Currently the following IP's are configured in CSF for cPanel support:

208.74.123.2 # cPanel Auth Server
208.74.123.3 # cPanel Auth Server
208.74.121.82 # cPanel Auth Server
208.74.121.83 # cPanel Auth Server
208.74.121.85 # cPanel Auth Server
208.74.121.86 # cPanel Auth Server

Upon opening a new ticket last week, we were advised that their support address block has changed to:

184.94.197.2...

Hi. I'm wondering if there's a way to not receive warnings for, say, ssh-agent for a specific user. I know that I can ignore all processes by a user, and all warnings for a specific executable, but is there a way to combine the two and ignore a specific process by a specific user?

What is the timeout for LFD UI to kick you out to the login screen? It seems very short, is there a way to change it? I tried to migrate some CSF settings from another server over and when I went to save it had already timed out and I had to start again. I did that twice before just saving after every 3rd setting....

csf can be configured so that when a client is blocked by ip itself site will display a message , (AS BEEN BLOCKED IP )

I have a domain that crawls a lot of other domains. For sites that have a lot of urls to crawl I get a permanent block do to CT_LIMIT being reached. I know i can add the IP addresses for them in csf.allow, but this doesn't work as my site is a SaaS and needs to allow lots of different IP addresses. Is there a way for me to have this one domain not monitored for CT_LIMIT?

Thank you,

Tony

Hi guys.

Fantastic product by the way.

I want some host to be excluded from the RELAY ALERT I'm receiving. These are the IP of my mail filters. I don't want to increase the RT_RELAY_LIMIT so I can keep alerted if another IP is abusing.

Here is the alert I'm receiving:
Time: Wed Jun 12 10:47:22 2019 -0400
Type: RELAY, Remote IP - 144.217.xxx.xxx (CA/Canada/xxx.xxxxxxxxx.net)
Count: 101 emails...

Hello all,

I tried adding port rules for a specific IP that is present in a BLOCKLIST to access the server. It was added to csf.allow

tcp|in|d=80|s=xx.xx.xx.xx
tcp|in|d=443|s=xx.xx.xx.xx
tcp|out|s=80|d=xx.xx.xx.xx
tcp|out|s=443|d=xx.xx.xx.xx

After reloading the csf, when I ran a csf grep, it shows as below

# csf -g xx.xx.xx.xx

Table Chain num pkts bytes target prot opt in out source...

Good da Guys

I am currently evaluating CSF / LFD, I have a colleague that put me on CSF, and he claims that:

CSF/LFD it could warn/block on *successful* logins from multiple IPs.

I just want to double check with community if that is true. I don't know if it is in my heads, but it just seems a little hard to be true. Or back to front thinking , for surely tools like LFD / fail2ban etc monitor...

Hi,

csf.conf is using maxmind geolite2 country, but this is not available anymore from 2 Jan 2019.

Any fix?
(using it for CC_ALLOW/CC_DENY)

Thank you.

Hello,
We have a VPS with Centos 7.6 and Cpanel/WHM installed. We installed CSF and it worked great until some days ago. The interface in WHM doesn't load and it is showing a blank page.
In the error logs we fond the below:

Below you can find the error log from /usr/local/cpanel/logs/error_log:

warn The subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/csf.cgi) exited with an...

Following a recent operating system upgrade to Fedora 30 I have now found that CSF will no longer work: running perl /usr/local/csf/bin/csftest.pl gives the following issues:

perl /usr/local/csf/bin/csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...FAILED - Required for csf to function
Testing ipt_multiport/xt_multiport...FAILED - Required for csf to function
Testing...

Well I'm sure I'm daft on this, but after reading the new blog update at today, I'm not sure what I'm supposed to do with that file at all.

Would anyone be so kind as to provide a bit of guidance?

Thank you :)

I am looking for a field to add a command like cphulk

Is there any existing functionallity? Or can be added?

I need to post remote ip/country/reason/time etc to able to track and build my own blocklist

Hi,

We use CSF on our cPanel DNS only servers. We have had a lot of attacks against them recently. However in CSF it only seems to keep the last 200 ip's blocked. How can we keep all blocked ip's please?

Hello

The delete CloudFlare command is returning the failure
both at the interface and also at the command line.

CloudFlare Delete xxx.104.28.197 for user(s) SRV12:

Message:
csf - CloudFlare: id failed: 400 Bad Request (SRV12)

- Command line
# csf --cloudflare del xxx.104.28.197 SRV12
csf - CloudFlare: id failed: 400 Bad Request (SRV12)

Regards.

Jean

Hello,

I set CF_ENABLE to 1 and put my api and email to the csf.cloudflare file but csf will not sync csf.deny ips to cloudflare firewall

Hi.

On my server has CSF configured for stop users using sendmail or not authenticathed SMTP.

But after one problem with Hotmail, I see that configuration by pass.

/etc/csf/csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing...

Hello,

I set CF_ENABLE to 1 and put my api and email to the csf.cloudflare file but csf will not sync csf.deny ips to cloudflare firewall

How to maintain and deploy configurations for CSF firewall for several Ubuntu Linux servers?

Currently I maintain configurations for each server separately on my PC. If and when I make a change or improvement I manually ripple it across all the configurations and upload to my servers. This is error prone and tedious. (A configuration is a set of files such as csf.conf, csf.allow, csf.ignore,...

We're trying to route all traffic on our server through Sucuri's networks, and for the most part that's worked with the following entries in /etc/csf/csf.allow (IPs listed below are not private, they are owned by Sucuri and publically accessible):

tcp|in|d=80|s=192.88.134.0/23 # Sucuri Range
tcp|in|d=80|s=192.124.249.0/24 # Sucuri Range
tcp|in|d=80|s=185.93.228.0/22 # Sucuri Range...