ConfigServer Community Forum

Hey,
I'm unable to start lfd on centOS 8.2 with DirectAdmin v.1.61.3. iptables v1.8.4 (nf_tables). CSF and LFD in newest versions.

Logs:

CSF:
csf : iptables v1.8.4 (nf_tables): RULE_APPEND failed (Invalid argument): rule in chain OUTPUT
csf : LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 0.0.0.0/0
csf : iptables v1.8.4 (nf_tables): RULE_APPEND failed (Invalid argument): rule in chain INPUT...

Good Day

I would like to know if it is possible to exclude a domain name from csf. A client of mine is constantly blocked when using his email on his pc via Outlook. Have one through all settings and setup the account numerous times.

Any suggestions will be helpful.

Thanks in advance.

Can someone help me ? I have the following problem.

I configured CSF on a new server and everything was working perfectly, but after I added a few more ips via Cpanel Interface (range of 16 ips) my server crashed, I couldn't access whm or ssh, luckily I have physical access to the machine and to the monitor and I was able to disable the csf with the command csf -xe after disabling everything...

Good morning!
I am new to csf so sorry if this a repeat thread. How do I use the csf firewall app in WHM to white list IP address ranges? The documentation I have read is not very clear.

Thanks in advance.

Eric

Hello

the LFD keeps failing and recovered every fed minutes

The service “lfd” appears to be down.
The system’s command to check or to restart this service failed.

i have tried to investigate the issue by

# service lfd status
Redirecting to /bin/systemctl status lfd.service
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled;...

Hi guys!

I made a custom regex rule that worked in the begging but now looks like it's not triggered anymore.

Here it is:

if (($globlogs{CUSTOM2_LOG}{$lgfile}) and ($line =~ /(\S+).*] \w*(?:POST) .*\/admin\/ HTTP.*301.* /)) {
return ( OC Admin attack ,$1, OC-admin-login , 1 , 80,443 , 8600 );
}

and in the /etc/csf/csf.conf:

CUSTOM3_LOG =...

Hello.

I hope everyone is safe and healthy.

The most recent update (Oct. 4, 2021) of ConfigServer wiped out all my previous settings. Does it make a backup somewhere?

Thank you.

helo
lets say our server has 2 ip A and B.
but i only want to block ip A to access country CN.
how do we achieve that?

cc_deny , yes we can use that but for ip source A and B.. how do we only apply ip A?

I've got a user that keeps getting blocked for a custom LFD rule to block 3 consecutive Worpress failed logins within 3600 seconds. But they swear they are not getting failed logins. The rule is the widely published rule:

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] POST \/wp-login\.php.* 200/)) {
return ( Failed WordPress login from ,$1, wordpress , 5 , 80,443 , 3600 );
}...

Our CS&F works well but we are getting Excessive resource usage warnings that I can't see how to stop using csf.pignore.
And I can't see a solution in the forums.

Our developer uses the Visual Studio Code remote extension and the executable link varies for each hosting account e.g:
Executable: /home/murrayheatingand/.vscode-server/bin/7f6ab5485bbc008386c4386d08766667e155244e/node
Executable:...

Genuine transaction or website access or wordpress-admin updates are blocking csf with the following reason.

Temporary Blocks: IP:157.33.50.133 Port:80 Dir:inout TTL:518400 (Blocked port 80 with Directadmin Brute Force Manager)

How to prevent this or how to prevent the genuine traffics.?? its happening for all.

When Cpanel updates it modifies MANY files. And CSF warns the administrator about these changes.
I have created a feature request on Cpanel that was just approved so the update process try to inform CSF LFD of those changes so it stops barking at it.

Please support this feature request here:

Sorry if this is a dumb question, but what's the difference between the DYNDNS_IGNORE and GLOBAL_DYNDNS_IGNORE settings in csf.conf?

Hello,
i have a new vps with almalinux 8.4 and install csf firewall.
works fine but not block attack on ssh.

i check and found on almalinux there isn't a file
/var/log/secure
(like centos 7).

searching i found that centos 8 / almalinux 8 use journalctl
so if i run in ssh
journalctl _COMM=sshd
i found error (like old log files)

so what i write in /etc/csf/csf.conf
SSHD_LOG = .... ????

thank...

I'm having another issue with CSF blocking inbound emails from Gmail. I logged into multiple gmail accounts and tried to send email to one of our servers and the emails are never received. After I disable CSF firewall i can then receive email from all 3 gmail accounts. I flushed all IP blocks, and added Googles entire IP block 209.85.166.0/255 to CSF ignore. Restarted CSF and still CSF is...

I usually receive a minimum of 50 LFD blocked alerts a day, but yesterday I noticed a sudden decrease to only a handful. This seems like an anomaly, so I am a bit concerned. I haven’t made any changes to the Firewall configuration (except for PT_Usermem) and I’m not seeing any major changes in my server activity. In short, I don’t know if this is a problem or not. Just wondering if anyone has...

I understand that for certain sites, like those that accept credit cards, MaxMind provides fraud prevention. But I don't understand what functions it offers in CFS's Firewall Configuration.

Also wondering if there is a log of MM's activity.

Any insights are appreciated.

I have a fairly new 'large' AWS instance which houses around 40 'not very busy' websites, yet I regularly get a High 5 minute load average alert email.

The that I have just received says:
Time: Thu Sep 2 12:35:36 2021 +0000
1 Min Load Avg: 27.97
5 Min Load Avg: 8.12
15 Min Load Avg: 3.15
Running/Total Processes: 68/395

I compare this to an 'x-large' AWS instance I have that houses 100+...

My website suffer from bad bots and Invalid Traffic bots can i configure csf to stop that

Couldn't find a specific forum for OSM so posting here.
Hi, You installed OSM for us as part of the cpanel services a few months ago. OSM has now sent us a mail report but does not say who the user account sending the mail is or what directory the mail script originated from. Are we missing something? Example:
WHM Report URL:

Report Date:

Fri Nov 22 16:03:44 2019

Report Message:

User...