Hi Everyone,

I have my support system on the same server as some customers and want to be able to whitelist this domain so if they get blocked out they can still access the support system. Is this possible?

Hi,

We have a situation whereby we need two levels of geoblocking, and I was wondering if there was any way of achieving this in CSF as it stands.

We use the CC_DENY_PORTS option to block all FTP/SSH/cPanel/Mail ports from a dozen countries due to the amount of hack attempts that come from those countries. The only port we don't block is 25, as we want mail to be delivered from anywhere,...

Hello,

csf -v
csf: v12.09 (cPanel)

LF_MODSEC is set to 20
LF_TRIGGER is set to 0
LF_SELECT is set to 0

an IP matches more than 20 hits with mod_security for minute but IP is not blocked:

grep x.x.x.x /var/log/apache2/error_log | grep modsec | awk '{print $4}' | grep 21:50:50 | wc -l
23

Waiting for your reply

Regards

I have a cPanel server with CSF installed. I am looking for an option to restrict access to a certain page (independent IP for the cPanel account). Am I able to set up a rule for a specific cPanel IP in CSF (cPanel has over 30 IPs)?

Hi,

Our external backups have not run all weekend due to a connection error. Looking at the IP address in CSF, it shows the IP address is in one of the blocklists we use, however, the address is also in the GALLOW ipset.

I'm wondering how come this is still getting blocked?

IPSET: Set:chain_GALLOW Match:nn.nnn.nnn.nnn Setting:GLOBAL_ALLOW

IPSET: Set:bl_FIREHOLLEVEL1 Match:nn.nnn.nnn.nnn...

I have csf firewall up and working on a centos 7. I have a web control panel that i only want access from a certain ip address. I am not certain about how to do this.

So I know the port is open on the csf.conf. I know I am supposed to add the port and ip address in the csf.allow.

But I am not sure how to do this. Do i remove the port from the csf.conf file ? Then add only the port and ip...

Hi i recently installed CSF on my new webuzo server , after installing all the requirements i have one error still remaining .

When i do a restart csf -r i get the following error

*WARNING* Cannot use DROP_OUT value of [] on this server, set to DROP

What does this mean? and if this is a problem i should worry about, how can i fix ?

Thank you.

Hi All

I run a dedicated server with cpanel, until today i had csf installed, however since cpanel updated it stopped working and have had to remove to be able to get server to respond.

I did speak to the cpanel tech guys seems they dont want to know as its not their issue.

Has anyone else had this issue.

I did uninstall and reinstall today, however the result was the same. Im guessing this...

We would like to use csf on solusvm slave server since we are getting injected and almost getting root escalation without notice on the slave server, however after enabling csf it would always block all access to the VM (KVM) except the slave server itself. If we run service network restart it would be fine but only for 5 minutes which is clearly something csf is doing.

Tried the following...

Hello.
I'm newer here, if I start some stupid question, please excuse me.

I use firewall in WHM with CentOS 7*64, the config file of firewall are installed by host, and today, navigate in this site I view are scripts for download/install for my self
Therefore, now I do not know if it is better to use script downloaded from this site...

My doubt is that, in the host where I have the doubt /...

This is happening to me on 2 non-cpanel servers that we're running. Basically the title of the email reads something like: lfd on localhost.localdomain

How do we get localhost.localdomain to be the actual hostname of the server?

We have our hostname attached to each IP in /etc/hosts. On 1 server, the sending email is showing: root@ourdomain.com, but for some reason the other one is still:...

I contacted the support CPANEL , following the return mail :

I apologize for the confusion, but we cannot update CSF for you, despite the offer made by the previous analyst. CSF is not our product, so we do not provide support for it, including updating it or changing its configuration. You will need to update CSF yourself. You can update CSF in the plug-in in the WebHost Manager, or in the...

Hello,

Restarting csf causes: FORWARD DROP failed at line 1359 in /usr/sbin/csf

After that basically all traffic is blocked to/from server.

Server is a web-server with cPanel-Cloudlinux.

I want to ask about the exception of domain access or send an email where I previously made a block for regional China via CSF, but there is one of our customers who objected because of many relations (consumers from that country).

Is there a way of excepting for one of the domains to keep escaping but I still block the region of China.

In essence, I want only one domain to be able to escape or...

Hi i get emails like this every few minutes

Time:    Mon Feb 27 08:26:12 2017 +0000
PID:     13825 (Parent PID:9399)
Account: nobody
Uptime:  10887 seconds

Executable:

/usr/sbin/httpd

Command Line (often faked in exploits):

/usr/sbin/httpd -k start

Network connections by the process (if any):

tcp: 0.0.0.0:80 -> 0.0.0.0:0
tcp6: 0.0.0.0:80 -> 0.0.0.0:0
tcp: 0.0.0.0:443 -> 0.0.0.0:0
tcp6:...

Hi -
I'm getting a Suspicious File Alert notice regarding certain dynamically generated cached font files (TTF) within a particular WordPress plugin. Here are a few notices:

Time: Sun Jan 6 00:05:05 2019 -0900
File: /tmp/gravitypdf-f9030c7ae762b0c8213685204124121f/mpdf/ttfontdata/dejavusanscondensed.mtx.php
Reason: Script, file extension
Owner: dxlkfhpl:dxlkfhpl (1014:1016)
Action: No action...

Hi All,

I'm using CSF and LFD on one of my WHM servers and have been getting about 6 of these alerts every hour:

Time: Wed Nov 14 06:05:24 2018 -0400
File: /tmp/.xcloner-cc30b
Reason: Suspicious directory
Owner: : (538:538)
Action: No action taken

All 6 are always the same content with the exception of the 5 characters after .xcloner-

Anyone have any suggestions on how to stop these? The...

Hi,

I have 2 IPs on my server running Ubuntu 18.04 LTS for this post I will call the IPs 1.1.1.1 and 2.2.2.2

I would like to have use 2.2.2.2 for TeamSpeak 3 and need to option some TCP and UDP ports for it to all work.
I read I can open the ports using csf.allow but not sure how to allow the IP only to thoses ports

These are the ports I need to open only for the IP 2.2.2.2.
TCP In:...

Is there a way to reduce the counter for an LFD trigger in regex.custom.pm?

I have a log which counts displays of a ReCaptcha page which works well but I would really like to reset the counter for the trigger level after a successful validation. This is also logged in the same file.

I would be grateful for any suggestions please.

Hello all,

I want to enable CSF email alert service. This server is an Ubuntu 18.04, Nginx. It's already installed sendmail and it's working properly. I have enabled following services in CSF configuration file and reloaded CSF ( csf -r ).

LF_ALERT_TO = myemail@gmail.com
LF_ALERT_FROM = root
LF_ALERT_SMTP =
RESTRICT_SYSLOG = 3
LF_EMAIL_ALERT = 1
LF_SSH_EMAIL_ALERT = 1

But when I log...