks it for everyone,...

Since our servers upgraded to Alma Linux 8.9, each time the servers reboot, CSF does not operate as normal until after its restarted via WHM.

On one server that uses PHPMailer and Office 365 SMTP, any emails that are sent by the cPanel account will fail due to network is unreachable and in the /var/log/messages it shows outgoing connection attempts to port 587 being blocked. This is happening...

Under CC_ALLOW_FILTER, I have this:

US,MP,PR,CA,TH,GU

But I'm still seeing connections from other countries. For example, I just now received an alert from CSF:

IP: 185.196.9.119 (CH/Switzerland/-)
Temporary Blocks: 5

Temporary blocks that triggered the permanent block:
Tue Jan 16 21:27:06 2024 (smtpauth) Failed SMTP AUTH login from 185.196.9.119 (CH/Switzerland/-): 1 in the last 3600 secs...

I cant send Email in Roundcube webmail, when click to send I have this error: SMTP error (504): authentication failed

I use CSF firewall and mail port is open. SMTP_ALLOWLOCAL is on, SMTP_BLOCK in on/off not defference, (I disable CSF but i have same error. Even if I remove CSF completely, the same error still exists.)

I use Cloadflare on my whm hostname and my main domain, but cloudflare...

I have created a file /etc/csf/csf.custom.deny which contains a single line:
11.22.33.44 # LHB

Then in csf.deny at the top I have a line:
include /etc/csf/csf.custom.deny # do not delete

I then restart csf and lfd (this is on a cPanel system on Centos using ipset)

When I lookup the address 11.22.33.44 via CSF, it does not appear. And if I look in the ipset chain chain_DENY the address does not...

In the new year, i'll potentially be migrating to a new server.
Is there a backup/restore feature in CSF so I can migrate my config over.
Or a cfg file buried away somewhere ?

I'll also need the same for mail scanner.