ConfigServer Community Forum

When setting LF_MODSEC to 3 (for example), does that mean the offending IP is blocked if the *same* modsec rule is matched 3 times, or does it mean the IP is blocked on the 3rd match of *any* modsec rule?

Thanks for any clarification you can provide!

Hello dudes , after updating to v14.03 , I am facing some issues with CSF .
My CSF Automatically Stop and then after some seconds it's Automatically enabled , this happens again and again.
and in logs I see these logs -

Jun 18 20:47:35 server lfd : IPv6 Enabled...
Jun 18 20:47:35 server lfd : LOAD Tracking...
Jun 18 20:47:35 server lfd : Country Code Lookups...
Jun 18 20:47:35 server lfd :...

I'm happy to report that CSF works fine on Centos 8. I fired up a test Centos 8 VM and everything seems to work fine.

# cat /etc/redhat-release
CentOS Linux release 8.0.1905 (Core)

# uname -a
Linux centos8.example.com 4.18.0-80.7.1.el8_0.x86_64 #1 SMP Sat Aug 3 15:14:00 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

The only issues I've run into:

When doing a minimal install of Centos 8 the...

I have CSF installed on a Ubuntu 18.04 machine. We just installed libvirt on the machine and have VMs that are using the internal network adapter virbr0. When libvirt starts, it adds the following rules:

# Generated by iptables-save v1.6.1 on Tue Jun 16 11:48:26 2020
*nat
:PREROUTING ACCEPT
:INPUT ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24...

Hi,

i need to protect FORWARD rules , csf.redirect

-A INPUT ! -i lo -j LOCALINPUT
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j SYNFLOOD
-A INPUT ! -i lo -p tcp -j INVALID
-A INPUT ! -i lo -p icmp -m icmp --icmp-type 8 -j LOGDROPIN
-A INPUT ! -i lo -p icmp -j ACCEPT
-A INPUT ! -i lo -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT !...

When you login to CloudLinux via SSH you get a welcome message something like There have been 9,980 failed login attempts since the last successful login. I was thinking CC_DENY should reduce this number significantly, however I still have a lot of IP's included in that number that are from countries I have blocked. For example in the welcome message it also tells you the last IP blocked, and I...

Hey guys!

I'm hosting a domain for a friend who used to use other hosting provider.
One of his employee is not longer working for him, but this person still have in her smartphone (Actually not her anymore, since she sold it to someone else, but didn't factory reset the smartphone) her old old mail account connected . But this mail box no longer exist, so lfd treats this as a imapd attack.
This...

I cannot seem to get this to work. I am running openlitespeed with mod_security 3.0 module on a non-cPanel CentOS 8 server and it denies access when using test URL, and logs the event like it supposed to, but LFD completely ignores it.

csf.conf has the following:
LF_MODSEC = 5
LF_MODSEC_PERM = 1
MODSEC_LOG = /usr/local/lsws/logs/error.log

I even tried...
MODSEC_LOG =...

Hello,

We'd like to disable the email alerts for certain types of alerts. For example, we don't need an email when there is a POP/IMAP/SMTP login failure, as it's easy to search the logs for there.

Thanks!

Hello,

I'm wondering if CSF has any way to do some aggregate monitoring across a set of clustered servers to look for bad actor IP addresses.

For example even a single IP that is hitting lots of websites across all of our servers is suspicious.

It's really suspicious if it's hitting /xmlrpc.php on multiple sites across our servers and a strong sign it's a bot net or some type of scanning....

Hello,

Anyone can help me to turn off LFD alerts for ossecr service?

Screenshot;

I am getting a lot of emails from the service. I want to turn it off. I have turned off other LFD alerts but I can't turn off for the service I've specified.

Regards,
Khalequzzaman

Hello!
I have server Cpanel Cloudlinux+CSF>
I need make redirect port 4554 on port MySQL 3306.
I added on csf.redirect
But doesn't work , mysql not accept connect

Hello buddies , from somedays I am facing connection was reset by peer issue in my dedicated server.
The Following are installed in my server :
CPanel
CloudLinux
LiteSpeed
ConfigServer Firewall
Imunify360

I asked my friend he said that someone doing Ddos on your server.

sir I checked my IP on check-host.net , and I patched a issue that when UDP Ports showing connection refused then HTTP shows...

Hi,

-I did a simple installation in my server, I installed only: CentOS 8 + Postfix + Mailx + CSF
-I configured in file /etc/csf/csf.conf this data: LF_SSH_EMAIL_ALERT= 1 , LF_SU_EMAIL_ALERT= 1 , LF_SUDO_EMAIL_ALERT= 1 , LF_ALERT_TO= myemail@email.com
-I enabled only 2 ports: SSH port, and port 25 for emails
-I can send emails with command mail and work correctly.
-I not did nothing more for...

Hello,

I was wondering if anybody has any insight into this issue we are seeing. We have centos6 and csf with cpanel integration installed. Sometimes a users IP will be blocked, and after being removed, the hostname will still remain blocked in iptables.

After trying to remove the block through CSF it's saying it doesnt exist:

Unblock 184.153.XXX.XX, trying permanent blocks...

csf:...

Hello

Just i make a fresh installation on dedicated server with centos7 and cpanel.
When reboot server look ofline i believe this happening After installation of csf.
Now i have access only from rescue mode.
In past i didnt had any problem with csf and cpanel (centos 6 + cpanel)

Steps to reproduce:

1.I make fresh installation again.
2.I try to set csf on test mode to disable it.
3.I search on...

hello
im try to open / block port by country with this settings

all country:
TCP_IN = 20,25,53,80,443,465,587,993,995,1167,49152:65534,2080,2443,49152:65534

only from IT
CC_ALLOW_PORTS = IT
CC_ALLOW_PORTS_TCP = 21,110,143,2077,2078,2082,2083,2086,2087,2095,2096

deny all CHINA
CC_DENY = CN

deny BR,VN,TH
CC_DENY_PORTS = BR,VN,TH
CC_DENY_PORTS_TCP = 993,995,465,587

seem all works great...

Hello,

I am having issues with CSF not loading iptables rules on CentOS 8 on reboot. I have to run csf -r to apply the rules after reboot. How can I fix this?

Thanks,

# iptables -n -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# Warning:...

Hi

csf.deny lists the IPs, and the protocol used for the IP blacklist. This is fine.
However, and when running shared servers, it would be really helpful if we could know what email address is being used when it gets blocked.

One of our clients has 30+ email accounts, and supposedly ONE user is constantly get blocked because of wrong SMTP credentials, this is what I see in the logs.

Is there a...