Hello!

I'm getting this log spamming on my new server:

USER yyyyy: no such user found from 107.150.xxx.xx

My configuration of LF_ is:

LF_TRIGGER = 5
LF_TRIGGER_PERM = 3600
LF_SSHD = 5
LF_SSHD_PERM = 3600
LF_FTPD = 1
LF_FTPD_PERM = 3600
LF_SMTPAUTH = 1
LF_SMTPAUTH_PERM = 3600
LF_EXIMSYNTAX = 1
LF_EXIMSYNTAX_PERM = 3600
LF_POP3D = 1
LF_POP3D_PERM = 3600
LF_IMAPD = 1...

I've decided to start a new thread because I haven't seen any current working solution, or activity on older threads regarding this issue.

I have spent countless hours over the last 3 months trying to solve this issue with email that is getting blocked which comes from Gmail:

DNS Error: 91335 DNS type 'mx' lookup of localinternetads.com responded with code SERVFAIL

I've read through 3 dozen...

I'm having a lot of problems with clients blocking themselves by signing in with the wrong email login details.

All my clients are in Ireland and I was wondering if I was to use CC_ALLOW_FILTER IE would it stop the problem.

2. If I was to do that would it create significant additional load on the server?

Hi Team,

I have added 177.0.0.0/8 # BR/Brazil/NA. do not delete to our deny list of IPs.

Normally when a range is blocked, then I don't continue to get e-mail notifications for that denied range... however recently I am getting notifications for repeated hacks for IP Addresses that are blocked on the deny list of IPs
Is there a way to ONLY get notifications of NEW IP Address hack attempts?...

Hi All,

I was wanting to permanently deny the following IPV6 IPs

QUESTIONS:-
1) Will the following work?
0:0:0:0:0:ffff:65fe:e68c/120/ # CN/China/Beijing, Xuanyu. do not delete
0:0:0:0:0:ffff:6f49:2e21/118 # CN/China/Nanchang. do not delete
0:0:0:0:0:ffff:7276:6175/120 # CN/China/Beijing. do not delete
0:0:0:0:0:ffff:7bf9:d28/119 # /Shenzhen. do not delete
0:0:0:0:0:ffff:d3da:7e8e # KR/Korea...

Hi

I've got a customers IP that has been blocked multiple times due to trying to set up their email with the wrong password. I've unblocked them multiple times and added them to the allow list so that they have time to sort things out their end. However they are still unable to access it.. When I do a search for their IP it brings up the following, which I do not appear to be able to unblock or...

Only a certain reseller does not have access to the Configserver Firewall plugin.
As I did not find any problem that could cause this, I contacted cPanel support. And it looks like there's a bug. Here is the answer from cPanel support:

At this time, all reseller privileges for ablhostc are configured correctly to allow access to the ConfigServer interface, however I do see that ConfigServer is...

Howdy,

We've got an interesting issue with CSF on one customer's VPS only whereby the customer will log in to WHM in order to remove an IP block for a client of theirs only to find that CSF is showing up as disabled - with a button to reenable visible.

They're not disabling the firewall and neither are we, but the interesting part here is that the logs indicate that CSF is in fact functioning...

Hi guys. Been using CSF/LFD for quite a while now and am a big fan, but I have an issue I need help solving.

I have quite a few resellers that find themselves with clients that frequently have incorrect login credentials for either Imap or POP3 services. Since I don't want to disable this protection (obviously) I would like to know any workarounds where the clients will still be able to make it...

Hello. I like csf and use it on all servers. Some times ago I try to use docker. If I use network as host-mode and enable docker in csf.conf - all worked fine. But if I use docker-compose with bridge network - it's not worked. I find some script to fix it puppet-csf .
Now docker work fine and csf worked, but script create DOCKER-ISOLATIONS rule and csf blocks all ports without port used by...

Hi,

How to configure CSF to allow CIFS mount?
Ive enabled TCP_IN and TCP_OUT ports 139. 445 (both for IPv4 and IPv6) and I still get errors:

Nov 3 20:26:13 kernel: Firewall: *TCP6OUT Blocked* IN= OUT=eth0 SRC=xxxx:xxxx:xxxx:xxxx:0000:0000:0000:0001 DST=2222:xxxx:xxxx:xxxx:0000:0000:0000:0001 LEN=80 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=54886 DPT=445 WINDOW=28800 RES=0x00 SYN URGP=0
Nov 3...

Hi all,

Came across a user who was blocked for portscan on 443, is this normal? As far as I can tell my CSF is configured correctly to allow connections on 443, and browsing HTTPS hosted sites works just fine.

/var/log/messages
# grep ::data-removed:: /var/log/messages
Oct 31 11:15:49 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:15:5d:64:7b:05:::data-removed::...

Hello,
after i have updated csf from v11.7 to latest version 12.08, some things on my server have stopped working (such as cronjob for udptscaper) so i desperately need the old working version and ask everyone who has it somewhere to send one such to me ...

thanks to all of you

This one user we have keeps calling us because LFD has blocked him every time his IP Address changes (cell tower change, etc)... How do i prevent this block from happening without disabling all email login failure blocks?

Log entries:

info - user@domain.com POST /cpsess#############/3rdparty/afterlogic/?/Api/ HTTP/1.1 FAILED LOGIN webmaild: cookie ip check: IP address has changed
info - -...

***necessary grave-dig***

I have same problem. Disabling IPV6 is not a proper solution in the server world.

I added my IP to csf.allow, I generated self signed certs and those did not work either. I cannot access the UI on the port configured. I get ERR_CONNECTION_RESET from the browser.

When accessing the https:// URL I get a SSL warning, which I accept and add exception, then I get...

Hello,

We have an IP that keeps getting temporarily blocked. I've searched all the logs and there are no hits to that IP address.

Running the unblock IP returns the data that a temporary block was removed and access is restored. Seems to be every 10 minutes or so. We have been searching devices on our network to see if something is misconfigured to no avail.

Would love to get more data from...

Hello,

I've been using CSF & LFD for years and it's done very well for me. However I'm attempting something I haven't done before and am having trouble getting it to work. I am trying to block IP addresses that are attempting to POST command lines (nohup, wget etc) into perceived Drupal vulnerabilities. The vulnerabilities are long gone but these attempts are generating significant traffic....

Has anyone answered your question yet?
Seems like a very important question. One I would like to have an answer to too.

I have a laravel command as cron job that runs every week. I keep recieving emails that the command line is exceeding process time. I need to igonre this in process tracking ignore:
Executable: /usr/bin/bash
Command Line: /bin/bash -c php /home/rayes/backend/artisan redis:subscribe >/dev/null 2>&1

here's what i tried to put in the process ignore tracking
exe:/home/rayes/backend/artisan...

Just to let you know, all the free script .tgz packages are double compressed. So they're not gz->tar, but gz->gz->tar.

This applies to csf, cmc, cmm, cmq and cse.

This might fail to extract, for example when using a multithread program with tar:

bsdtar --use-compress-program pigz -d -xf csf.tgz

It was spotted here: