ConfigServer Community Forum

I have tried this in my regex.custom.pm to use with the output from the error log file line(s) below but it doesn't work.

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /^\S+\s+\d+\s+\S+ \S+ auth_basic:error \(\?\@(\d+\.\d+\.\d+\.\d+)\) /)) {
return ( Failed basicauth login from ,$1, basicauth , 7 , 80,443 , 1 , 0 );
}

The log file I have added as CUSTOM1_LOG returns the following when...

lfd warns me daily about a process i simply cannot teach csf to ignore:
Time: Wed Nov 1 20:08:44 2023 +0100
Account: www-data
Resource: Process Time
Exceeded: 146435 > 1800 (seconds)
Executable: /tmp/appimage_extracted_a3ed3648c2d4a42fcd239937c53130a2/usr/bin/coolwsd
Command Line: coolwsd --config-file=/tmp/appimage_extracted_a3ed3648c2d4a42fcd239937c53130a2/etc/coolwsd/coolwsd.xml...

AlmaLinux v8.8.0 STANDARD kvm + CPANEL

Any idea how to completely unistall CSF from my WHM? I followed the famouns instructions but nothing happens.

==============
cd /etc/csf
sh uninstall.sh
==============

Thanks

Sorry I am sure this has been asked but i can't seem to find it. I have a server with multiple ( 16 ) ip addresses. What i want to do is open specific ports on specific ip address of that server so for example:
ip: xxx.xxx.xxx.xxx i want to open port 6697 but don't want that port open on ip: yyy.yyy.yyy.yyy

tcp|in|d=6697|d=xx.xx.xx.xx from what i understand would be like if i wanted to open port...

I am trying to configure csf to allow tcp and udp in and out on ports 1514,1515,5601 and 9200. After I save these changes in the csf.conf file, verify the changes have actually been saved and restart csf, the changes take effect for a few minutes to an hour and then the csf.conf reverts to it's default version by itself. This happens both when I do it from the terminal and when I use the UI to do...

Hi,

I would like to ask if there is a conflict in using ConfigServer Security & Firewall (CSF) even if we already have CloudFlare and Azure NSG. My understanding is that it will provide an additional security layer in WHM/CPanel, but our network admin has suggested not to install it due to a possible conflict. Any suggestions and recommendations are appreciated.

Thank you.

hi,
i have csf in centos7.9 with cpanel and when csf is enabled, host tracker cant ping ip server or any website,
when i disabled csf, everything is completely works fine,
so whats the problem?
in my all servers the problem is the same with csf.
* when csf is enabled, everyone can access their website or server but websites like host-tracker.com or check-host.net cant ping them with timeout error.

I've just gone through the process of upgrading from CentOS 7.9 to AlmaLinux using the cPanel elevate script and everything went through successfully.

However, since the upgrade CSF has stopped functioning.

I'm getting hourly alerts with the following errors:

Aug 12 11:10:12 server.rhdns.com systemd : Starting ConfigServer Firewall & Security - lfd...
Aug 12 11:11:42 server.rhdns.com systemd :...

Hello.

I'm having problems with outbound emails that contain links to images not displaying in the email unless I disable csf.

I can't imagine what setting within csf is causing this to happen, so:

1) where can I get a fresh install csf.conf file to compare it with and:
2) anyone have a clue why images would not display in this situation.

Thank you.

Hi there

Since a few weeks, 2 or 3, I started having a very strange issue.

The server cannot communicate on self (like doing a curl on it's own ip, or access an image from an url hosted on the same server).

I have 3 servers with the same os, same config, and only this one has the trouble.

Let's take an example of a php website that generates PDF, where in the pdf you have an image loaded by...

I have a new server running CloudLinux 8.8 and while csf starts, it gives the following errors at the end of the startup output;

Command:
Error:
You should check through the main output carefully

*ERROR* line:
Command:
Error:
You should check through the main output carefully

*ERROR* line:
Command:
Error:
You should check through the main output carefully

*ERROR* line:
Command:...

my python script it use requests lib , requests to graph.facebook.com (with alot of requests per seconds )
catch error showing :
HTTPSConnectionPool(host='graph.facebook.com', port=443): Max retries exceeded with url: /me/ (Caused by NewConnectionError(' : Failed to establish a new connection: Connection refused'))

when disable csf csf -x , it working perfectly.
all value of tcp_out, udp_out,...

Hi,
I see that Debian 12 isn't yet listed on the working distros, but not sure where to report this from my testing. Following my test server being updated to Deb 12 (Bookworm), CSF appears to work, but LFD fails to read logs. I get the failed SYSLOG email warnings - although it is writing the check code to SYSLOG, it's not able to read it. Looking at the debug log under debug level 2 every log...

Almost every day, I receive lfd failed email notifications, followed by 1 lfd recovered email notification.

I have a VPS with InMotion. They told me I should look for answers here.

Hi,

Is there any way to receice an alert if csf or lfd turn off?

Best
Joao

We use nf_tables on Debian 11, but on every configserver update the iptables are set back to legacy.

Very strange behavior and it breaks a lot of functionality over and over.

Any fix for this?

attempting update v13.08 to v13.10

With ipset in use and using the following update script, script freezes with message:

*ERROR* IPSET:

Don't know what to do. . .

Hi,

I think it's a strage thing, but csf is dropping my httpd service each minute. When csf is disable, apache works fine.
I don't have any crond running every minute.

Any ideia about this problem?

Thanks
Joao

So I'm an idiot. What can I say?

I've set my customlog1 as follows:
CUSTOM1_LOG = /var/log/nginx/access_log
Yes, that is the correct path.

The format looks like:
118.126.124.10 - - HEAD /manager/html HTTP/1.1 404 0 - Python/3.6 aiohttp/3.8.3

I'm looking for 5 404's from the same IP in the specified time period in order to give them the boot. Truthfully, if they're appearing in that log,...

Hello,
i am facing a big problem?
I am using csf with cpanel / whm .
Please take a look at this part of the exim_mainlog which indicates some of the 4000 dovecot failed logins over the last 5 days. :
Line 118101: 2023-09-15 06:54:10 dovecot_login authenticator failed for 107.40.3.213.static.wline.lns.sme.cust.swisscom.ch :43582: 535 Incorrect authentication data (set_id=abuse@domain.com)
Line...