ConfigServer Services Blog

New in this release:

• Added new feature to send an alert email if su is used to login from one account to another. Alerts are sent whether the
  

A few bugfixes:

• 1.76
  

Some new features and fixes:

• Added new option LF_CSF to restart csf if iptables appears to have been flushed (i.e. stopped)
• Added new option LF_SCRIPT_PERM to disable directories identified by LF_SCRIPT_ALERT – see csf.conf for more information
• Workaround to child reaper when 2 children die at the same time
• Added workaround for PT spamd false-positives

Updates and additions:

• Additions to csf.pignore
• Added new option PT_SKIP_HTTP – see csf.conf/readme.txt
• Updated readme.txt regarding unavoidable false-positives and possible mitigation

Major new feature in this release:

• Updated CLI help and readme.txt for new csf -u command from v1.63
• Changed the format of the email templates for new installations – if you want to use the new format remove /etc/csf/*.txt and then install csf
• Added mechanism to prevent multiple email/block attempts from login attacks in lfd
• Added new feature – Process Tracking. This option enables tracking of user and nobody processes and examines them for suspicious executables or open network ports. Its purpose is to identify potential exploit processes that are running on the server, even if they are obfuscated to appear as system services. If a suspicious process is found an alert email is sent with relevant information – readme.txt for details

A new release of csf+lfd with the following changes:

• Added feature to WHM UI to enable editing of the email templates
• Modified WHM UI to use fixed-width larger font for command output and edit boxes
• Added notice to install.txt and readme.txt about enabling klogd (on VPS systems in particular)
• Added autoupdates system using AUTO_UPDATES – see csf.conf for details

New release with:

• Added to APF/BFD removing in WHM UI the logrotate configuration files
• Added comments system to csf.allow and csf.deny – see readme.txt for more information

New release, new major feature:

• Tighten up some of the csf rules
• Added new fature – LF_SCRIPT_ALERT when enabled will scan /var/log/exim_mainlog for extended exim logging lines that show the cwd= line for paths in /home which indicate emails sent from scripts. If LF_SCRIPT_LIMIT emails from the same path are sent within an hour, an email alert is sent using scriptalert.txt containing the first 10 probably exim mainlog line matches and also likely mailing scripts within the identifed path – an ideal tool to help identify spamming scripts sending out email through exim. The option is disabled by default as you do need to enable extended exim logging first as