General

New csf v6.26

Changes:

  • Fixed UI issue with some settings sent via the Cluster Config option
  • Modified CONNLIMIT_LOGGING rule insertion point
  • Added new feature: Outgoing UDP Flood Protection. This option limits outbound UDP packet floods. These typically originate from exploit scripts uploaded through vulnerable web scripts. The feature is controlled by: UDPFLOOD, UDPFLOOD_LIMIT, UDPFLOOD_BURST, UDPFLOOD_LOGGING, UDPFLOOD_ALLOWUSER
  • Update the TOR URL in existing /etc/csf/csf.blocklists file if still set to the old URL

New csf v6.25

Changes:

  • Fixed UI “Temporary IP entries > Flush all temporary IP entries”
  • Fixed UI_USER and UI_PASS being emptied on saving the firewall configuration through the UI
  • Fixed CLUSTER_KEY not displaying when RESTRICT_UI is disabled

 

New csf v6.24

Changes:

  • Security – Removed items from Cluster Config UI option if RESTRICT_UI enabled

 

New csf v6.23

Changes:

  • Security – added new option RESTRICT_UI. This options restricts the ability to modify settings within csf.conf from the csf UI. Should the parent control panel be compromised, these restricted options could be used to further compromise the server. This option is enabled by default on all installations
  • Added entries to csf.pignore on new installations on cPanel servers for Dovecot v2.2 (cPanel v11.40+)
  • Fixed UI Template validation error message

 

New cxs v3.04

Changes:

  • Security – Fixed file view from quarantine – reported by Rack911
  • Security – Further improved UI form data sanitisation
  • Bolstered the UI warning with regard to disabling Restricted Mode

 

New cxs v3.03

Changes:

  • Fixed broken UI items
  • Improvements to the ignore logic
  • Improved UI form data sanitisation
  • Exploit fingerprint definitions database additions

 

New cxs v3.02

Changes:

  • Security – Added UI Restricted Mode which is enabled by default. This disables features in the UI that could allow abritrary commands to be run as root and system files to be overwritten. To enable unrestricted access to the UI remove /etc/cxs/cxs.restricted
  • Added UI option to completely disable the UI by creating the file /etc/cxs/cxs.disableui

New cxs v3.01

Changes:

  • Implement slurp routine for configuration files to cater for incorrect linefeeds
  • Improvements to forced quarantine feature within –xtra [file] and updated instructions provided in cxs.xtra.example
  • Security – Quarantine improvements
  • Exploit fingerprint definitions database additions

New csf v6.22

Changes:

  • Security Fix – Sanitised user data input to prevent running unauthorised commands via the UI. A user would require root access to exploit this, so vulnerability is probably low. Thanks to Steven at Rack911.com for reporting this issue
  • Added Password ENV variable check to Server Check on cPanel servers
  • Update cPanel ACL Driver installations to change force cache update using “touch” instead of removing the cache
  • Modified TOR URL in /etc/csf/csf.blocklists to use:
    http://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1

 

New csf v6.21

Changes:

  • Modified auto-update logic to only create the /etc/cron.d/csf_update file if it does not already exist
  • Fix permissions on csf man file and directory
  • Modified webmin module paths to be relative rather than absolute so that webmin via mod_proxy works correctly
  • Fixed “in” direction –tempallow/–tempdeny leaking into [comment]
  • Added nginx regex for ModSecurity rule detection. Remember to set MODSEC_LOG correctly for the location of the nginx error log
  • Fixed file permission/ownership problem on DirectAdmin servers for the /plugins directory