csf

Changes:

• Updated CloudFlare code to use GET instead of POST to retrieve the id of an entry as POST in the API is no longer working, which affected entry deletion
• Modified –denyrm [ip] to not remove “do not delete” entries. This now must be done by editing /etc/csf/csf.deny to prevent unintentional unblocking, e.g. by MESSENGER reCAPTCHA or the UI
• MESSENGERv2: Set KeepAlive to Off
• Added new csf CLI cluster option: -cir, –cirm ip
  This will remove the IP from each remote /etc/csf/csf.ignore member and then restart lfd. This has also been added to the UI
• Added missing comment to cluster –ctempdeny entries
• Added missing timestamp to cluster –cignore entries
• Cluster command –cignore now checks for duplicates

Changes:

• Added port 8443/tcp to cPanel server new installs to cater for the v80 calendar service. Existing installs will need to be modified manually if the service is used by adding the port to TCP_IN and TCP6_IN
• Updated various EOL version checks in Server Report
• Updated version modification system to check existing version before performing updates. Ensured that updates are applied chronologically

Changes:

• Added routine to select from multiple download servers for script updates
• Added Sectigo (formerly Comodo) IPv6 DCV addresses to cpanel.comodo.allow and cpanel.comodo.ignore
• Added support to LF_CXS for litespeed logs on cPanel
• Added exception to csf.fignore for NodeJS yarn temporary files in cPanel v80

Changes:

• Added new option CT_SUBNET_LIMIT. If the total number of connections from a class C subnet is greater than this value then the offending subnet is blocked according to the other CT_* settings. This option is disabled by default
• Removed ALTTOR from csf.blocklists on new installations as it has been discontinued
• Use ConfigServer::Slurp to read csf.resellers to avoid invalid line endings
• Modified CLUSTER_SENDTO and CLUSTER_RECVFROM so that they can be set to a file instead of listing IP’s within the respective setting. See csf.conf for more details
• Removed open_basedir check on cPanel servers in Server Check
• Fixed csf.conf typo
• Updates to Courier IMAP regexes for Plesk

Changes:

• Removed debugging code from lfd output
• Improvements for reason text information to IPs and CC_LOOKUPS to netblocks for LF_PERMBLOCK and LF_NETBLOCK reports

Changes:

• Added commented out regex lines in csf.pignore on cPanel servers for the upcoming ubic implementation by cPanel
• Added port 53 filters in cpanel.comodo.allow on cPanel servers
• Added postfix support for LF_DISTSMTP
• Switched Sendmail and URLGET modules from using croak to carp to avoid unexpected parent death from child failure
• Double fork external commands in DA UI to work around DA mod_perl restrictions, allowing full functionality
• Added reason text information to IPs and CC_LOOKUPS to netblocks for LF_PERMBLOCK and LF_NETBLOCK reports and csf.deny entries

Changes:

• Removed new regex for LF_EXIMSYNTAX

Changes:

• Removed rbl.jp RBLs from csf.rbls
• Modify Project Honey Pot blocklist URLs to use https
• Ignore $SIG{PIPE} when running ipset
• Ensure csf shows ipset warnings
• Added osmd to lfd restart routine when cPanel upgrades
• Modified Server Check to look for underscore as well as dash settings
• Added test in lfd to ensure the pidfile is open before attempting to close it
• Added new regex for LF_EXIMSYNTAX
• Added new option: URLPROXY. If you need csf/lfd to use a proxy, then you can set this option to the URL of the proxy

Changes:

• Make CC_IGNORE check case-insensitive
• Improved TCP/UDP port inspection for IPv6 connections (affecting CT_*, PT_* and PT_SSHDKILL)
• Updated cxs FontAwsome to v5
• Added fixes for additional Include line processing
• Fixed race condition when processing CC_* zip files that could sometimes prevent the csv files from being extracted
• Updated HTTP::Tiny to v0.070