ConfigServer Community Forum

Hello. We have a small server and every weekend or holiday, we see a spike of server intrusion tries. They know that most, mainly small and medium-sized companies probably leave their servers unassisted during those days. By blocking China, we cut tentative intrusions by 60%. But, there are those from Netherlands, France, Germany and other. We want them blocked permanently. No more temporary...

Hi,

You all know what cPanel just announced lately regarding unsane price increases, and reactions are extremely bad :

According to me, and the first reactions of web host community, the preffered choice for another panel is actually DirectAdmin (DA) because it is reliable, founded in 2004, has evolved strongly, inclusive new UI.

Indeed, not only the price is a signal, but the...

I am trying to implement SYNPROXY for the http/https ports with csfpre.sh

iptables -t raw -I PREROUTING -p tcp -m tcp --syn --dport 80 -j CT --notrack
iptables -t raw -I PREROUTING -p tcp -m tcp --syn --dport 443 -j CT --notrack
iptables -t filter -I INPUT -p tcp -m tcp --dport 80 -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -I...

The latest version of configserver firewall.

This one is driving me a little bonkers. We are all aware of the increase in SSH attacks lately. We run SSH on a non-standard port pretty high up but we are still seeing a MASSIVE influx of distributed SSH blocks on ports not related to our SSH port which is defined in the csf.conf

Ex: invalid user firefart from 67.205.153.16 port 34980 ssh2

This is...

Hello

Currently csf/lfd doesn't detect attacks on wp-login.php

My Settings:

regex.custom.pm

if (($lgfile eq $config{CUSTOM2_LOG}) and ($line =~ /^\S+\s+\d+\s+\S+ \S+ postfix\/\S+\ : warning:.*\ : SASL *? authentication failed/)) {
return ( Failed SASL login from ,$1, mysaslmatch , 3 , 25 , 86400 );
}

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] POST \/wp-login\.php.*...

I have noticed a few instances where LFD triggers have resulted in duplicate entries being added to /etc/csf/csf.deny , one after another. It isn't happening with all IP addresses or all service triggers either; it is only happening with IP addresses that appear to be correlated originating from a specific public subnet; 85.209.0.0/24

Notice in my logs below, you'll see duplicate entries,...

Hello,

I'm already registered ID from MaxMind. But everytime I get these error from my log

CC: Retrieving MaxMind Country database
CC Error: GeoLite2-Country-Blocks-IPv4.csv empty or missing
CC: Retrieving MaxMind ASN database
CC Error: GeoLite2-ASN-Blocks-IPv4.csv empty or missing

Everytime I put these files manualy but not help.

Any idea for this problem ?

Regards,
Bulent

Did you get anywhere with this?

I'm seeing a similar issue where the license key is entered, but on some servers CSF cannot detect the country of IPs. It's configured in the same way you mentioned.

On the servers where it works there is a file:
-rw------- 1 root root 12649147 Dec 30 16:00 /var/lib/csf/Geo/GeoLite2-Country-Blocks-IPv4.csv

...which does not exist on servers where it does not...

Hello,

does OSM work on openvz node to track outgoing connections from containers and how can it be configured to monitor spammers on open vz vps nodes.

regards.

hello guys

I have a cpanel server that uses CSF, which blocks IP by noting the country of origin of said IP

by example : (show country of IP)

However, I have a problem with another server, where the IP Country is not shown

view example: (not show country)

How to solve this problem? I would like the country names to be shown as in the first image

Hello,

I'm experiencing a bug using CSF on cpanel CENTOS 7.7 v86.0.18 that is banning cloudflare ips.
I have enabled mod_cloudflare and it's working because I can see the real ip address of requests on Apache Status, but CSF is always banning cloudflare ip.
I also have enabled for the website that is getting flood and ddos attack cloudflare ban ip but I can't see that any ip address was added...

Configserver appears to by in the UK.

We have country code blocking in place using CSF (and have for 18 years...)

When we place in CC_DENY. PL,NL,FR,CN,RU,DE,AN,TR,HK,CH,FI,SE,DK,IE,SG,AU,BG,LV

Even though UK is not listed, updates fail and will never work again unless all removed. Is this a bug? Or are updates coming from a country other than UK?

Hello is it possible to block an IP at CSF level if that IP tries to access a url pattern like anydomain.com/includes/folder/restricted.php

thank you in advance

The UI status shows stopped even when

systemctl status csf show the service as Active

Hi,

Im banning a reasonably amount of IP's adding the blacklist URL's to lfd's blacklist function. for example:

BLOCKLIST_DE_ALL|86400|0|
showing the amount of rows it tells me at this moment it has 33147 rows (of which only 6 ipv6 adresses)

yet an ipset list command is telling me it only has 28650 entries.

this happens with some other lists also. What can i do to import all ip's?

Hi i have many DNS recursive query and i want to ban the IPs doing this, i activate in the firewall the LF_BIND but doesn't ban the IP.
What iam missing?

var/log/messages

Apr 14 12:31:43 server named : client @0x2fb4d40c2340 207.148.30.165#11081 (test.baidu.com): query (cache) 'test.baidu.com/A/IN' denied
Apr 14 12:31:43 server named : client @0x2fb4d40c2340 207.148.30.165#1517 (baidu.com):...

I have a server where CSF has been installed for over 3 years but has suddenly started acting up. I have also had Webmin installed on the server for the same length of time and both have worked together very nicely.

In the last couple of weeks I am having major problems with starting, stopping and restarting the firewall through Webmin and the Webmin dashboard says that the firewall is not...

Hi,

When i check csf (check server security), i get this ntice:
Check telnet port 23 is not in use

I have removed telnet by yum remove telnet and port 23 is in block list.

what should i do to find out why this notice has been appeared ?

by the way, I'm using centos 7 and directadmin and there are update.

I'm set up a SoftetherVPN server on Linux Server and create a local Tap Device, bound DHCP server on the device.
If I disable CSF, client users can get IP by DHCP normal. But when enable CSF, a client can't request an IP. So, how do I allow DHCP on CSF?

it turns out that on the PC of the physical firewall I have CSF installed to control all incoming traffic, and from there I route the ports to different applications located on other machines to the rest of the lan.

It turns out that the IPs of all the clients that connect to these applications on different ports and machines of the lan, all appear with our IP WAN and different connection...