ConfigServer Community Forum

Hi,
I have enabled SMTPAUTH_RESTRICT on csf and whitelist my country in CC_ALLOW_SMTPAUTH.
I intend to relay only clients from my country..
I works but i still have a few alerts like this:

Time: Sun Oct 18 23:54:13 2020 +0200
IP: XXXXXXXXXXXX (AU/Australia/-)
Temporary Blocks: 5
Temporary blocks that triggered the permanent block:
Sun Oct 18 19:37:31 2020 (smtpauth) Failed SMTP AUTH login from...

Hello good afternoon.

Some time ago I installed csf on my Cpanel server.

The problem I have now is that when I give the enable button to seconds the csf stops working. I give it to enable again and the same thing happens to seconds it stops working.

In /var/log/messages appear this:

Sep 30 12:16:05 hostname lfd : Main Process: TERM
Sep 30 12:16:05 hostname lfd : daemon stopped

Sorry for...

Hi!

Is there a forum board for the OSM (Outgoing Spam Monitor) plug-in?

Thanks!

Hi,

I have a server we need to block everything on it from every IP expect for one.

So the server would not ping or allow any connections to it other than from that IP.

Is that possible?

Hi there,
I have a server that runs CWP. I also have Wireguard installed on the same server.
Wiregaurd on clients is working fine till I enable csf. When I enable csf, clients can connect to the server through Wireguard, but they don't have internet traffic at all.
Can anybody help me to force csf to let the Wireguard clients have their own traffic?

Regards

How can I change what goes into the deny lines in the csf.deny

Example:
#.#.#.# # lfd: (mod_security)
#.#.#.# # lfd: (smtpauth) Failed SMTP AUTH login from

To:
#.#.#.# # Security filter triggered
#.#.#.# # Failed SMTP Logins

Hi there!

I do not have a MaxMind license installed, but I have entered settings in CC_ALLOW_FILTER. I appear to still have unallowed countries accessing the server.

Does CC_ALLOW_FILTER require a MaxMind license?

Thank you!

Hi,

I have various ConfigServer software in my server, but I don't know how update him.

In this server I have CentOS + WHM/cPanel. How can I update ConfigServer Explorer, ConfigServer Mail Manage and ConfigServer Mail Queues ?.

The command yum update will update him to last version?.

Thank you very much!

Hi,

I'm running cPanel on CloudLinux and have run CSF, CXS, MSFE for many years.

My server was just updated to include ImunifyAV. WHM security advisor recommends uninstalling ClamAV if ImunifyAV is installed.

Is it possible to continue to use the configserver security suite if i uninstall ClamAV? Is it really necessary to do so?

thanks in advance

Upgraded to cPanel 78.

lfd won't start

lfd : Main Process: Can't locate Net/DNS/Resolver/linux.pm in @INC (you may need to install the Net::DNS::Resolver::linux module)

Not really finding anything that uses Net::DNS::Resolver::linux - not sure what's going on.

Not seeing where anyone else has had this issue, and I'm sure I'm not the only one using cPanel 78 now. So have to believe it's...

Getting this error consistently over the last week or so.

To my knowledge, no changes that might have triggered this have been made on my server.

cPanel/WHM server on CentOS latest release version. All software up to date.

Added the csf filter to both csf.ALLOW and csf.IGNORE.

Not sure why this is happening. I am going to strip the restrictions and just put the IPs by themselves and see if it...

Brute Force Protection in CSF for IMAP, POP3, and SMTP is a support nightmare. Here are a few scenarios:

1. A user inputs an incorrect password in an email app on a device. The app quickly exceeds the login failure threshold and the user's IP address is locked out of the server, even though the app is trying the same password over and over.
2. A user changes their email password and enters the...

I'm currently evaluating several firewalls. My goal is to block all traffics from VPN providers. We have the VPN IP address list from the IP2Proxy in the following format with IP address ranges in decimal format.

17496733 , 17496733 , VPN , TH , Thailand
17496784 , 17496784 , VPN , TH , Thailand
17543533 , 17543533 , VPN , KR , Korea (Republic of)
17544563 , 17544563 , VPN , KR , Korea...

Hi All,

We're getting swamped with LFD Excessive Resource Usage emails and are working on that. Just wondering though, if its possible to modify the email subject as to remove the PID

for example, the email we get now is:

RE: lfd on hostname.servername.com: Excessive resource usage: username (45750 (Parent PID:45750))

Would like it to be:

RE: lfd on hostname.servername.com: Excessive...

At the time of an attack on SSH, a lot of CSF processes are created, sometimes I reach even 60 blocking processes.
This saturates CPU time, what can you do about it?

I've searched and read many posts on this topics before but I still don't find it clear what specific syntax to use in the csf.pignore file. These is the type of warning I'm trying to ignore.

lfd : *Suspicious Process* PID:3792 PPID:3788 User:username Uptime:121 secs EXE:/home/virtfs/elemcms/opt/cpanel/ea-php73/root/usr/bin/php CMD:/opt/cpanel/ea-php73/root/usr/bin/php -f cron.php

Right now I...

Hello,
which directive would be enabled or disabled so that connections to remote services are made without having to whitelist the ip of this service?For example if a client must connect to an API from his website with the IP address: 192.168.2.3 we need to whitelist this IP on the firewall

Best Regards

Hello,

I am trying to add an open port.

The port is listening:
# netstat -punta | grep 5666tcp 0 0 127.0.0.1:5666 0.0.0.0:* LISTEN 1084400/nrpe

but in csf it does not appear in the section: view listening ports

I have added the port in firewall configuration in Allow incoming TCP ports but in the View listening ports I don't see the open port.

What could be the problem?

Best regards,

Check your config for DENY_IP_LIMIT e DENY_TEMP_IP_LIMIT

I have a person or bot that keeps requesting an image(s) that exists on my website creating multiple 404s. I can't block the image because other users might request it. Sometimes over a period of time I might get 2000 emails about 404s. He doesn't do it real fast, just continually and it doesn't create a big load on my server. He changes IPs constantly and changes images that he requests as well...