Hi all,
this thread is to add working REGEX that we can share with the community. To add them to this sticky, you should have the regex working in your server, this thread is not intended to solve any issues related with no working regex, the intention is to give users of CSF REGEXs that could make CSF with more security options.
If you want to collaborate, please add your rule to this thread...
If you have one particular IP address that is either dropped or accepted through the firewall that you think should not be, then you can use the new WATCH_MODE in csf.
Before enabling this option and using the CLI command to watch an IP address, check whether it is explicitly listed first using:
csf --grep 11.22.33.44
Where 11.22.33.44 is the IP address you're tracking. If that comes back...
If you get iptables errors when trying to start csf on a VPS then you most likely have missing iptables modules for your VPS.
If your hosting provider wants to know how to configure iptables correctly on a VPS server, then you should point them to this Parallels FAQ and have them follow it (plus to add ip_conntrack_ftp to the list of required modules):
I was wondering if it would be possible to send lfd notifications like: login notification, suspicious process,... to an REST API endpoint/server, instead of sending them by email? In case of an email system failure, emails are not sent, but sending them to another (monitoring) system over eg. Https (to an API) would be a good alternative.
There seems to be an option to execute a script,...
This topic has been mentioned already. I have read all the relative posts, I think and cannot find an answer.
We are running centos 7.9, mod_security 3, CSF rules and mod_lsapi. We do see that mod_security is correctly identifying attacks in the cPanel tools. When we look in our CSF logs, we see only about a third of the IP's are being blocked.
It seems that this stopped working between October and November with the most recent IMAP block being on 02 Dec 2021. I'm not sure if it's related to the CSF 14.15 update that was released on 04 Dec. Looks like it updated on 05 December. This is affecting all our Interworx servers.
These are my IMAP blocks.
LF_IMAPD = 10
LF_IMAPD_PERM = 1
IMAPD_LOG = /var/log/dovecot/dovecot.log
and INTERWORX...
I have problem with coding in file /etc/csf/csf.deny.
When I'm editing this file in Python I'm getting error: UnicodeDecodeError: 'utf-8' codec can't decode byte 0xce in position 2882: invalid continuation byte .
Hello Forum,
I want to block an IP Adresse in the range of 91.241.72.0 to 91.241.72.254. Due to spam and multiple IP Adresse in that range.
So i added 91.241.72.0/24 #do not delete to /etc/csf/csf.deny.
And yes i restarted the firewall.
Then i tried to ping 91.241.72.1 from my host... no ping.. Great I thought it works.
The next day I got spam from that IP range agian. WTF!
Hi, i have two servers that every hour the settings are reseting, and removes on special cofig on TCP_IN, TCP_OUT and SMTP_ALLOWUSER,
i tryed to fix this reinstalling, searching for a cronjob but i already not found what is happening, on the logs there is no not about the resetting
Unless I have an IP address/port entry in the csf.allow (tcp|in|d=5061|s=my_ip_address/32), incoming SIP signaling with TLS transport (not UDP) on port 5061 is blocked.
I suspect SPI is rejecting this traffic.
Is it possible to turn off SPI on specific ports?
port 5061 is being opened with port knocking. I can see incoming traffic on tcp 5061 port with tcpdump, so I guess port has been...
Any idea how to make CSF Firewall only logging to file not the console ?
Using CloudLinux 8.5 with cPanel, last time i check the server it was correctly logging into the log file, but now it's shows the log too in the console.
We are getting blocks from an unknown IP range which is not visible in any of our other logs besides lfd logs. It does not cause any harm as of now but it looks like a csf bug itself. Please suggest some solution if there is available or fix it in next update.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum