ConfigServer Community Forum

Solved, Thx.

Hi,

I am getting tons of email from csf lfd on server.xxxxxxxx.com: Suspicious process running under user xxxxxxx

Just want to know if this can be added in csf.pignore? Is it safe

Any help will be highly appreciated.

Time: Thu Jan 26 11:01:09 2023 +0530
PID: 5587 (Parent PID:4853)
Account: torqueparmap
Uptime: 135550 seconds

Executable:

/opt/cpanel/ea-php73/root/usr/bin/php-cgi

Command...

Disabling CSF makes them work as normal. Obviously I don't want to run with CSF disabled.

I've added various ports in, reset it, reinstalled it but nothing works other than fully disabling it.

The message I get from mail-tester.com is Your SMTP or web host is probably blocking your emails .

If this a know issue and is there a fix?

Thanks

Dave

As of about a week ago CSF appears to be timing out processing of queued emails. If the message is sent manually using WHM > Mail Queue it times out.
Nothing more specific than connection timeout is reported.
At the same time we started getting random calls from clients, their website wouldn't load for them, mail app can't connect etc.
We have flushed everything, restarted and...

While CSF is active, it also blocks the IP of normal users. How can I find a solution to this? The IP of our customers using Outlook is blocked. Since the ip is not fixed, it is not a solution to remove ip.

Hello
I am trying to filter incoming messages via CSF
When I apply this:
if (($lgfile eq $config{CUSTOM2_LOG}) and ($line =~ /^\S+\s+\d+\s+\S+ \S+ postfix\/smtpd\ : warning:.*\ : SASL *? authentication failed/)) {
return ( Failed SASL login from ,$1, mysaslmatch , 3 , 25 , 1 );
}
This does not break, I do not see the IP blocked in the management.
Any idea?
Mz

Hi there

A new server with Cloudlinux installed, Installed CFS, but all messages are logged to the console, making the console unusable.

I have no idea what setting needs to be done for this to stop. Any help is appreciated, as I am sure I am not the only one. This was presented before here: (but no fix was provided)

screen looks like this:

Instructions I think how to block tor in /etc/csf/csf.blocklists by uncommenting this line (remove the #):
#TOR|86400|0|
and in /etc/csf/csf.conf make sure URLGET is set to use LWP then restart the firewall

We leave the ip=1.2.3.4 and don't change it to our server ip address?

I'm using Logwatch and have noticed a bunch of logs coming in for ICMP.

For example:

iptables firewall
Listed by source hosts:
Logged 1760 packets on interface eth0
From 3.87.248.151 - 1 packet to icmp(8)
From 3.231.165.178 - 2 packets to icmp(8)
From 3.236.183.212 - 2 packets to icmp(8)
From 3.236.184.164 - 3 packets to icmp(8)
From 3.237.184.3 - 1 packet to icmp(8)
From 3.238.39.131 - 1...

I've bunch of ips / networks added to csf.deny

csf.deny
1.1.0.0/19 # do not delete

However i want to allow 1.1.1.1 on port 80 and 443 with csf.allow

csf.allow
tcp|in|d=80|s=1.1.1.1
tcp|in|d=443|s=1.1.1.1

or

csf.allow
1.1.1.1

Allow rules above is not working.

- If i add IP adress to both csf.allow and csf.ignore it works but opens all ports which i don't want to
- Adding...

I run a MyBB forum, and MyBB utilizes PHP mail() for account activation e-mail addresses. In my csf.deny, I have 0.0.0.0/0 denied. This is to prevent all incoming requests directly to the server. The website is only accessible by going to the domain. The issue with this, is that it makes PHP's mail() function a little finicky. Is there a way with CSF to block all incoming requests, but allow all...

Dear all,

I am using block_all_temp profile to temporarily block the IPs attempting a brute force attack. using this profile, it only allows me to block the IPs for 1 hour aftr this the IPs get unblocked. i want to customize this time to 5 min for example. so that, any IP trying brute force attack will be blocked for 5 minutes only. help will be grateful.

Hamza

Hi there,

With the High Load template for instance, there are set variables which don't seem to be documented.

This includes , , , , and however there doesn't seem to be a way to tweak them. For instance, we'd like to amend how ps is invoked (and likely include a 2nd copy of it, sorted differently), include iostat/sar reports and others.

How does one go about amending what the above variables...

I'm having an issue with ipset CC_RU:

*ERROR* IPSET:

I'm struggling to find any info on how to resolve it, other than removing RU from the CC_DENY list. I understand what the issue is, just don't know how to either remove/fix that entry in CC_RU.

Any help would be appreciated.

Hi all,
I need help with Check Server Security configuration on cPanel VPS.
My VPS hosts mutliple Wordpress and various different Laravel CMS websites, along with some static content.

I need to know is it safe to do as Security says (disable) and will it impact my websites:
PHP Check
1. Check php for enable_dl or disabled dl()
2. Check php for disable_functions

Server Services Check
3....

I use Centos 7 and DirectAdmin have an issue with unblock adress IP. Validation recaptch works but adress IP still block.

In /home/csf/public_html/index.php file_put_contents doesn't work and unblock.txt and lfd_messenger.log don't create.
PHP Warning: file_put_contents(/home/csf/unblock.txt): failed to open stream: Permission denied in /home/csf/public_html/index.php on line 252PHP message:...

Hello, i want to know is this rule that i have wrote correct?
i mean that can we use source port and desteniation port after each other with same ip.
tcp|in|s=0_65535|s=x.x.x.x
tcp|in|d=(some specific ports)|s=x.x.x.x

2022-10-07 18:32:31 H=(lnyd) F= rejected RCPT : R1: HELO should be a FQDN or address literal (See RFC 2821 4.1.1.1)

I got lot of this kind of spam everyday, how can I use csf to auto block them?
Thank you

My exim part setting:
SMTP_BLOCK = 1
SMTP_ALLOWLOCAL = 1
SMTP_REDIRECT = 0
SMTPAUTH_RESTRICT = 1

I just want my server and php send mail only,

Thank you so much

Hi all,
I am rebuilding my infrastructure and those services facing the public, I am opting to use CSF instead of vanilla IPTables.

I am having a bit of an issue when CSF is active Bird2 is failing to work properly, I was wondering if anyone else has had this issue before and solved it.

The error I get is:
bird : ospf1: Socket error on enp6s0: Operation not permitted

Setup is Vultr VPS with...

A little help here guys.

I created an extremely simple wordpress plugin that creates log of failed login attempts, this way I can target only a brute force attack and not a webmaster login into several sites in an hour for normal work (this is a server with more than a thousand wordpress sites)

I can make the log any way I want, but so far I am appending a timestamp and the ip of the failed...