General

Changes:
– Added iptables UID logging for dropped outgoing packets
– New feature – DROP_OUT_LOGGING. Enables iptables logging of dropped outgoing connections. Where available, these logs will also include the UID connecting out which can help track abuse. Note: Only outgoing SYN packets for TCP connections are logged. The option is not enabled by default, but we recommend that it is enabled
– Option DROP_ONLYRES now only applies to incoming port connections
– New feature – User ID Tracking. This feature tracks UID blocks logged by iptables to syslog. If a UID generates a port block that is logged more than UID_LIMIT times within UID_INTERVAL seconds, an alert will be sent. Requires DROP_OUT_LOGGING to be enabled
– Modified Port Scan Tracking regexes to ensure only incoming connections are tracked
– Added Server Check for dhclient running
– Added Server Check on cPanel servers for antirelayd
– Added Server Check on for a swap file (don't bother on Virtuozo)
– Added Server Check for xinetd, qpidd, portreserve and rpcbind in Services Check since most people won't use them

Changes:
– Modified csf UI to detect Webmin install and symlink script and images directory so as to no longer require Webmin module update on a new csf version
– Tidied up csf UI html
– Fixed System Statistics graph display when using Webmin
– Modified Server Security check to only perform GENERIC test when using Webmin to prevent hanging processes
– Added CLI options –car, –carm. This removes an allowed IP in a Cluster and removes it from /etc/csf.allow
– Added new options LF_WEBMIN, LF_WEBMIN_PERM. This feature adds login failure detection for Webmin in WEBMIN_LOG
– Added new option LF_WEBMIN_EMAIL_ALERT. This feature sends an email if a successful login to Webmin is detected in WEBMIN_LOG
– Modified LF_SCRIPT_ALERT text in csf.conf for cPanel servers
– Modified proftpd regex to cope with non-standard format and to remove trailing colons from account name
– Modified LF_SCRIPT_ALERT regex to cater for paths containing spaces
– Improvements to LF_SCRIPT_ALERT memory usage and possible script detection
– Added alternative LF_SCRIPT_ALERT regex for specific 1H.com exim logging ACL