Hi all,
this thread is to add working REGEX that we can share with the community. To add them to this sticky, you should have the regex working in your server, this thread is not intended to solve any issues related with no working regex, the intention is to give users of CSF REGEXs that could make CSF with more security options.
If you want to collaborate, please add your rule to this thread...
If you have one particular IP address that is either dropped or accepted through the firewall that you think should not be, then you can use the new WATCH_MODE in csf.
Before enabling this option and using the CLI command to watch an IP address, check whether it is explicitly listed first using:
csf --grep 11.22.33.44
Where 11.22.33.44 is the IP address you're tracking. If that comes back...
If you get iptables errors when trying to start csf on a VPS then you most likely have missing iptables modules for your VPS.
If your hosting provider wants to know how to configure iptables correctly on a VPS server, then you should point them to this Parallels FAQ and have them follow it (plus to add ip_conntrack_ftp to the list of required modules):
When CF_ENABLED is set to 1, Is there a log of CSF's interactions with CloudFlare?
I have mod_remote IP setup and working, mod_security is setup and working, and in the LFD log I can trigger the mod_security rules and see a block come up (I am testing via TOR):
i have problem with *MESSENGERV3* Error: The home directory for csf does not exist
I was useradd csf -s /bin/false and then check lfd.log
Jul 10 23:39:32 lfd : Messenger HTTPS Service starting...
Jul 10 23:39:32 lfd : Messenger HTML Service starting...
Jul 10 23:39:32 lfd : *MESSENGERV3* Error: The home directory for csf does not exist
Jul 10 23:39:32 lfd : Messenger TEXT Service starting......
I have a problem with my AWS EC2 VPS.
I have AlmaLinux 8.4 with WHM/cPanel and everything is running very well so far.
But as soon as I enable CSF, my server IPv6 is blocked and my server has no IPv6 anymore.
When I disable it, everything works again.
In CSF I have IPv6 enabled.
Does anyone have any idea what this could be?
I'm having another issue with CSF blocking inbound emails from Gmail. I logged into multiple gmail accounts and tried to send email to one of our servers and the emails are never received. After I disable CSF firewall i can then receive email from all 3 gmail accounts. I flushed all IP blocks, and added Googles entire IP block 209.85.166.0/255 to CSF ignore. Restarted CSF and still CSF is...
I've created a bash script which should be triggered by LF_DIST_ACTION but doesn't appear to be. I've set the execute bit and csf.conf appears to be set OK.
Hello, i have an dedicated bare metal server with Hetzner but everyday I'm getting emails for outgoing bruteforce and portscan attacks.
My server is a shared hosting server, we're selling shared and reseller hosting through the server and server have almost 900+ cPanel Accounts.
So how can i find out which account is sending outgoing bruteforce attack and how can i stop it ?
I am mentioning some...
On one of my servers, lfd keeps crashing with the error shown in
CSF version is v14.10
Any help or insight on how to approach/fix this error would be appreciated.
Jul 2 09:42:12 server lfd : Main Process: Unmatched [ in regex; marked by line 2.
Jul 2 09:44:16 server lfd : Main Process: Unmatched [ in regex; marked by line 2.
Jul 2 09:46:46 server lfd : Main Process: Unmatched [ in regex;...
LF_PERMBLOCK = 1 means YES, plese protect my server and BLOCK any IP with BAD actions .
LF_PERMBLOCK_ALERT = 0 means NOT send email when a new IP is blocked .
I am wrong?
... just I have this config: LF_PERMBLOCK = 1
LF_PERMBLOCK_INTERVAL = 86400
LF_PERMBLOCK_COUNT = 4
LF_PERMBLOCK_ALERT = 0 and I get many emails each hour about new IPs blockeds.
I have the LF_PERMBLOCK_ALERT set to OFF and have saved and reloaded CSF. Still, even after turning it off I am getting dozens of PERMBLOCK alerts in my inbox every day like the one pasted below. Am I missing some other setting that I have to change to stop CSF from sending me all of these?
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum