ConfigServer Community Forum

Hello,

I'm experiencing a bug using CSF on cpanel CENTOS 7.7 v86.0.18 that is banning cloudflare ips.
I have enabled mod_cloudflare and it's working because I can see the real ip address of requests on Apache Status, but CSF is always banning cloudflare ip.
I also have enabled for the website that is getting flood and ddos attack cloudflare ban ip but I can't see that any ip address was added...

Configserver appears to by in the UK.

We have country code blocking in place using CSF (and have for 18 years...)

When we place in CC_DENY. PL,NL,FR,CN,RU,DE,AN,TR,HK,CH,FI,SE,DK,IE,SG,AU,BG,LV

Even though UK is not listed, updates fail and will never work again unless all removed. Is this a bug? Or are updates coming from a country other than UK?

Hello is it possible to block an IP at CSF level if that IP tries to access a url pattern like anydomain.com/includes/folder/restricted.php

thank you in advance

The UI status shows stopped even when

systemctl status csf show the service as Active

Hi,

Im banning a reasonably amount of IP's adding the blacklist URL's to lfd's blacklist function. for example:

BLOCKLIST_DE_ALL|86400|0|
showing the amount of rows it tells me at this moment it has 33147 rows (of which only 6 ipv6 adresses)

yet an ipset list command is telling me it only has 28650 entries.

this happens with some other lists also. What can i do to import all ip's?

Hi i have many DNS recursive query and i want to ban the IPs doing this, i activate in the firewall the LF_BIND but doesn't ban the IP.
What iam missing?

var/log/messages

Apr 14 12:31:43 server named : client @0x2fb4d40c2340 207.148.30.165#11081 (test.baidu.com): query (cache) 'test.baidu.com/A/IN' denied
Apr 14 12:31:43 server named : client @0x2fb4d40c2340 207.148.30.165#1517 (baidu.com):...

I have a server where CSF has been installed for over 3 years but has suddenly started acting up. I have also had Webmin installed on the server for the same length of time and both have worked together very nicely.

In the last couple of weeks I am having major problems with starting, stopping and restarting the firewall through Webmin and the Webmin dashboard says that the firewall is not...

Hi,

When i check csf (check server security), i get this ntice:
Check telnet port 23 is not in use

I have removed telnet by yum remove telnet and port 23 is in block list.

what should i do to find out why this notice has been appeared ?

by the way, I'm using centos 7 and directadmin and there are update.

I'm set up a SoftetherVPN server on Linux Server and create a local Tap Device, bound DHCP server on the device.
If I disable CSF, client users can get IP by DHCP normal. But when enable CSF, a client can't request an IP. So, how do I allow DHCP on CSF?

it turns out that on the PC of the physical firewall I have CSF installed to control all incoming traffic, and from there I route the ports to different applications located on other machines to the rest of the lan.

It turns out that the IPs of all the clients that connect to these applications on different ports and machines of the lan, all appear with our IP WAN and different connection...

Hello friends,
I block everything from CN using the option we have Country Code Lists and Settings

but I wanted to release only one domain that use CN server

example domain: sepco1.com

does anyone know how i can do this?

Hi,
How to filter IPs that connect to the Linux server

Hi,
How to filter IPs that connect to the Linux server
For this I have configured CC_Allow = CL, CL being the code of my country Chile.
However, this configuration does not work, because it continues to block IP SMTP, IP POP, IP CPANEL.

1) I wish I could block only access to cpanel from all countries.
2) And I will free the IPs of my...

Hello,

On our server LFD fails because of:

Log line flooding/looping in /etc/apache2/logs/error_log

When Litespeed restarts, because of this lines in /etc/apache2/logs/error_log:

Processing config file: /etc/apache2/conf.d/userdata/lscache_vhosts.conf
Processing config directory: /etc/apache2/conf.d/userdata
Processing config file: /etc/apache2/conf.d/userdata/lscache_vhosts.conf...

Hi ConfigServer Team and User Friends,

Two days ago, there was a CSF update from v14.01 to 14.02 in my WHM and I got the automatic CSF update email. In the CSF update email, near the bottom line (...All done.), I saw this:

PID file /run/lfd.pid not readable (yet?) after start.

Is this normal or not? If not, how to fix the problem?

Is this a cause why after I manually add IPs and IP ranges...

Config:
OS: Centos 7.7
csf: 14.02
ipset: yes, enabled

Problem:
In config, i enable CC_ALLOW_PORTS to specific country, and list the CC_ALLOW_PORTS_TCP ports. When i restart csf and lfd, i cant reach the specific port from the blocked countries, but after some time, i can.

Example:
CC_ALLOW_PORTS: US
CC_ALLOW_PORTS_TCP: 22

After csf restart, i cant connet to ssh from a host in the US, but some...

So I've built this custom lfd in custom.regex.pm:

if (($globlogs{CUSTOM9_LOG}{$lgfile}) and ($line =~ /^ {2} \d{2} \d{2}:\d{2}:\d{2} Invalid user login booting from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/)) {
return ( Failed booting login from ,$1, booting ,${LF_CUSTOMLOGIN}, 80,443,8443 ,${LF_CUSTOMLOGIN_PERM});
}

In csf.conf I have these variables set:

CUSTOM9_LOG = /var/log/customsecure...

All csf commands on this server appear to hang, for example:

`csf -r`
`csf -g $IP`
`csf -x`

A strace doesn't show anything useful:

```
# ps aux | grep csf
root 2234908 8.2 0.0 169596 21016 pts/2 S+ 11:34 0:00 /usr/local/cpanel/3rdparty/bin/perl /usr/sbin/csf -v
root 2234932 0.0 0.0 114760 968 pts/0 S+ 11:34 0:00 grep --color=auto csf
# strace -p 2234908
strace: Process 2234908 attached...

I'm seeing this every time I restart lfd:

● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2020-03-28 09:47:35 EDT; 3ms ago
Process: 21413 ExecStart=/usr/sbin/lfd (code=exited, status=0/SUCCESS)
Main PID: 21426 (lfd - starting)
CGroup: /system.slice/lfd.service...

Hi guys,

i have a problem. When CSF activated i encounter cloudflare 522 error. I also added the cloudflare ip addresses to CSF whitelist but my problem isnt solved yet. By the way, for example, you get this error when you are surfing on the web site. When you refresh the page, the error is dissappear and then you continue to the website from where you left off.

When i deactivated CSF, i never...

Is it necessary to remove firewalld for CSF to work properly or can they both be together and active?