General

New csf v3.01

Changes:

  • Tightened DNS port configuration restrictions as the old rules were being catered for by iptables connection
  • Added Kerio Mailserver POP3/IMAP regex’s

PHP v4 – R.I.P

A reminder that support for PHP v4 was dropped by the PHP developers at the end of last year. For security and stability (yeah, right) reasons, you should be moving over to PHP v5 exclusively ASAP:http://php.net/#2007-07-13-1

New csf v3.00

Changes:

  • Added progress information to LWP downloads within csf
  • Added numiptent checking for VPS servers. csf will flush iptables and lfd will stop blocking IP’s if numiptent is nearly depleted. This should help prevent VPS lockouts due to insufficient server resources. If this happens, you will either need to reduce the number of iptables rules (e.g. disable Block List usage) or have the VPS provider increase numiptent. A value of ~700-1000 should be fine for most SPI firewall applications with full Block List configuration
  • Added support for the BOGON List (Block List) with LF_BOGON – http://www.cymru.com/Bogons/ See link and csf.conf for more information
  • Enhanced the cpanel.net lookup for httpdupdate.cpanel.net to workaround the lack of rDNS PTR records
  • Fixed problem with RELAYHOSTS not working
  • Removed use of the replace binary

Mrtg error after OS vendor update

If you’re seeing the following error after your OS updates mrtg if we’ve installed mrtg graphs for you:

ERROR: I Quit! Another copy of mrtg seems to be running. Check /etc/mrtg/mrtg.pid Daemonizing MRTG …

Simply do the following:

rm -fv /etc/cron.d/mrtg/etc/init.d/mrtg restart

You can ignore any subsequent mrtg errors referring to ETH1.

New csf v2.95

Changes:

  • Reduced memory overhead and added large file skipping for LF_DIRWATCH
  • Improved performance of LF_DRIWATCH trigger checks
  • Fixed problem with LF_SELECT temporarily blocking outbound access on all ports. Now now only the relevant inbound only port(s) will be blocked if triggered

New csf v2.94

Changes:

  • Fixed linux line-endings in some configuration files from v2.93 – doesn’t affect existing installations

New csf v2.93

Changes:

  • Improved mod_security v2 regex for filter triggers
  • Added MySQL v5 check

MailTools v2.* breaks MailScanner

On servers that are running the perl modules that are a part of MailTools, MailScanner breaks with the recently released v2.*. The errors you will see when starting MailScanner look like this:

Variable “$FIELD_NAME” is not imported at /usr/mailscanner/lib/MailScanner/Message.pm line 6907.Variable “$FIELD_NAME” is not imported at /usr/mailscanner/lib/MailScanner/Message.pm line 6910.Global symbol “$FIELD_NAME” requires explicit package name at /usr/mailscanner/lib/MailScanner/Message.pm line 6907.Global symbol “$FIELD_NAME” requires explicit package name at /usr/mailscanner/lib/MailScanner/Message.pm line 6910.Compilation failed in require at /usr/mailscanner/bin/MailScanner line 79.BEGIN failed–compilation aborted at /usr/mailscanner/bin/MailScanner line 79.

You can determine the module version using:

perl -MMail::Header -e ‘print “$Mail::Header::VERSION\n”‘

To fix this you need to downgrade MailTools to v1.77:

wget http://search.cpan.org/CPAN/authors/id/M/MA/MARKOV/MailTools-1.77.tar.gztar -xzf MailTools-1.77.tar.gzcd MailTools-1.77perl Makefile.PL makemake installcd ..rm -Rfv MailTools-1.77*

New csf v2.92

Changes:

  • Improved the cPanel version check for < v11 and whether up to date
  • Added new CLI option -t (–temp) which lists the temporary IP bans and the TTL before the IP is flushed from iptables
  • Added “View Temporary IP Bans” to WHM UI
  • Changed WHM UI lfd Log auto-refresh default to unchecked
  • Added regex for dovecot “Aborted login” messages in /var/log/maillog
  • Added support for displaying mod_security v2 logs in WHM UI

New csf v2.91

Changes:

  • Added Fedora Core v6 to the obsolete OS check
  • Added php v4 check
  • Added apache v2.2 check
  • Added Perl v5.8.8 check
  • Added cPanel v11 check
  • Modified Sys::Syslog use to utilise the ndelay and nofatal options
  • Added new option GLOBAL_IGNORE which makes lfd ignore IP’s listed in a globally located ignore file
  • Modified Connection Tracking so that lfd doesn’t block IP addresses that resolve to *.cpanel.net (to prevent CT_LIMIT being triggered during a upcp upgrade of cPanel)
  • Added new option CT_STATES to Connection Tracking so that you can specify which connection states you want to count towards CT_LIMIT, e.g. SYN_RECV