Hello,
I changed the value of LF_CPANEL to reduce the chance of banned IPs
due to bad password mistakes but I still don't understand the
purpose of the LF_CPANEL_PERM variable.

Can somebody explain me it better?

PS: Is it possible to attach pictures to posts of this forum?

Hi,
I am using my VPS under CentOS 7.10 with CPanel/WHM, and everything work well, but I've got this message from LogScanner, I've check the ifconfig and found three adapters installed
eth0 >> primary one with 10.x.x.x configuration
eth0:1 >> External IP
lop01 >> 127.0.0.1
is there any recommended thing to do in this case?
warn detects system IP as 64.202.186.216 and system local IP detected as...

Hiya all,

I just noticed this happening since today and I don't know what's going on. See the log below:

Apr 25 17:28:46 arabier lfd : (WordPress) Failed wordpress login from 88.68.42.8 (DE/Germany/dslb-088-068-042-008.088.068.pools.vodafone-ip.de): 5 in the last 3600 secs - *Blocked in csf* for 86400 secs
Apr 25 18:35:35 arabier lfd : Incoming IP 88.68.42.8 temporary block removed
Apr 25...

Hello,
I have noticed several errors like the following line
xxx.yyy.zzz.xxx # lfd: (eximsyntax) Exim syntax errors from xxx.yyy.zzz.xxx (PE/Peru/-): 10 in the last 3600 secs - Tue Apr 23 22:16:45 2019
and some of them are false positives so I was wondering if it is possible
to disable any rule to avoid IP blocking for this reason.

Hi All,

I'm getting hourly Log Scanner Reports --

lfd on xxx.xxx.xxx: Log Scanner Report for 15:00, (lines:144)

I would like to turn these off if possible, does anyone know if this can be done?

Thanks!

Hello,
i have a vps (kmv) and i would block all incoming connections outside Italy.

this server is
Centos 7 + cpanel

so i disable cphulk and install CSF.
then install
yum -y install ipset

my CSF conf is:
...
CC_ALLOW_FILTER = IT
...
LF_IPSET = On
...
FASTSTART = Off
...

restart CSF , i tried reboot server also but i can connect from another my server located in France.

if i disable LF_IPSET...

We are using a reservations system on a new web site. The payment processing in that system uses a hosted payment form at Authorize.net, and when the payment is successfully completed Authorize.net submits a POST back to the reservation system to confirm the payment and retrieves a Thank You page from our web site and displays it to the customer. When the CSF/LFD firewall on the server is...

Just setup docker with csf, rules arent working, i still cant build containers (docker cant connect to outside world)

maybe there are some settings in csf blocking it? or more rules need to happen?

Running Amazon EC2 (Amazon Linux) with a load balancer.

CSF has been running fine until today (some 1.5 years).
I logged in via SSH and ran the latest update for EC2.
Then restarted CSF - and https and sftp stop working worldwide.

Disable CSF - all good.

Turn CSF TEST MODE on - all fails.
- My understanding is LFD does not run when in test mode. So LFD not the issue.
I have flushed iptables,...

Upgraded to cPanel 78.

lfd won't start

lfd : Main Process: Can't locate Net/DNS/Resolver/linux.pm in @INC (you may need to install the Net::DNS::Resolver::linux module)

Not really finding anything that uses Net::DNS::Resolver::linux - not sure what's going on.

Not seeing where anyone else has had this issue, and I'm sure I'm not the only one using cPanel 78 now. So have to believe it's...

Hello CSF blocking my own customers IP's address. Please help me to change some settings... I don't want CSF to block my customers IP's like when my customers use his wordpress and try to create a new post CSF blocked his access.

Hello, I am using cPanel and csf installed in it. I have blocked port 80 and 443. Now some of the services are not working. So, If I enable those IPs then it is working fine. Like on my wordpress website Akismet was not connecting after blocking the Ports. So I have allowed Akismet IPs and now it is working.
I have added gdrive backup system on my cpanel server for backup. After blocking these...

This is happening to me on 2 non-cpanel servers that we're running. Basically the title of the email reads something like: lfd on localhost.localdomain

How do we get localhost.localdomain to be the actual hostname of the server?

We have our hostname attached to each IP in /etc/hosts. On 1 server, the sending email is showing: root@ourdomain.com, but for some reason the other one is still:...

Since the last update to csf we've been getting multiple notifications every time a user accesses phpMyAdmin.

lfd on xxxx.xxxxx.com: Suspicious File Alert
File: /tmp/pma_template_compiles_USERNAME/twig/9f/9f2b0868c0ee3bdb8fbcdba6e363515596d67849ea34a2ad71b70607edbb2a33.php
Reason: Script, file extension
Owner: USERNAME:USERNAME (510:507)
Action: No action taken

I would normally just...

CSF from configservers is killing processes from my PHP-FPM, could they help me prevent this?

hey,
how can I block all the world except 1 country?
I can't block all the countries with CC_DENY due to limitations in the IPSET .. I get an error of the kernel limit
I tried to put the country inside CC_ALLOW_FILTER but users still login outside the country in CC_ALLOW_FILTER

thanks for the help

I have noticed that CSF has started to ban Google IPs when a user did setup Gmail to import their email account contents using pop3 showing an alert message like 5 distributed SMTP Logins on account
Has anybody else have noticed something similar?

Default vanilla CentOS 7 minimal installation.

After a new CSF installation, executing csf -r you get:

*WARNING* Binary location for in /etc/csf/csf.conf is either incorrect, is not installed or is not executable
*WARNING* Missing or incorrect binary locations will break csf and lfd functionality

I have setup MyJoomla to help manage my Joomla websites. Part of their service is setting up uptime monitors via UptimeRobot.com.

I whiltelisted the IP addresses for both services:

178.62.5.35 # Manually allowed MyJoomla: (England) - Tue Mar 20 14:50:59 2019 DO NOT DELETE
178.62.31.185 # Manually allowed MyJoomla: (England) - Tue Mar 20 14:50:59 2019 DO NOT DELETE
178.62.47.108 # Manually...

Hello,

Lately I'm seeing a lot of incoming SMTP traffic, which is rejected by EXIM.

Example:
2019-04-02 18:29:24 Connection from :59957 refused: too many connections
2019-04-02 18:29:24 SMTP connection from net-2-45-190-15.cust.vodafonedsl.it :28532 lost D=5s
2019-04-02 18:29:24 SMTP connection from :41794 (TCP/IP connection count = 20)
2019-04-02 18:29:24 Connection from :7242 refused: too...