ConfigServer Community Forum

I've been getting a ton of suspicious process alerts lately about a Perl script that hasn't been modified since 2020. So I'm pretty sure these are false alerts.

The email says:

Time: Tue Dec 12 15:18:14 2023 -0500
PID: 19935 (Parent PID:23922)
Account: nobody
Uptime: 99 seconds

Executable:

/usr/bin/perl

Command Line (often faked in exploits):

/usr/bin/perl...

I stopped receiving alert emails about SSH root logins, on all the servers i use CSF+LFD on... did something change in a recent update?

Hello.

I am starting to have a very large SMTP_ALLOWUSER. How do you create groups for use of SMTP_ALLOWGROUP? Presently it shows mail,mailman.

Thank you,
Larry

Hello,

I have a DNS querys problem with query.senderbase.org: since 3 weeks. After check I found a this page

I think Senderbase replace with Talosintelligence. Any idea this point ?

Regards

I'm using csf 14.20 on an Ubuntu Jammy system behind a 1GB FIOS connection. With csf/lfd running, I get throughput of about 30M/s, which increases to about 800M/s with csf/lfd disabled. I'm using a fairly generic csf.conf (shown below) and have tried to improve performance by reducing DENY_IP_LIMIT and DENY_TEMP_IP_LIMIT to 100, but obviously it's still subpar. Any suggestions for how to narrow...

For a server I manage, I explicitly want to receive notification emails of successful ssh logins. I've enabled this, and allow-listed my own fixed IP address.

My customer can login to one account using ssh, but doesn't have a fixed ip. Is there a way to allow-list the public ssh key he's using?

An example of such notification would be:

Nov 28 13:05:51 srv sshd : Accepted publickey for...

Hello,

Currently, I get a ton of emails like this:
lfd on : Suspicious File Alert
Time: Mon Nov 27 10:17:20 2023 +0100
File: /tmp/xxxxxxxx.o
Reason: Linux Binary
Owner: varnish:varnish (xxx:xxx)
Action: No action taken

These files are created by Varnish when it compiles the VCL for reloading.

However, I already whitelisted the varnish user from /etc/csf/csf.fignore like this:
user:varnish...

I have tried searching for all the synonyms I could think of for transfer, copy, new server in relation to CSF, and have come up with nothing...

Searched here and on the COnfigServer website.

I am needing to move all my sites from one server to a new server. The old server will get turned off later.

And I would REALLY like to know how to copy all my settings for CSF from the old server to the...

Hi,
I have already looked around this form , but did not come to a positive conclusion in the end.
I have been working for years with csf (and now also with cxs ). Now I am getting 'weird' messages on /opt/cpanel/ea php81/root/usr/sbin/php-fpm. Especially since multiple files are being opened/transferred.

I have investigated the ip's and they are from cloudflare and google (even 1 from...

Hi all

Updated post after further investigation.

It looks like CSF has not been blocking IPs based on ModSec events for over 30 days, at least. This is across two WHM CentOS servers.

LFD Stats only show CT_LIMIT, LF_DISTATTACK, and LF_PERMBLOCK_CONT triggers, but no LF_MODSEC events in the last 30 days.

ModSec looks like its doing what it should, and I can see the usual events. There's been...

Recently I disabled WP-CRON for wordpress and started using CPANEL with WGET to replace it. I've started getting emails lfd on XXXXX: Suspicious process running under user . I found some instructions on where to go to tell CSF to ignore these in the /etc/csf/csf.pignore edit, but I'm unclear exactly how to do this. Here is what the LFD emails are showing:

Executable:...

Hi guys,

We have configured the alert template (/usr/local/csf/tpl/alert.txt) on multiple servers to send email to a particular email account

This has been working fine for a number of years.

All of a sudden on one server it no longer works. We are puzzled as to why this would be the case.

Any ideas?

Thanks
Sasha

SYSTEM INFORMATION
OS type and version Rocky linux 8.8
Webmin version 2.101
Virtualmin version. 7.8.2
Config server Firewall(CSF) verison 14.20(generic)

I want to see alerts of outgoing emails from my server when they cross a certain limit and I have configured everything accordingly but alerts are not coming in my given email. Everything is working fine except Relay Tracking. We are using...

I've always used CC_ALLOW_FILTER to block non-US IPs, but I recently began using Cloudflare and now all connections come from a Cloudflare IP! My server load has skyrocketed, so I don't think that CSF is able to block non-US IPs anymore.

I blocked them in Apache configuration, but I think that runs after CSF, too, so I'm still getting the Apache connection for each request. And I'm talking about...

We are warding off a country denial of service attack on a WHM Exim server that has been ongoing for around 1 week. The attack takes the form of 1000s of servers sending email to non-existing recipients on the Exim server, quickly overwhelming the Exim's server's connection count limit ` smtp_accept_max `. The default for Exim is 20 connections. The default for cPanel is 100 connections. In our...

I've seen a lot of threads related to using Cloudflare, but no answers :-( Hopefully this thread will be the exception!

I've always used CSF's CC_ALLOW_FILTER to block non-US IPs. But I started using Cloudflare in September, and now that all incoming IPs appear to come from Cloudflare I don't think that this is working.

I tried enabling CF_ENABLE, but nothing changed so I think there must be...

LFD is emailing me three times for all excessive SFTP usage. Not for other excesses.

I know I could add the SFTP executable to the pignore file but I want to receive these notifications.

How can I make it email just the once for each excess?

After making all needed updates in my Ubuntu 20.04 server and restarting it through WHM I was not able to access the hosted sites(they are not propagating) and I was not able to check for Ubuntu updates through apt-get update.
The configuration of the csf v14.20 was unchanged and before the restart it was working perfectly.
My port settings are the following:
TCP_IN =...

Hi all,

On my VPS I use:
- WHM/cPanel v114.0.11
- CloudLinux v8.8.0
- Plug-in: ConfigServer Security & Firewall - csf v14.20

I am a beginner.

On my VPS I host several websites for others. Also, the VPS serves as a mail server.

Part 1:
I perform all management tasks for my VPS from 1 fixed IP address for example xxx.xxx.xxx.xxx.xxx. This IP address should never be blocked and all ports...

I have tried this in my regex.custom.pm to use with the output from the error log file line(s) below but it doesn't work.

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /^\S+\s+\d+\s+\S+ \S+ auth_basic:error \(\?\@(\d+\.\d+\.\d+\.\d+)\) /)) {
return ( Failed basicauth login from ,$1, basicauth , 7 , 80,443 , 1 , 0 );
}

The log file I have added as CUSTOM1_LOG returns the following when...