ChangeLog:
15.10 - feat(conf): preserve custom user comments in config files across
        CSF updates

        feat(cyberpanel): footer theme toggle now syncs CyberPanel and CSF
        WebUI themes

        feat(webui): add new **RBLCheck** interface with `info` and `warning`
        message types during tests

        feat(cpanel): implement new header layout

        build(deps): remove external Perl dependency `URI::Escape`

        refactor(core): consolidate codename detection into a single Perl
        subroutine

        refactor(webui): use lookup table for **RBLCheck** processing

        fix(cpanel): correct alternating table row colors in dark theme

        fix(webui): hide **Cloudflare Integration** button when 
        CF_ENABLE = "0"

        fix(webui): hide **Statistics** buttons when `GD::Graph` dependency
        is missing

        fix(webui): fix **Sponsor** container class causing excessive padding

        fix(webui): fix main navigation text alignment in Chromium / Edge
        browsers

        fix(webui): remove unsafe `innerHTML` usage to prevent potential XSS

        fix(webui): strip ANSI SGR sequences from exec command output

        fix(webui): enforce monospace font in config editor inputs

        fix(cpanel): add Ace Editor support for light and dark themes

        fix(core): properly escape and encode form input values

        fix(messenger): prevent reCAPTCHA response truncation by increasing
        HTTP limit to `4096`

15.09 - URLs in /etc/csf/csf.conf are now clickable in the Firewall
        Configuration web interface.

        Correctly detect interactive --version input in the CLI.

        Sponsor icon updates:
            - Added new setting in /etc/csf/csf.conf "SPONSOR_HIDE_ICON" to
              hide icons in the web interface footer.
            - Sponsor icon automatically hides if the user enters a sponsor
              license.
            - Removed the beating animation for the sponsor icon.

        Automatically install Webmin module without requiring the user to
            /usr/local/csf/csfwebmin.tgz.

        Added csf.conf optional setting to show Firewall Configuration button in
        Webmin next to other buttons:
            - UI_WEBMIN_SHOW_BUTTON_CONFIG = "1"

        Added AbuseIPDB service template to the blocklist file:
            /etc/csf/csf.blocklists.

        Updated DirectAdmin plugin.conf:
            - Added update_url and version_url so DirectAdmin can fetch the
              latest version.

        Rebranded CentOS Web Panel to Control Web Panel to reflect the correct
        app name.

        Added AbuseIPDB template to /etc/csf/csf.blocklists for improved
        integration.

        Rewrote Docker integration script in "extras/docker.sh":
            - Added caching for docker container list generation.
            - POSIX compliant.
            - Added optional flags such as --help, --dryrun, etc.

        Rewrote OpenVPN integration script in "extras/openvpn.sh":
            - POSIX compliant.
            - Added optional flags such as --help, --dryrun, etc.

        Corrected an install script error in install.directadmin:
            - Fixed an improperly closed "if" condition.

        Descriptions for Webmin settings now render correctly with proper
        structure.

        Segregated formatted --version output in Control Web Panel to remove
        ANSI colors.

        Ensured proper sanitization when sending version information to Control
        Web Panel.

        Added support for AlmaLinux, RedHat, and Rocky 10 based distributions:
            - Debian, Ubuntu, ZorinOS: /usr/share/webmin
            - RedHat, AlmaLinux, Rocky 10: /usr/libexec/webmin

        Added DirectAdmin installation instructions to the Install chapter in
        the documentation.

        Added AbuseIPDB integration instructions to the documentation.

15.08 - Refactor Perl module csget for improved maintainability.

        Add CLI commands to manage ports:
            --addport, -ap
            --removeport, -rp
            --listports, -lp

        Improve installation script output for better clarity.

        Add logic to handle immutable flag +i on Control Web Panel installs;
        restores flag after installation.

        Automatically install Webmin module
            /usr/local/csf/csfwebmin.tgz.

        Optimize blocklist generation scripts in the CSF GitHub repository.

        Rename Control Web Panel navigation label:
            ConfigServer Scripts to ConfigServer Firewall.

        Update JSON response structure for license and Insiders service
        endpoints.

        Refactor protect.sh and all install.*.sh bash scripts to be fully
        POSIX compliant.

        Add warning if LF_MODSEC_PERM is set below 3600 seconds (1 hour).

        Add comment in csf.conf specifying input value type for LF_MODSEC_PERM.

        Update configuration description for LF_MODSEC.

        Add longdesc property to module.info in CSF Webmin module.

        Update csf.blocklists with revised URLs to blocklist services.

        Fix Control Web Panel menu link csfofficial returning a blank page.

        Suppress update notifications when the latest version is installed
        without a terminal present.

        Remove duplicate entries from highrisk.ipset static blocklist.

        Add ShellCheck directive to extras/scripts/protect.sh in GitHub
        repository.

        Fix csget assigning incorrect user:group to files, resolving SELinux
        security errors.

15.07 - Add new tab "Resources" to tab interface.

        Add Privacy Policy to CSF.

        Add Discord server
        https://discord.configserver.dev

        Add "Insiders" releases.

        Remove spamhaus edrop list, merged with drop.

        Refactor cyberpanel installation script to ensure
        POSIX compliant.

        Refactor update functionality to support both numerical
        and tagged releases.

        Fix cyberpanel integration error:
        "address form post error Data supplied is not accepted"

        Fix dark-reader causing login page to not render 
        properly.

        Fix whitespace in ipset blocklist definitions causing
        entire blocklist to not load.

15.06 - Fixed backwards compatibility issue related to older
        versions of Webmin control panel. Specifically v2.111
        and Authentic theme v21.10. Webmin detected as "Generic"
        installation; header icon missing; generic footer 
        loaded.

15.05 - Fixed HTML escaping in the Firewall Configuration 
        page to ensure settings are processed safely and
        correctly.

        Refactor "csf.sh" init.d script; POSIX compliant.

15.04 - Fixed log output textbox height for Webmin control panel

        Added new csf.conf setting UI_LOGS_REFRESH_TIME
            Determines how often logs are refreshed

        Added new csf.conf setting UI_LOGS_START_PAUSED
            Determines if automatic log refresh starts in the
            running or paused state.

15.03 - Fixed missing header buttons Module Config and Help
        in the Webmin header

        Rewrote the JavaScript library csfajaxtail.js for 
        improved optimization and maintainability

        Reduced the minimum font size allowed for FontMinus 
        and FontPlus from 12px to 10px

        Release blogs now support comments integrated from Github

15.02 - New login page for Generic installations
        New csf.conf setting:
            UI_RETRY_SHOW_REMAINING

        New footer design for improved consistency and navigation

        Integrate csfpre.sh and csfpost.sh for native pre/post script support

        Added new "HEADER:" flag to config files

        Added help page to the download service

        Added Light/Dark mode toggle in the footer

        Added optional Content Security Policy (CSP) protection to web interface
            New csf.conf settings:
                UI_CSP_ENABLED
                UI_CSP_ADVANCED_ENABLED
                UI_CSP_ADVANCED_RULE

        Modified config file comments for clarity; more descriptive, organized,
        and include practical examples

        Modified "ports-blacklist"; now POSIX compliant

        Overhaul base `install.sh` script

        Update CSF SSL certificate and key

        Added CSS optimization to pre-load required stylesheets

        Fixed missing VestaCP header on the "/list/csf" admin page

        Fixed CyberPanel integration

        Fixed regex pattern issues when dealing with strict conditions

15.01 - First version released by Aetherinox
        https://github.com/Aetherinox/csf-firewall

        Registered new domain https://configserver.dev

        Added new blocklist service at https://blocklist.configserver.dev

        Bring new update server online at https://download.configserver.dev

        Changed csf update server code to point to new csf domain

        Fixed bug with invalid sessions still being able to access backend web
        interface assets

15.00 - Final version released by Jonathan Michaelson / configserver.com

        Download and update servers taken offline

        Disabled automatic updates within csf

        Added country code validation and warning output

        Updated regex to extract client ip from logs

        Changed license to GPLv3

14.24 - Fixed regression bug in v14.23 "Modified UI HTTP header checks to be
        case agnostic"

14.23 - Modified Apache regexes to detect "remote" or "client" as the IP
        trigger

        Mdified UI HTTP header checks to be case agnostic

        Sanitise CC list strings

14.22 - Removed session IP match check from DA login

        Added example spamassassin temp file regex to csf.fignore for
        new installations

14.21 - Modified IP lookup to strip some missed quotes

        Added exe:/usr/bin/dbus-broker-launch and exe:/usr/bin/dbus-broker to
        csf.pignore for new installations

        Added check to ensure that only PUBLIC IP addresses are used when
        loading IPv4 CC zone files

        Fixed issue when converting embedded IPv4 addresses in IPv6 connections

14.20 - Modified MaxMind URLs to use https

        Fixed DOCTYPE print order for integrated UI login

        Added "Require all granted" to Messenger v3 .htaccess generation

        Normalise source IP during connection tracking for IPv6 comparisons

        Fixed regression for some IMAP logon failure detections

14.19 - Switch to using iptables-nft if it exists in /usr/sbin/iptables-nft

        Added IO::Handle::clearerr() call before reading data from a log file

        Added "Require all granted" to the MESSENGER .htaccess file

        Added UID/GID rules to IPv6 if enabled

        Modified dovecot regex to look for "failed: Connection reset by peer"

14.18 - Added port 853 for DoT to all new installs

        Added exe wpt-panopticon on cPanel servers to csf.pignore

        Updated list of EOL PHP versions

        Modified HTACCESS regex to include "remote" as well as "client" log
        lines

        Implemented DA POST workaround for saving large text files via the UI

        Modified MESSENGER to only send unblock email if a valid IP is
        requested

        Modified DA server check to look for multiple php versions in
        /usr/local/php*

14.17 - Removed Security Report recommendations that do not apply to
        unsupported control panels

        Updated Security Report to show PHP v7.3 is EOL

        Confirmed support for RHEL v9

14.16 - Removed some spurious debug code

        Modified alert templates for: 
            LF_WEBMIN_EMAIL_ALERT
            LF_CPANEL_ALERT
            LF_SUDO_EMAIL_ALERT
            LF_SU_EMAIL_ALERT
            LF_SSH_EMAIL_ALERT
        These have been changed to include the log line that triggered the
        alert to help give context to the alert and the date/time from the
        log to identify when the event occurred. All the relevant templates
        are modified to include the log line for existing and new installs

        Implemented an addition check for webmin that we're in the csf module
        before creating symlink to the UI script

        Fixed parameter checking for some dovecot regexes

        If DEBUG is enabled and the sendmail binary fails to send an lfd alert,
        the email text will now be logged to /var/log/lfd.log with an error

14.15 - Fixed regression issue with logfile regexes

        Implemented an improved email wrapper

14.14 - Fixed issue with using Text::Wrap

14.13 - Added inline pid match to all system regexes to cater for logging
        changes

        Use Text::Wrap to ensure email line lengths are within specifications

        Updated dovecot log regexes to support the changed format in v2.3.15+

14.12 - Added cPanel SaaS servers to cpanel.allow

        Added a fix for RHEL v8 processes that were reporting excessive null or
        whitespace characters at the end of /prod/[pid]/cmdline. This is turn
        meant that such processes (e.g. spamd on cPanel servers) subverted some
        entries in csf.pignore

        Updated systemd entries in csf.logignore for RHEL v8+

        Updated dovecot log regexes to support the changed format in v2.3.15+

        Modify LookUpIP to hopefully account for data inconsistencies from
        Maxmind

14.11 - Added entries in csf.pignore for new cPanel installations:
            exe:/usr/sbin/mariadbd
            exe:/usr/sbin/atd
            exe:/usr/lib/systemd/systemd-timesyncd
            exe:/usr/lib/systemd/systemd-networkd
            exe:/usr/sbin/rsyslogd

        Updated configuration files to support cPanel on Ubuntu

        In Server Check don't check for Fork Bomb protection on cPanel servers
        running CloudLinux

14.10 - Fixed error message regarding location/permissions to the iptables
        binary in correctly referencing ip6tables

        Added PASV port range hole for VZ servers on cPanel for new installs

        Fixed MESSENGERV3 Apache tree search where ServerRoot is not configured
        so that csf defaults to /etc/apache2/ so that relative Includes are
        still defined correctly

        Modified LF_BIND regex to deal with new log field

14.09 - Improvements to CC IP lookup binary search

        Modified index.recaptcha.php and index.php to use square instead of
        deprecated curly brackets on array index for PHP v7.4+

        Modified Server Check regex matching on include in dovecot config files
        in RHEL v8+

        Added workaround for iOS issue with bootstrap modals

        Added EOL messages to Server Check report

        Modified dovecot.conf parsing on cPanel for include_try in Server Check

        Modified Apache 404 regex to check for either "info" or "error"

        Added two new CLI options: --temprma [ip], --temprmd [ip]. This allows
        distinction between allow and deny that does not exist for
            --temprm [ip]

        Updated UI to offer either --temprma [ip] or --temprmd [ip] instead of
            --temprm [ip]

        Added PHP v7.2 EOL notice to Server Report

14.08 - Added missing images/ subdir to webmin and interworx installers

        Added new option LF_TEMP_EMAIL_ALERT. This allows the disabling of temp
        IP block emails. It is enabled by default (send temp email alerts as
        before)

14.07 - Added missing images/ subdir to DA installer

14.06 - If DOCKER is enabled and the iptables nat table exists, csf now creates
        a DOCKER chain in the nat table for IPv4

        cPanel additions to csf.pignore on new and existing installs

        Disable reputation service on error

        Added new options MESSENGERV3PERMS and MESSENGERV3GROUP for the
        creation of the MESSENGER_USER public_html directory. See csf.conf for
        information, defaults set for each install control panel type where
        possible

        Added exe:/sbin/rngd to csf.pignore for new installations

14.05 - Modified dovecot pop3d/imapd log line parsing to repeat single lines
        reporting multiple login failure attempts

        Additional entries in csf.pignore for new installs on CyberPanel v2

        cPanel additions to csf.pignore on new and existing installs

        Convert embedded IPv4 addresses in /proc/net/tcp6 back to IPv4

14.04 - Added two new options: CC_MESSENGER_ALLOW, CC_MESSENGER_DENY. These
        options can control which Country Code IP blocks are redirected to the
        MESSENGER service, if it is enabled

        Fixed some typos in csf.conf

        Added DirectAdmin diagnostics to the admin UI for session security
        checks, together with a method to skip the checks if desired

14.03 - Updated DSHIELD blocklist to use https
        
        Updated Server Check PHP EOL information

        Improved DA session checking

        Improved DA Server Check report

        Modified cpanel.comodo.allow and cpanel.comodo.ignore with an
        additional IP address

        MESSENGERv3 now out of BETA testing

        Added UDP ports 80 and 443 to UDP_IN/UDP6_IN for new installations to
        support QUIC/HTTP3

        Modified DA regex for Roundcube v1.4+

        Modified DIRECTADMIN_LOG_R to point to
        /var/www/html/roundcube/logs/errors.log for Roundcube v1.4+ by default
        on new installs and change for old installs if not already set

        Added a new DA regex for phpMyAdmin

        Modified iframe resizer on DA, thank you to Martynas @ DirectAdmin

        Updated Integrated User Interface documentation to point to the latest
        Apache docs

        Added newly generated self-signed keys for lfd UI

        Updated Server Report descriptions for cPanel

        Updated Server Report for systemd processes

        Added back cPanel update check to the Server Report now that it has
        been reinstated by cPanel

        Removed outdated Server Report checks

14.02 - Added new BETA TESTING option: MESSENGERV3. This provides the MESSENGER
        service utilising the local webserver. It currently supports Apache
        v2.4+ and Litespeed/Openlitespeed. As the first iteration this likely
        contains bugs and may not be suitable for production environments. See
        csf.conf and readme.txt for more information

        Changed Country Code Lookup source to ipdeny.com

        Added CC_ALLOW_SMTPAUTH to all configurations for the benefit of
        servers other than cPanel running Exim

        Modify CC_ALLOW_FILTER to allow RELATED, ESTABLISHED connections
        through so that outgoing connection replies from remote sites not in
        CC_ALLOW_FILTER are accepted

        Added a note in csf.conf regarding MESSENGER_CHILDREN, that
        consideration needs to be made for local images displayed on the page.
        The default has also been increased to 20 for new installations

        Modifications to MESSENGER server to speed up connection response time
        and improve stability

        Modifications to LFD UI and CLUSTER server to improve stability

        Added SUDO login alerts: LF_SUDO_EMAIL_ALERT. This will send an email
        alert using the sudoalert.txt template whenever there is a failed or
        successful SUDO connection. SUDO_LOG must be set to the correct log
        file. LF_SUDO_EMAIL_ALERT is disabled by default

        Added new entry in csf.pignore on cPanel servers for v86+:
        exe:/usr/libexec/dovecot/imap-hibernate

        Added Server Check for EOL PHP v7.1

        Removed cPanel update checks from the Server Report now that the
        options are no longer available in cPanel v86+

        NOTICE: We are deprecating support for Virtuozzo/OpenVZ servers. Future
        releases will not take into consideration those platforms which have
        become onerous to support. The software application may continue to
        work but support and functionality is no longer guaranteed

14.01 - Changed mailman listings in csf.pignore on cPanel servers to cater for
        changes in python versions in RHEL v6/7 and 8

        Fixed issue with CC_ALLOW_FILTER when not using IPSET but using
        SAFECHAINUPDATE would cause the new chain to be created in the wrong
        place by lfd when the zone is retrieved/updated

        Fixed issue when using CC_ALLOW_FILTER with IPSET enabled not adding
        the final DROP rule in lfd

        Further modifications to support RHEL/CentOS v8

        Fixed issues with MESSENGER and CLUSTER server listeners terminating
        prematurely

14.00 - Added alternative database for Country Code Lists and Settings. These
        do not currently require logins/keys and in some cases are better
        optimised. A new setting CC_SRC allows switching between sources. For
        new installations these new sources are used. Existing installations
        are configured to continue to use the MaxMind databases. See the
        "Country Code Lists and Settings" section in /etc/csf/csf.conf for
        detailed information

        Added binary locations for CURL and WGET which will be tried if data
        retrieval fails when using the LWP perl module, e.g. on outdated OS's

        Added new option for URLGET setting "3". This allow the use of either
        CURL or WGET instead of the perl modules

13.12 - Modified CyberPanel installation to support move to python3

13.11 - Fixed interdependence issue between Country Code lookups and Country
        Code filters in lfd introduced in v13.09

    Improved MM_LICENSE_KEY error messages

13.10 - Removed hard-coded date from MaxMind ASN url

13.09 - Due to MaxMind changing their free download policy to require signup
        and a license key, a new option MUST be configured to continue to use
        Country Code lookups (CC_LOOKUPS). The option MM_LICENSE_KEY must be
        set to the key obtained from the MaxMind site. See:
        https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/
        https://www.maxmind.com/en/geolite2/signup
        Note: Existing installations will continue to use downloaded d/b's from
        before the MaxMind change, though may be cleared after CC_INTERVAL

        Changed CC_LOOKUPS option 4 from freegeoip.net to db-ip.com as the
        former no longer exists

        Fixed System Stats graphs not displaying on CyberPanel

        Updated csf control panel reporting in version display

13.08 - Added official CyberPanel integration and CyberPanel panel specific
        configuration (only tested on CentOS v7)

        More changes to support RHEL/CentOS v8

13.07 - Added format requirements for ASN entries in CC_* settings

        Removed SSHDSPAM exploit check as it's no longer critically relevant

        Modifications to support RHEL/CentOS v8

        Modified systemd service to cater for RHEL/CentOS v7.7 pidfile symlink
        check changes

        Fixes and improvements to UI Ajax code

        Removed legacy bandmin code for cPanel servers and LF_CPANEL_BANDMIN
        setting

        Modified default InterWorx csf.conf to set SMTP_ALLOWGROUP
        appropriately for SMTP_BLOCK

13.06 - Removed debugging code from log file globbing routine

        Fixed reseller UI HTML text for each supported control panel

        Replaced the need in InterWorx for a custom Firewall.php with a
        preAction to intercept calls instead

        Moved csf in InterWorx to the Advanced section in Plugins UI

        Updated the InterWorx plugin.ini information to be more descriptive

13.05 - Added official CentOS Web Panel (CWP) integration and CWP panel
        specific configuration. See /etc/csf/readme.txt for more information
        (only tested on CentOS v7)

        Added official VestaCP integration and VestaCP specific configuration
        (only tested on CentOS v7)

        Additional entries to csf.pignore for new DirectAdmin installations

        Corrected DirectAdmin UI link text

        Fixed UI presentation HTML

        Fixed vsftpd regex for single character date of the month

        Modified Debian installation to detect ip(6)tables-legacy and use
        update-alternatives to switch to using them

        Modified InterWorx installation to not use chattr on /etc/apf/apf stub
        which was preventing apf upgrading. The lfd daemon will now reapply
        the stub if needed

        Modified Server Check on DA to get case-insensitive config from the
        binary rather than the directadmin.conf file

        Modified csf warning text on cPanel DNSONLY servers regarding the
        smtpgidonlytweak to disable it from CLI as it is not currently possible
        from the DNSONLY WHM UI

13.04 - Fixed issue with ConfigServer::CheckIP generating incorrect IPv6
        addresses during validation using Net::CIDR::Lite

        Added UI entry for editing csf.reseller for DirectAdmin and InterWorx

13.03 - Fixed PATH issue in DirectAdmin installer when used from within the UI
        to upgrade

13.02 - Removed perl CGI::Carp module use from the DirectAdmin reseller UI as
        the module may not be present

13.01 - Added reseller support in InterWorx

        Added reseller support in DirectAdmin

        Added login failure detection on InterWorx (v6.3.16+). If LF_INTERWORX
        is enabled, INTERWORX_LOG will be scanned for login failures to
        NodeWorx and SiteWorx. This is enabled by default on all InterWorx
        installations

        Fixed text in Firewall.php stub in InterWorx

        Improved UI display in DA

        Improved UI display in InterWorx

        Fixed InterWorx UI issue with "Service Status" NodeWorx feature caused
        by Firewall.php stub

        Created cronjob to check for new product versions for the UI
        (/etc/cron.daily/csget). A manual check is still available if needed.
        This does not affect the daily upgrade check if enabled

13.00 - Added InterWorx integration and InterWorx panel specific configuration.
        See /etc/csf/readme.txt for more information (only tested on CentOS v7)

        Added InterWorx regex detection for proftpd, dovecot imap, dovecot pop3,
        and smtp auth login failures. Added regex detection for LF_DISTSMTP and
        LF_DISTFTP. Added regex detection for LF_CXS and LF_MODSEC. Added Login
        Tracking for LT_POP3D and LT_IMAPD

        Ensure UI errors are displayed in browser to avoid blank pages

        Display install.txt if perl module checks fail

        Reworked DirectAdmin UI to display within the parent template

12.12 - Updated CloudFlare code to use GET instead of POST to retrieve the id
        of an entry as POST in the API is no longer working, which affected
        entry deletion

        Modified --denyrm [ip] to not remove "do not delete" entries. This now
        must be done by editing /etc/csf/csf.deny to prevent unintentional
        unblocking, e.g. by MESSENGER reCAPTCHA or the UI

        MESSENGERv2: Set KeepAlive to Off

        Added new csf CLI cluster option: -cir, --cirm ip
        This will remove the IP from each remote /etc/csf/csf.ignore member and
        then restart lfd. This has also been added to the UI

        Added missing comment to cluster --ctempdeny entries

        Added missing timestamp to cluster --cignore entries

        Cluster command --cignore now checks for duplicates

12.11 - Added port 8443/tcp to cPanel server new installs to cater for the v80
        calendar service. Existing installs will need to be modified manually
        if the service is used by adding the port to TCP_IN and TCP6_IN

        Updated various EOL version checks in Server Report

        Updated version modification system to check existing version before
        performing updates. Ensured that updates are applied chronologically

12.10 - Added routine to select from multiple download servers for script
        updates

        Added Sectigo (formerly Comodo) IPv6 DCV addresses to
        cpanel.comodo.allow and cpanel.comodo.ignore

        Added support to LF_CXS for litespeed logs on cPanel

        Added exception to csf.fignore for NodeJS yarn temporary files in
        cPanel v80

12.09 - Added new option CT_SUBNET_LIMIT. If the total number of connections
        from a class C subnet is greater than this value then the offending
        subnet is blocked according to the other CT_* settings. This option is
        disabled by default

        Removed ALTTOR from csf.blocklists on new installations as it has been
        discontinued

        Use ConfigServer::Slurp to read csf.resellers to avoid invalid line
        endings

        Modified CLUSTER_SENDTO and CLUSTER_RECVFROM so that they can be set to
        a file instead of listing IP's within the respective setting. See
        csf.conf for more details

        Removed open_basedir check on cPanel servers in Server Check

        Fixed csf.conf typo

        Updates to Courier IMAP regexes for Plesk

12.08 - Removed debugging code from lfd output

        Improvements for reason text information to IPs and CC_LOOKUPS to
        netblocks for LF_PERMBLOCK and LF_NETBLOCK reports

12.07 - Added commented out regex lines in csf.pignore on cPanel servers for
        the upcoming ubic implementation by cPanel

        Added port 53 filters in cpanel.comodo.allow on cPanel servers

        Added postfix support for LF_DISTSMTP

        Switched Sendmail and URLGET modules from using croak to carp to avoid
        unexpected parent death from child failure

        Double fork external commands in DA UI to work around DA mod_perl
        restrictions, allowing full functionality

        Added reason text information to IPs and CC_LOOKUPS to netblocks for
        LF_PERMBLOCK and LF_NETBLOCK reports and csf.deny entries

12.06 - Removed new regex for LF_EXIMSYNTAX

12.05 - Removed rbl.jp RBLs from csf.rbls

        Modify Project Honey Pot blocklist URLs to use https

        Ignore $SIG{PIPE} when running ipset

        Ensure csf shows ipset warnings

        Added osmd to lfd restart routine when cPanel upgrades

        Modified Server Check to look for underscore as well as dash settings

        Added test in lfd to ensure the pidfile is open before attempting to
        close it

        Added new regex for LF_EXIMSYNTAX

        Added new option: URLPROXY. If you need csf/lfd to use a proxy, then
        you can set this option to the URL of the proxy

12.04 - Updated license terms for GDPR compliance

12.03 - Make CC_IGNORE check case-insensitive

        Improved TCP/UDP port inspection for IPv6 connections (affecting CT_*,
        PT_* and PT_SSHDKILL)

        Updated cxs FontAwsome to v5

        Added fixes for additional Include line processing

        Fixed race condition when processing CC_* zip files that could
        sometimes prevent the csv files from being extracted

        Updated HTTP::Tiny to v0.070

12.02 - Removed CC_OLDGEOLITE and associated code so that all installations
        will now use the MaxMind GeoLite2 databases

        Added more CLI options that work if csf is disabled

        Added Include line support to 20 more /etc/csf/csf.* configuration
        files. See /etc/csf/readme.txt under "Include statement in
        configuration files" for the list of supported files

        Added mangle and raw tables to csf --grep [IP] and modified output to
        show a new column with the table then the chain that a rule is in

        Added mangle and raw tables to csf --status output and modified output
        to show a new header line with the table that a rule is in

        Added new option USE_FTPHELPER. This enables the ftp helper via the
        iptables CT target on supporting kernels instead of the current method
        via /proc/sys/net/netfilter/nf_conntrack_helper and unrestricted use of
        RELATED state

        Modified ICMP_IN/ICMP_OUT to only affect PING (echo-request), all other
        ICMP traffic is allowed (which can help network performance) unless
        otherwise blocked. This is for IPv4, it does not affect IPv6

        Improved rule placement to prevent existing connections bypassing
        ICMP_IN_RATE/ICMP_OUT_RATE limits

        Updated csf.conf documentation relating to the ICMP/PING settings

        Added new option ICMP_TIMESTAMPDROP. For those with PCI Compliance
        tools that state that ICMP timestamps should be dropped, you can enable
        this option. Otherwise, there appears to be little evidence that it has
        anything to do with a security risk but can impact network performance,
        so should be left disabled by everyone else

        csf and lfd now exit with status 1 on error or if disabled. However,
        this will not happen with csf if the CLI option used still works while
        disabled

        USE_CONNTRACK is now enabled by default on new installations

        Fixed DOCKER IPv6 warning message when DOCKER not enabled

        Modified csf.blocklists for GREENSNOW to use https on existing and new
        installations

12.01 - Added missing DOCKER_DEVICE setting from the generic and directadmin
        csf.conf files

        Ensure iptables/ip6tables mangle and raw tables are flushed on
        stop/start if they exist

        CC_OLDGEOLITE set to "0" on new servers and those upgrading to v12.*
        for the first time. This enables MaxMind GeoLite2 by default unless
        already set

        Note: The old MaxMind Geolite v1 database code will be removed in the
        near future, before the end of March, in favour of the v2 databases

12.00 - Added support for GeoLite2 databases from Maxmind for CC_*. These
        databases are significantly larger than the soon to be deprecated 
        GeoLite ones stored in /var/lib/csf/

        Added support for GeoLite2 databases from Maxmind for CC_LOOKUPS and
        CC6_LOOKUPS.

        Added new option: CC_OLDGEOLITE. This option is enabled by default to
        continue using the old GeoLite databases. See csf.conf for more
        information. This option will be removed in the near future so that all
        installations use the new GeoLite2 databases
        
        GeoLite2 lookups now use the CSV files instead of the formatted Data
        files because the Perl dependencies for the MaxMind Perl modules that
        access the Data files are prohibitively excessive. We have developed
        our own fast binary search module to perform the required lookups on
        the CSV files for both IPv4 and IPv6

        An advantage of the new GeoLite2 databases is that IPv6 lookups can now
        be done to the same level as IPv4: Country Code; Country; Region; City;
        ASN

        Unified storage of GeoLite2 database to avoid duplication between 
        CC_LOOKUPS and CC_* databases

        Added new CC_LOOKUPS value of "4". This option does not use the MaxMind
        databases directly for lookups. Instead it uses a URL-based lookup from
        a third-party provider at https://freegeoip.net and so avoids having to
        download and process the large databases. See csf.conf for more
        information and limitations

        Modified CC_INTERVAL default to 14 days on new installations

        Ensure MESSENGERV2 service will not start if using a valid cPanel
        account in MESSENGER_USER (must be non-cPanel account)

        Create entry in /etc/aliases for "csf" if MESSENGERV2 is enabled on
        cPanel servers to reserve the account name

        Added new feature: DOCKER support. This configures iptables rules to
        allow Docker containers to communicate through the host. This is
        currently in BETA testing. See csf.conf for more information. Thanks to
        Marcele for the rules

        Removed redundant nat table check for ip6tables in Config.pm

        Replaced all remaining bareword file handles

11.07 - Added missing WAITLOCK to iptables when processing advanced port
        filters in csf and lfd and checking csf status in UI

        Added WAITLOCK, if enabled, to iptables-restore commands during
        FASTSTART

        Server Check Report - removed ini_set check as so many scripts use
        ini_set nowadays. Updated text on various checks

        Updated the postfix SMTP AUTH regex

        Added new SSHD "maximum authentication attempts exceeded" regex

        Set basic PATH before running csfpre.sh/csfpost.sh to avoid binary
        location issues

        csf now runs csfpre.sh/csfpost.sh directly without forcing it through
        /bin/sh. If present, csf chmods the script 0700 and checks for a
        shebang. If the shebang is missing #!/bin/bash is added to the top. The
        script is then run

        Added seventh parameter to regex.custom.pm to allow Cloudflare blocking
        if a CUSTOM regex is triggered (see latest regex.custom.pm in distro)

        Rearranged UI tabs and shortened tab names. Moved quick actions to the
        top of the "csf" tab pane

        Added "AUTH command used when not advertised" to the LF_EXIMSYNTAX
        regex check

        Added new csf CLI cluster option: -ci, --cignore ip [comment]
        This will add the IP to each remote /etc/csf/csf.ignore member and then
        restart lfd. This has also been added to the UI

        Fixed cluster grep output in UI

        Modified MESSENGERV2 to support combined certificates+keys in cPanel
        v68+

        Added triggered setting and, if applicable, temporary TTL to the
        "Blocked:" status in block alert emails

        Added "wildcard" option to "Search System Logs" UI to use ZGREP to
        search the specified log with a wildcard suffix. ZGREP option added to
        csf.conf which must point to the zgrep binary

        Added git binaries to csf.pignore on cPanel servers for upcoming v72/74
        features

11.06 - Modified Integrated UI to use new cxs UI perl modules

        Added custom redirect line for webmin UI when STYLE_CUSTOM enabled

        Ensure ip6tables nat table is flushed if present whether MESSENGER is
        enabled or not

11.05 - Added new configuration option PT_SSHDKILL. This option will terminate
        the SSH processes created when blocking an IP

        Added a "Fix Common Problems" section to the csf UI for various common
        configuration issues

        Ensure application ports are always defined in lfd

11.04 - Added new configuration option LF_APACHE_ERRPORT. This option is used
        to determine if the Apache error_log format contains the client port
        after the client IP. By default it is set to autodetect

11.03 - Improvements to ajax output in integrated UI

11.02 - Integrated UI fix for CloudFlare page

        Removed non-participated deny options for cxs reputation service

        Changed PT_SSHDHUNG to use a regex for process cmdline detection

        Fixed issue with IPv6 client detection in Apache logs

11.01 - Corrections to readme.txt

        In UI, display long output into fixed height divs with scrollbars and
        font size changer

        Modified Server Check to not display the mod_cloudflare warning if
        CF_ENABLE enabled

        Modified Server Check to display a single warning for each PHP check
        listing affected versions instead of multiple warnings

        Additional exim check added to Server Check

        Improvements to ajax output in UI

11.00 - New Feature: CloudFlare Firewall integration. This feature provides
        blocking and unblocking functionality with the CloudFlare Firewall from
        within lfd, together with new CLI commands for direct access. See
        documentation for CF_ENABLE in csf.conf, information in readme.txt as
        well as the csf man page

        Added UI elements for CloudFlare Firewall integration

        New CLI command --trace [ip]. This replaces the --w, --watch CLI
        command to Log SYN packets for an IP across iptables chains by using
        the iptables TRACE module

        New Feature: Check the size of the ModSecurity IP D/B. This option will
        send an alert if the ModSecurity IP persistent storage grows
        excessively large. This is enabled on cPanel by default. See csf.conf
        for more information

        New Feature: Allow use of comma separated list of ports in Advanced
        Allow/Deny Filters

        WATCH_MODE in csf.conf and --w, --watch CLI commands removed in favour
        of the new --trace [add/remove] [ip] CLI command

        Restrict the scope of Perl shebang replacement when installing on
        cPanel servers

        Modifications and fixes for the example MESSENGERV2 templates

        Ensure /proc/sys/net/netfilter/nf_conntrack_helper is enabled at
        startup to allow connection tracking to continue working on newer
        kernels

        Stop needlessly setting <head> and <body> elements in Ajax returns

        Various corrections and updates to readme.txt

        Tweaks to the Mobile View UI button arrangement and spacing

10.25 - CSS change to UI configuration page

        Remove refresh timer from UI log file grep

10.24 - On webmin servers, added csf.body file to UI skinning (STYLE_CUSTOM).
        See readme.txt for more information

10.23 - On cPanel servers, ensure that the csf driver for WHM is removed on
        uninstall

        Added hooks for upcoming cxs IP Reputation Service

        On webmin servers, added csf.htmltag and csf.bodytag files to UI
        skinning (STYLE_CUSTOM). See readme.txt for more information

        MESSENGERV2 released as stable on cPanel servers. This uses the Apache
        http daemon to provide the web service for MESSENGER HTML and HTTPS

        Additions to csf.logignore on new installs

        Added IPv6 support to BLOCKLISTS

        Added Spamhaus DROPv6 and Stop Forum Spam IPv6 blocklists to
        csf.blocklists

        Removed Spamcannibal and added all.s5h.net from/to csf.rbls

        Fixed issues with IPv6 rule creation attempts when IPV6 disabled

        Automatically enable WAITLOCK on initial installation if supported

10.22 - Fixed issue with the ModSecurity regex modification in v10.20

10.21 - Ensure /etc/logrotate.d/lfd is overwritten on upgrade

10.20 - Prevent lfd logrotate from erroring if log files missing

        Modified Apache ModSecurity regex to cater for changes in logging 
        format on cPanel servers with ModSecurity v2.9.2

        Modified Apache cxs regex to cater for changes in logging format on
        cPanel servers with ModSecurity v2.9.2

        Ensure destination files are owned by root during installation

10.19 - MESSENGERV2: Take a copy of the live certs and keys and use these in
        csf.messenger.conf to work around changing filenames for keys and certs
        when they are regenerated which causes httpd to fail. This is done each
        time lfd restarts

        Added CLI option csf --mregen: MESSENGERV2
        /etc/apache2/conf.d/csf_messenger.conf regeneration. This will also
        gracefully restart httpd

10.18 - Stability improvements to the UI daemon

        Fixed MESSENGER log entry spelling

10.17 - Prevent Cluster and UI daemons from terminating the main process if
        they themselves terminate

        Modify Cluster and UI daemons to restart if they are stopped or fail

        Modify Cluster and UI daemons to be more verbose about reasons for
        stopping

        Fixed typos in readme.txt and csf.conf

        Added MESSENGER child logging to /var/log/lfd_messenger.log, also for
        MESSENGERV2 via a new index.recaptcha.php

        Modified logrotate configuration to include /var/log/lfd_messenger.log

10.16 - Fixed issue in 10.15 which was causing the Cluster daemon to exit
        unexpectedly

10.15 - New EXPERIMENTAL feature on cPanel servers: MESSENGERV2. This uses the
        Apache http daemon to provide the web service for MESSENGER HTML and
        HTTPS

        Added new option LF_APACHE_401 that works in a similar way to
        LF_APACHE_404 and LF_APACHE_403

        Added new option RECAPTCHA_ALERT. This will send an email when a
        recaptcha unblock request is attempted by lfd. This option is enabled
        by default

        Stability improvements to UI, MESSENGER and CLUSTER daemon processes

        Added memory usage information to lfd log when using MESSENGER_HTTPS

        Add limiter to enforce MESSENGER_CHILDREN when connections are waiting
        for a child process

        Modify MESSENGER HTML examples for new installs to use inline images to
        improve page load speed and reduce lfd overheads

        Modified network interface detection to allow dash (-) in name

        URL updates in Server Check

        Increased the default value for MESSENGER_RATE to 100/s (from 30/m)
        and MESSENGER_BURST to 150 (from 5) for all installations to alleviate
        slow MESSENGER response times

        Set the SELinux security context for systemd and executable files

        Ensure firewalld is masked on systemd servers

10.14 - Made configuration checks on iptables more fault tolerant to avoid
        unnecessary failures while loading
    
        Removed openbl.org from csf.blocklists for new and existing installs

        More generic binaries added to csf.pignore

10.13 - Fixed looping/timeout of integrated UI children when Chrome client is
        used

10.12 - Configured UI to fully integrate with cPanel templates without using
        iframes

        Configured UI to display full cPanel breadcrumbs

        Configured UI to support cPanel v66 WHM UI changes

10.11 - Modified username regex for csf.syslogusers

        Fixed issue with /var/lib/csf/lfd.stats excessive growth

10.10 - Modified HTML to cater for major change in cPanel v66

10.09 - Added new option DROP_OUT which is set to "REJECT" by default. This
        option sets the default target for blocked outgoing ports. See csf.conf
        for more information

        Added improved detection of xtables lock and recommend enabling
        WAITLOCK on error

        Improved csf down detection when xtables lock in effect and WAITLOCK is
        not enabled

        Added support for listing ASNs in CC_IGNORE

10.08 - Added cpanel.allow and cpanel.ignore Include files for the cPanel
        authentication servers. These are included on new installations and
        added to existing files on cPanel installations

        If running cPanel 1:1 NAT, use the contents of /var/cpanel/cpnat to
        whitelist/ignore the external IP addresses

10.07 - Fixed bug when using RECAPTCHA_NAT where the listed IP's were not
        correctly processed

        Server Check now follows includes in dovecot.conf

        Server Check now reports RHEL/CentOS/CloudLinux v5.* as EOL

10.06 - Added new entry in csf.pignore on cPanel servers for:
        exe:/usr/libexec/dovecot/indexer
        exe:/usr/libexec/dovecot/indexer-worker

        Croak if IPTABLES is not set, incorrect or not present in csf.conf

        Set SELinux context for /etc/logrotate.d/lfd on new generic installs

10.05 - Fixed table header html/css

        Added workaround for adding superusers listed in
        /etc/csf/csf.syslogusers to the RESTRICT_SYSLOG_GROUP if the log socket
        is not accessed via the owner permissions

        Changes for cPanel v64 template

        Updated text description in csf.dirwatch for new installs

10.04 - Added error message to RECAPTCHA_* if the non-priveleged user cannot
        write to its home directory

        Further improvements to RECAPTCHA_* hostname check

10.03 - Added new option MESSENGER_HTTPS_SKIPMAIL on cPanel installations. This
        option ignores ServerAlias definitions that begin with "mail.". This
        can help with memory usage on systems that do not require the use
        of MESSENGER_HTTPS on those subdomains. The option is enabled by
        default on cPanel servers

        Improved RECAPTCHA_* hostname check

        Cluster CLI can now block CIDRs, e.g LF_NETBLOCK blocks will be applied
        cluster-wide

10.02 - Modified Messenger HTTPS to cater for a wider range of Apache
        VirtualHost formatting

        Added Messenger HTTPS workaround for servers using PEM but a version
        of IO::Socket::SSL that does not yet support it (pre v1.988)

        Added Messenger HTTPS warning in csf.conf regarding memory usage on
        some servers using the option

        Added java binary for cPanel solr process to csf.pignore on new and
        existing servers

10.00 - Added new feature to MESSENGER: MESSENGER_HTTPS*. See /etc/csf/csf.conf
        for more detail. This option redirects blocked IP addresses that
        connect over an HTTPS connection (port 443) to the HTML MESSENGER
        service. The option uses existing SSL certificates on the server for
        each domain to maintain a secure SSL SNI connection without browser
        warnings. The setting is disabled by default

        Note: The perl module IO::Socket::SSL (v1.83+) with support for SNI
        must be available to use MESSENGER_HTTPS* otherwise it will be disabled

        Added new feature to MESSENGER: Google ReCAPTCHA (v2) to allow those
        blocked in the firewall to unblock themselves. See RECAPTCHA_* in
        /etc/csf/csf.conf for more details and limitations

        Added MESSENGER procedure to restart listening sub-process if it has
        died

        Moved MESSENGER processes to a separate module

        Ensure that all forked processes terminate appropriately

        On cPanel servers, use the cPanel WHM Template to support the new v64
        UI layout (as best we can to maintain the look that we want)

        Modified the cPanel csf ACL metadata and driver Perl modules to match
        new requirements for v64 and also maintain backwards compatibility

9.30  - Fix to try and resolve cluster send/recv issues (Note: _All_ members of
        the cluster need to be running v9.30 for clustering to function
        correctly)

9.29  - Fixed issue that was breaking LF_DISTSMTP

        Fixed issue in UI lfd Stats. Note: The lfd stats data file has been
        renamed from /var/lib/csf/stats/lfdmain to /var/lib/csf/stats/lfdstats
        Additionally, the stats for 2016-12-31 will reset to 0 due to this bug

        Corrected text in readme.txt

        Added new csf CLI cluster option:
        -ctd, --ctempdeny ip ttl [-p port] [-d direction] [comment]
        This sends a temporary deny request to the cluster

        Added new csf CLI cluster option:
        -cta, --ctempallow ip ttl [-p port] [-d direction] [comment]
        This sends a temporary allow request to the cluster

        Added new csf CLI cluster option:
        -cg, --cgrep ip
        This requests the --grep output for [ip] from each cluster member

        Modified cluster requests to respond with an acknowledgment to the
        sender

        Modified --cdeny [ip] and --callow [ip] to include optional comment

        Added separate tab for Cluster options in UI if enabled and added new
        cluster temp allow/deny commands to UI

        Modified Port Scan Tracking. UDP packets destined for the network
        broadcast address(es) will now be ignored in Port Scan Tracking unless
        BRD is added to PS_PORTS. The broadcast address(es) include the those
        listed in IP or IFCONFIG plus the default (255.255.255.255) unless one
        of the servers IPs

        Added new feature: PT_USERRSS. This User Process Tracking option sends
        an alert if any user process exceeds the RSS memory limit set - RAM
        used, not virtual. PT_USERRSS is set to 256 (MB) and PT_USERMEM is now
        set to 512 (MB) by default on new installations. On existing installs
        PT_USERRSS is set to the same value as PT_USERMEM

9.28  - New logo added and configured for cPanel plugins

        HTML fixes

        STYLE_CUSTOM is now set to 0 by default on all new installations. If
        you want to choose custom styling this option can be enabled

9.27  - Fix for UI Quick Unblock button

        Fix for UI main page [ENTER] not working on all forms

9.26  - Fix for webmin UI when watching logs

        Various UI html syntax fixes

        Reduced UI banner padding

        Port 23 added to DROP_NOLOG for new installations

        WAITLOCK taken out of beta

        Modified UI View Listening Ports

        Reworked main UI table to produce syntactically correct HTML

        Fixed duplicate HTML top and bottom page elements

9.25  - Correct csf lookup failure message

        Converted UI icon for temp allow removal to new format

        Simplified Configuration display of radio toggles to help screen
        readers

        Added patch to send message text for CLUSTER blocks

9.24   - UI html fixes

9.23  - Added upgrade note to the top of the UI if available

        UI improvements for integrated cse and interface to cxs

        Added Scroll to Top/Bottom buttons

        Consolidate images, css and javascript into a common directory in the
        installer

9.22  - Modify UI temporary IP deny buttons to not wrap in table

        Modified UI Statistics images to be responsive

        Modified readme.txt to detail additional UI styling options

        Added two new options STYLE_CUSTOM and STYLE_MOBILE relating to UI
        styling

        Globalised SIGNALs where needed to help prevent zombie children

        Modified UI to use container-fluid to improve whitespace use

        Modified pre tags to wrap on whitespace

9.20  - Redesigned UI based on Bootstrap

        New functionality: Added integrated mobile device view with subset of
        functions

        Modified csf to not warn about the SENDMAIL binary if LF_ALERT_SMTP is
        enabled

        Added use of the ace editor if present on cPanel installs to edit
        files. Added toggle to switch back to textarea. Added buttons to
        decrease and increase font size in editor

        Modified readme.txt to include information regarding changing styles
        and disabling Mobile View

9.14  - Fixed LOGSCANNER logging to only report to the log if DEBUG enabled

        Added new BETA options WAITLOCK and WAITLOCK_TIMEOUT which provide
        support for the iptables --wait option

        Added UI support for cxs with Bootstrap

9.13  - Modify Server Check to prevent hanging process for CloudLinux PHP
        versions prior to v5.2 

9.12  - Improved LOGSCANNER accuracy of hourly and daily runs between restarts

        Added more binaries on cPanel servers to csf.pignore for cPanel v60

        Fixed repeated check for PHP open_basedir in Server Check

        Do not perform suexec check if mod_ruid2 enabled in Server Check

        Corrected text description of IPv6 port lists in non-cPanel csf.conf

        Export ConfigServer::Logger::logfile

        Detect mpm_itk_module and treat in a similar manner to ruid2_module in
        Server Check

        Removed use of Cpanel::cPanelFunctions as it is now being withdrawn

        Updated common ConfigServer UI

        Fix instance where cluster block timeout for temporary blocks was not
        being sent

        Check for EOL PHP v5.5 in Server Check

        Added detection of alt-php versions provided by CloudLinux, but do
        not check them for EOL version status

9.11  - Fixed issue with csf.allow Include checks when allowing an IP

        Added the Greensnow blocklist to csf.blocklists for new installs

        Fixed display of ports in CLI temporary blocks

        Fixed issue removing CIDR blocks via the CLI from csf.deny

9.10  - Fix profile diff in the CLI

        Fixed issue with deny removal by IP address of advanced rules in the
        CLI

9.09  - Additional fix for ip6tables MESSENGER service when LF_IPSET not
        enabled (ip6tables nat)

9.08  - AUTOSHUN list removed from csf.blocklists as the public list is no
        longer available

        Added support for ip6tables MESSENGER service when LF_IPSET not
        enabled (ip6tables nat)

9.07  - Fixed removal of complex allow and deny rules

        Fixed IPv6 implementation of CC_ALLOW_PORTS_* and CC_DENY_PORTS_*

        Fixed file upload in cse via the integrated UI

        Fixed "csf --cfile [file]"

        Removed setting: OLD_REAPER

        Localised SIGNALs

        Localised uid and gid change in MESSENGER

        Removed Bareword file handles

        Where ip6tables <= v1.3.5 and IPV6 is enabled, disable USE_CONNTRACK if
        enabled as ip6tables does not support the conntrack module in older
        versions. This will force the use of the state module instead

9.06  - Fixed incorrect inclusion of cPanel Free SSL service include entries
        on new non-cPanel installations

9.05  - Fixed RT_AUTHRELAY_LIMIT detection

9.04  - Fixed issue with custom regex rules where log hash was not being
        passed to regex.custom.pm

        Fixed issue with custom regex rules where "use strict" was used
        incorrectly

9.03  - Fixed issue with LF_ALERT_TO and LF_ALERT_FROM not being used when set

9.02  - Fixed Reseller UI command execution

9.01  - Fixed graph display when using integrated UI

9.00  - Convert csfui.pl, csfuir.pl and cseui.pl to perl modules and modify
        the calling UI specific scripts

        Updated cseUI so that is passes perl strict module checks

        Fixed issue with deny removal of some IPv6 addresses

        Ensure /etc/chkservd/lfd is recreated when lfd is enabled via csf -e
        on cPanel servers

        Added exes to csf.pignore on existing and new cPanel server:
        /usr/libexec/dovecot/lmtp
        /usr/local/cpanel/3rdparty/php/54/bin/php-cgi
        /usr/local/cpanel/3rdparty/php/56/bin/php-cgi
        /usr/local/cpanel/3rdparty/php/56/sbin/php-fpm

        Ensure all file opens are properly flocked

        Switch to using require instead of eval/use to load runtime modules
        where possible

        Code review - started addressing perl critic suggestions in all
        scripts and modules

        Moved regex.pm to a seperate perl module

        Moved email sending to a seperate perl module

        Moved lfd logging to a seperate perl module

        Add allow and ignore Include files for the cPanel Free SSL service
        from Comodo in cPanel v58+. These are included on new installations
        and added to existing files on cPanel installations

        Fixed spurious Include error in lfd for csf.ignore

8.26  - Added more dovecot binaries to csf.pignore for new and existing cPanel
        servers

        Updated lfd-cron to use the csf startup routines to restart lfd on
        systemd servers correctly, existing cron jobs are also modified

        HTTP::Tiny upgraded to v0.058

8.25  - Modified Config loading to check for valid ip6tables location before
        attempting to use it

        Modify Server Report to support checking of cPanel MultiPHP
        configurations when using EasyApache v4

        Removed PHP check for suhosin from Server Report

        Improved cipher check for pure-ftpd in Server Report

        Added password reset check for subaccounts in Server Report on cPanel
        servers

        Added cPanelID check in Server Report on cPanel servers

8.23  - On cPanel servers ensure the lfd service is always correctly appended
        to chkservd.conf on csf installation

8.22  - Fix csf --tempdeny from allowing blocking of local IPs

        Fix problem where LF_NETBLOCK was no longer affective after blocking
        a its first netblock until it timed out from csf.tempip

        Modify UI table spacing

8.21  - Modified cPanel version check to avoid restart loop if GENERIC set to
        1 in csf.conf

8.20  - Modify Relay Alert email to specify "localhost" rather than "Local
        Account" when localhost IPv6 address detected as it currently does for
        IPv4 localhost

        Improvement to lfd restart routine for MailScanner and pure-ftpd when
        cPanel upgrades on RHEL/CentOS/CloudLinux v7+ servers

8.19  - Move SMTP_BLOCK rules to a separate chain to avoid conflicts with
        other control panels deleting required rules

8.18  - Reversed csf.tempip changes to avoid a possible locking issue in
        csf.pl, lfd.pl changes retained

8.17  - Fixed 12 month statistics pie chart rendering

        Increased default value and sanity range for PT_USERMEM

        Modified SMTP_BLOCK to use iptables multiport

        Added new feature: SMTP_REDIRECT. This redirects non-authorised
        outbound SMTP connections to the local SMTP server

        Ensure LF_PERMBLOCK IP's are removed from csf.tempip when rotating
        csf.deny after reaching DENY_IP_LIMIT

        Remove stale csf.tempip entries on lfd startup

        Added IPv6 support to RT_LOCALHOSTRELAY tracking

        Update binary locations for new installations on DirectAdmin Debian

        Improved fix for detection of ip6tables nat chains

        Added UI Firewall Configuration On/Off buttons

        Added UI Firewall Configuration dropdowns for some value ranges

        Updated UI restricted list

        Updated sanity checks

        Various UI updates and modifications

        Added a warning when using mod_cloudflare to Server Check Report

8.16  - Removed UI integration from CentOS Web Panel as recent permission
        changes break the implementation. The csf installer will restore the
        original functionality

8.15  - Added new configuration option IP to point to the IP binary. This will
        be used in preference to IFCONFIG, the latter is no longer required
        when the IP binary is correctly configured and executable

        Added full UI integration into CentOS Web Panel (CWP). To disable
        integration:
        Rename: /usr/local/cwpsrv/htdocs/resources/admin/modules/csf.orig.php
        to:     /usr/local/cwpsrv/htdocs/resources/admin/modules/csf.php
        create: /etc/csf/cwp.disable

        Updated Postfix SMTP AUTH regex (thanks to Marcele)

        Added support for /etc/csf/csf.blocklists in ZIP format. The zip file
        MUST only contain a single text file of a single IP/CIDR per line

        Added Stop Forum Spam (ZIP) example to csf.blocklists

        Added IPV6 support to csf.sips

        Fixed detection of ip6tables nat

        Removed development code for ispconfig from distribution as this
        should NOT be used. It has never been implemented nor released as a
        supported solution and is likely to be insecure. Upgrading will remove
        any installations of this development code

8.13  - Added /usr/local/cpanel/3rdparty/php/54/sbin/php-fpm to csf.pignore
        for  cPanel installs

        Clarify cluster CLI commands that refer to remote server actions

        Added number of failures to the RBL check Subject field

        Modified Port Scan checks for more kernel log line formats in regex.pm

8.12  - Additional Feature: Added support for listing ASNs in all Country Code
        (CC_*) options

        Fixed GLOBAL_ALLOW and GLOBAL_DENY when LF_IPSET is enabled

        Fixed GLOBAL_DYNDNS when LF_IPSET and LF_IPV6 are enabled

        IPSET binary location set to /sbin/ipset for Debian/Ubuntu new
        installs

        Additional regex included for vsftp login failures

8.11  - Fixed issue on non-RedHat OS installations that failed due to problems
        whitelisting the installers IP address

8.10  - Fixed issues with new non-RedHat OS installations by reasserting perl
        module check to the start of the installation process but removing
        included modules from checks

        Ports 2079 and 2080 added to TCP_IN for new cPanel installs to allow
        CalDAV/CardDAV access

8.09  - Check /sys/module/ipt_recent/parameters/ip_pkt_list_tot or
        /sys/module/xt_recent/parameters/ip_pkt_list_tot if defined to allow
        higher settings for PORTFLOOD than the default of 20 if configured

        Added LimitNOFILE to lfd.service on servers using systemd to allow for
        large numbers of open files

        Cater for full stops (.) in ethernet device names

        Moved Perl module checks until after csf installation has completed so
        that all included modules exist in /usr/local/csf/lib/

8.08  - Fixed csf.sips modification via UI on Redhat/CentOS v7.1

        Raised csf.blocklist names from 9 to 25 characters long. This cannot
        be greater due to limits on ipset names on some OS's and the use of
        prepended names for new ipset list swapping

        Added output from netstat for PT_LOAD to loadalert.txt for new
        installs. For existing installs, latest file copied to
        /usr/local/csf/tpl/loadalert.txt.new

8.07  - Ensure spaces are stripped from values in /etc/cpanel/ea4/paths.conf
        on cPanel servers

        Fixed issue with csf --add [ip] not always removing [ip] if present
        from csf.deny

        Modified the LF_QOS regex to cater for additional log formats

8.06  - Added port 24441 to UDP_OUT and UDP6_OUT for new installs on cPanel
        servers for Pyzor that was added by cPanel in v11.52

        Support added for EasyApache4 log locations in cPanel from
        /etc/cpanel/ea4/paths.conf

        Added more executable files to csf.pignore on cPanel servers for
        cPanel EasyApache4

        Modify Server Check to support cPanel EasyApache4

        Added regex to support cPanel/WHM login failures with the new log
        format in v11.52+

        If mod_ruid2 is enabled do not check for mod_userdir in Server Check

        Always ensure binary exists and is executable before performing
        processing during Server Check

        Modified ProFTPD regex to support more formats

        vsftpd inbuilt log file format regex added

        Modified cPanel antirelayd Server Check to also support popbeforesmtp
        added in v11.52

        Added dbus and time systemd regexes to csf.logignore for new installs

8.05  - Added alarms to HOST binary calls

        Added new csf CLI option: --rbl [email]. This generates the report
        checking IP addresses against a set of RBLs. Optional configuration is
        available through /etc/csf/csf.rblconf

        Added UI to utilise the new --rbl [email] option

        Added systemd status output after lfd restart via the csf CLI

        Modified Server Check to only report bind if a named configuration
        file exists

        Require cPanel resellers to enter a Comment when allowing or denying
        an IP

        Added new option UI_IP to allow binding to a specific IP address for
        the integrated UI

8.04  - Added more executable files to csf.pignore on cPanel servers for
        cPanel v11.5*+

        Added warning to both csf output and Server Check report if
        PT_USERKILL is enabled

8.03  - Fixed bug where iptables nat tables were not being flushed or grepped
        correctly

8.02  - Modified DYNDNS and GLOBAL_DYNDNS to use the host binary if available
        for more reliable IPv4 and IPv6 reverse lookups

        Fixed IPv6 use of ipset for DYNDNS and GLOBAL_DYNDNS

        Added new csf CLI option: --lfd [stop|start|restart|status]. Actions
        to take with the lfd daemon

        Added new csf CLI option: -ra, --restartall. Restart firewall rules
        (csf) and then restart lfd daemon

        Fixed several output message typos for "FASTSTART"

        Disable IPv6 nat support (and MESSENGER) if ip6tables nat not provided
        by the local kernel

        Improve IPv6 detection on installation

        Implemented more efficient csf.conf loading in ConfigServer::Config

8.01  - Modify ConfigServer::CheckIP to cope with entries not passed by reference 

8.00  - Added new option CC6_LOOKUPS. This adds IPv6 support for Country Code
        and Country lookups

        Added new option LF_NETBLOCK_IPV6. This adds IPv6 support for
        LF_NETBLOCK

        Modified LF_LOOKUPS to use the host binary if available for more
        reliable IPv4 and IPv6 reverse lookups

        Added IPv6 support for LF_IPSET

        Added IPv6 support for CC_DENY, CC_ALLOW, CC_ALLOW_FILTER,
        CC_ALLOW_PORTS, CC_DENY_PORTS, CC_IGNORE, CC_ALLOW_SMTPAUTH
        (Requires CC6_LOOKUPS and CC_LOOKUPS to be enabled)

        Added IPv6 support for X_ARF report where found in the Abusix Contact
        DB

        Added IPv6 nameserver support for /etc/resolv.conf

        Added IPv6 support for MESSENGER if ip6tables version >= 1.4.17 and
        perl module IO::Socket::INET6 is installed

        Added IPv6 support for PORTFLOOD if ip6tables version >= 1.4.3

        Added IPv6 support for CONNLIMIT if ip6tables version >= 1.4.3

        Added IPv6 support for SYNFLOOD

        Added flush of ip6tables nat table if ip6tables version >= 1.4.17

        Standardise all IPv6 addresses and networks to use the short form for
        consist representation

        Added FASTSTART support to LF_IPSET

        Increased ulimit -n to 4096 in /etc/init.d/lfd

        Included Net::IP for IP address manipulation

        Included version perl module for version comparisons

        Added missing csf.allow search to csf --grep

        Added Server Check report for LF_IPSET when using Country Code filters

7.73  - Fix for temporary denies allowing duplicate IP/Port blocks/allows

        Speedup csf --grep [ip] when searching IPSET sets. Note: This does
        mean that partial IP queries will no longer match IPSET entries

        Added new options LF_IPSET_HASHSIZE and LF_IPSET_MAXELEM to allow for
        larger ipset sets

        Added option HOST as the location of the "host" binary for DNS TXT
        record lookups

        Modified X_ARF report to include the abuse contact for a reported IP
        address where found in the Abusix Contact DB

        Added new option X_ARF_ABUSE. This option allows for automatic sending
        of X_ARF reports to the IP addresses abuse contact. See csf.conf for
        warnings about using this option

        Added binary location checking in csf and issue warnings if incorrect,
        not installed or not executable

7.72  - Added new option PT_SSHDHUNG. Terminate hung SSHD sessions. When under
        an SSHD login attack, SSHD processes are often left hung after their
        connecting IP addresses have been blocked. This option will terminate
        such processes. See csf.conf for more info

        Added new binaries to csf.pignore on existing cPanel installations to
        cater for v11.50 and CentOS v7

        LF_CONSOLE_EMAIL_ALERT and LF_WEBMIN_EMAIL_ALERT now default to 1 for
        new installations

        Updated Server Check ipv6 detection

        Updated sanity checks

7.71  - Added warning on cPanel servers for GreyListing

        Fixed issue with RedHat/CentOS/CloudLinux v7 where local IPs were not
        being successfully detected from IFCONFIG

7.70  - Removed PayPal Donation buttons due to recent abuse

7.69  - Modified LF_CSF on cPanel servers to detect a change in the cPanel
        version and then trigger a restart of ConfigServer scripts (added
        cxs pure-uploadscript restart)

7.68  - Added Debian v8 and Ubuntu v15 support

        HTTP::Tiny upgraded to v0.054

7.67  - Added a workaround for Plesk sendmail wrapper SIGCHLD problem

7.66  - Fixed UI status form tags

        Added new option LF_SPI. This option configures csf iptables as a
        Stateful Packet Inspection (SPI) firewall - the default. If the server
        has a broken stateful connection tracking kernel then this setting can
        be set to 0 to configure csf iptables to be a Static firewall, though
        some funtionality and security will be inevitably lost

        Added common systemd logs to csf.logignore for new installs

        Modify LF_IPSET in csf to print failure messages instead of aborting
        on error

        On servers using systemd if firewalld found to be active, csf and lfd
        will not start until is is stopped and disabled as csf cannot be used
        with firewalld

        Added option SYSTEMCTL to csf.conf as the location of the systemctl
        binary for use with servers using systemd

7.65  - Fixed csf.blocklist for new installs which incorrectly had OPENBL
        enabled by default

7.64  - UI HTML updates and fixes

        Modified openbl.org URLs in csf.blocklist to use https - this will
        likely need URLGET set to 2 (LWP)

7.63  - Modified Server Check to highlight PHP v5.3.* as EOL and therefore a
        security risk

        Port 587 added to TCP_OUT/TCP6_OUT on all new installations (previously
        only on cPanel)

        Added new CLI option to csf, -i --iplookup will lookup IP address
        geographical information using CC_LOOKUPS setting in /etc/csf/csf.conf

        Manually allowed/denied permanent/temporary IPs through the csf CLI
        now include the CC information if no comment is used

        Renamed csf and lfd cron jobs in /etc/cron.d/ to cater for non-LSB
        compliant Linux cron managers

        Modified Server Check report to cater for servers running systemd

        More Server Check fixes for out of date checks

        Added 2 new alert settings for FTP and SMTP distributed attacks:
        LF_DISTFTP_ALERT and LF_DISTSMTP_ALERT

7.62  - Modified ModSecurity regexes to be more generic

7.61  - Fix issues with lfd restart via integrated UI and DA UI

7.60  - Ensure that /usr/lib/systemd/system/ is created on install on systemd
        servers

7.59  - Fix sanity check for SMTPAUTH_RESTRICT

        Fixed incorrect reference to cxs in the generic csf installer

        Modified csf.conf to show that LWP::Protocol::https is needed for LWP
        to retrieve https URLs and added examples of how to install these perl
        modules

        Implemented native systemd support for startup and shutdown of csf and
        lfd

        Added recommendation in csf.conf to use IPSET if wanting to set
        DENY_IP_LIMIT to a high value

        If IPSET is enabled, no sanity warnings are issued for DENY_IP_LIMIT

        Also add SSH port to TCP6_IN on new installations

7.58  - Display warning and revert to HTTP::Tiny if URLGET is set to use LWP
        but the perl module is not installed

7.57  - URLGET now set to "2" to use LWP by default on new installations
        instead of HTTP::Tiny

        If URLGET set to use LWP, csf will perform upgrades over SSL to
        https://download.configserver.dev

        Added check for URLGET to Server Check

        Added option "3" for CC_LOOKUPS to also include IP ASNs via the
        MaxMind GeoIPASNum database

        Updated SSH login regexes

        Updated named regex

        Added 30 second timeout for ST_IPTABLES iptables stats writing to
        prevent a child creation loop

        Modified lfd to restart if more than 200 children are currently active
        to prevent child creation loops

7.56  - Fixed issue with Restricted UI item sanity checks failing

        Modified LF_CSF on cPanel servers to detect a change in the cPanel
        version and then trigger a restart of ConfigServer scripts (lfd,
        MailScanner cxs Watch). Restart triggers are limited to every 12 hours
        and will only trigger if upcp is not running

7.55  - If LF_SELECT is enabled the port(s) listed in PORTS_* can now be
        specifed as port;protocol,port;protocol, e.g. "53;udp,53;tcp" to allow
        for protocol specific port blocks. This port format can also now be
        used in regex.custom.pm  and csf --td/--ta to allow udp port blocks

        PORTS_bind now defaults to "53;udp,53;tcp" on new installations

        PORTS_directadmin added for DA installs to allow for per port blocks
        if LF_SELECT is enabled

        Ports 993 and 995 now added to TCP_OUT and TCP6_OUT on new installs

        LF_IPSET taken out of BETA as it is proving stable

        Modified Server Check to skip checking xinetd on Plesk servers

        Modified UI_SSL_VERSION for new installations to use the new
        IO::Socket::SSL default SSL_version setting of SSLv23:!SSLv3:!SSLv2 so
        that SSLv3 is disabled

        If systemd is running the installer disables firewalld using systemctl

7.54  - Added IPv4/IPv6 column to show whether the port in the csf --ports 
        option is listed in *_IN (e.g. TCP_IN)

        Added Conn column to show the number of ESTABLISHED connections to the
        port in the csf --ports

        Modified Server Check text from "SMTP Tweak" to "SMTP Restrictions"
        for cPanel/WHM UI

        Added the following to LF_IPSET for IPv4 IPs and CIDRs:
        /etc/csf/csf.allow, /etc/csf/csf.deny, GLOBAL_DENY, GLOBAL_ALLOW,
        DYNDNS, GLOBAL_DYNDNS, MESSENGER. 
        IPv6 IPs, Advanced Allow Filters and temporary blocks use traditional
        iptables

        Modified ipset information in csf.conf including that only ipset v6+
        is supported

        Modified ConfigServer::Slurp to carp instead of croak

        Improvements to Server Check nameserver checking to include IPv6
        servers and better determine how many are local nameservers

        Modified csf --graphs to append a trailing slash if missing to
        directory name

7.53  - Modified Slurp.pm to use O_RDONLY instead of O_RDWR

7.52  - Fixed issue with Restricted UI items sanity checks failing

7.51  - Removed duplicate "Search System Logs" button from the UI

7.50  - Added new BETA options LF_IPSET, IPSET. Use ipset for CC_* and
        csf.blocklist bulk list matching. See csf.conf for more info

        Added new UI option to view ports on the server that have a running
        process behind them listening for external connections

        Added new CLI option (csf -p, csf --ports) to view ports on the server
        that have a running process behind them listening for external
        connections

        Added new CLI option (csf --graphs) to Generate System Statistics html
        pages and images for a given graph type into a given directory. See
        ST_SYSTEM for requirements

        If using DYNDNS and the FQDN has multiple A records then all IP
        addresses will now be allowed

        IPv6 support added to DYNDNS. Requires the Perl module Socket6 from
        cpan.org to be installed

        On DA servers, if LF_DIRECTADMIN is enabled, DIRECTADMIN_LOG_* will be
        scanned for login failures to Roundcube, SquirrelMail and phpMyAdmin
        if installed and logging enabled via CustomBuild v2+. Failures will
        contribute to the LF_DIRECTADMIN trigger level for that IP

        On DA servers, FTPD_LOG now defaults to /var/log/messages on new
        installs

        Added exe:/usr/libexec/dovecot/anvil to csf.pignore for new installs
        on DA

        Added to UI count of entries in /etc/csf/csf.allow

        Added blocklist.de to csf.blocklists for new installs, latest file
        copied to /etc/csf/csf.blocklists.new on existing installs

        Started moving common functions to separate modules within csf

        HTTP::Tiny upgraded to v0.050

        Fixed csf stop/start routines on reboot for servers using systemd

        Modified integrated UI to display die errors to browser

        Modified X_ARF report to use a self-published schema:
        https://download.configserver.dev/schema/abuse_login-attack_0.2.json

        Modified X_ARF to lowercase the Source-Type field

        Modified X_ARF template to use the v0.2 "X-XARF: PLAIN" header field

        Updated restricted UI items

        Geo::IP upgraded to v1.45

        Crypt::CBC upgraded to v2.33

7.15  - Updated installer to fix generic installs on some Redhat/CentOS setups

        Fixed issue with temporary allow/deny not applying individual port
        rules for outgoing connections

7.14  - Updated scripts to use download.configserver.dev

7.13  - Fixed issue with temporary allow/deny when issued through the UI

7.12  - Reverted PACKET_FILTER rule changes

        OPEN added as an option to PS_PORTS so that TCP_IN and UDP_IN ports
        will be ignored by Port Scan Tracking by default, but can be added if
        desired

7.11  - DROP_PF_LOGGING disabled by default on new installs as enabling by
        default will just cause confusion

7.10  - Removed debugging code from Port Scan Tracking

7.09  - Set scripts (.pl,.cgi,.php,.sh,.py) in /etc/csf/ to chmod 700

        Simplified PACKET_FILTER rules for dropping INVALID connection
        tracking states. This feature now only applies a single rule for
        incoming INVALID packets

        DROP_PF_LOGGING enabled by default on new installs

        INVALID added as an option to PS_PORTS so that PACKET_FILTER logs will
        be ignored by Port Scan Tracking by default, but can be added if
        desired

        Modified ST_ENABLE locking

        Regex updates to cater for Plesk 12 - thanks to Marcel Evenson

        Fixed issue with temporary allow/deny comment not being parsed 
        correctly when port * specified

7.08  - Withdrawn

7.07  - Modified lfd to silently drop ST_ENABLE lock queue entries unless
        DEBUG is enabled

        Modified ST_ENABLE logging to append to data file and only truncate
        when needed

7.06  - Added locking to ST_ENABLE and ST_SYSTEM to prevent child process
        queues

7.05  - Fix SMTPAUTH_RESTRICT where IPv6 addresses need to be quoted for exim

7.04  - Added new option LF_DIST_ACTION. If LF_DISTFTP or LF_DISTSMTP is
        triggered, then if LF_DIST_ACTION is a path to a script, it will run
        the script and pass arguments to it. See csf.conf for more info

        Added limit check on VPS servers when using FASTSTART to ensure there
        are sufficient numiptents available for all of the iptables rules in
        that block

        Modified SMTPAUTH_RESTRICT to add ::1 as a standalone IP to
        /etc/exim.smtpauth

        Fixed LF_BIND - BIND_LOG was not being added to the log list to watch

        On DirectAdmin servers, added new feature LF_DIRECTADMIN. This option
        scans DIRECTADMIN_LOG for failed logins and blocks accordingly

        Fixed typo in csf.conf

7.03  - Added new option DROP_UID_LOGGING which allows UID logging to be
        disabled for outgoing connections. This option is enabled by default
        and can be disabled on OS's that do not support --log-uid

        Preupgrade copy of csf.conf now created in /var/lib/csf/backup/ for
        use with the csf --profile option

        Updates to sanity.txt for new options

        Modified DSHIELD blocklist URL from feeds.dshield.org/block.txt to
        www.dshield.org/block.txt for new and existing installs

7.02  - Make auto.pl scripts more resilient to avoid leaving an incomplete
        configuration file after upgrades

        Improved output errors if FASTSTART fails

        Ensure UNZIP binary exists before attempting to process GeoLite CSV
        Country database

        Corrected FASTSTART description in Server Report check

        Modified auto.pl to not automatically enable IPV6 on Virtuozzo/OpenVZ

        Report all errors after csf starts in case they were missed in the
        main output

7.01  - Fixed issue with FASTSTART and DROP_PF_LOGGING

7.00  - New feature SMTPAUTH_RESTRICT - This option will only allow SMTP AUTH
        to be advertised to the IP addresses listed in /etc/csf/csf.smtpauth
        on EXIM mail servers. The additional option CC_ALLOW_SMTPAUTH can be
        used with this option to additionally restrict access to specific
        countries. See csf.conf and readme.txt for more information

        New FASTSTART procedures in csf and lfd to centralise functions and
        add error reporting

        FASTSTART added to GLOBAL_ALLOW, GLOBAL_DENY, GLOBAL_DYNDNS, csf.deny,
        csf.allow, Port Settings, PACKET_FILTER, DROP_NOLOG, SMTP Block, DNS

        Remove duplicate IP addresses from individual blocklists

        Remove duplicate IP addresses (not CIDRs) across blocklists as they
        are newly retrieved

        Ensure /usr/local/bandmin/bandminstart exists and is executable on
        cPanel servers before using it

        Removed MySQL version check as it is currently redundant from Server
        Report

        Improve Net::CIDR::Lite use integrity to prevent unnecessary lfd
        failures

        Ensure GeoIPCountryWhois.csv is removed before processing a new d/b
        download

        Add /etc/csf/csf.smtpauth to UI if SMTPAUTH_RESTRICT is enabled

        Fixed issue with IPv6 generation of SMTP_ALLOWUSER rules

6.48  - Fixed csf --ta/d not accepting comma separated port list

        Modified csf -t multi-port reporting

        Modified csf UI to support specifying port list in temporary
        allow/deny

        Modified integrated UI call to perform separate calls to
        IO::Socket::SSL to use the appropriate AF_INET(6) call depending on
        the setting for IPV6

        Updates to integrated cse UI CSS

        Added regular expressions for courier-imap, Qmail SMTP AUTH and
        Postfix SMTP_AUTH for Plesk servers

        Removed RBN from csf.blocklist for new installs as it is now obsolete

        Check for an apply correct permissions on /var/lib/csf and
        /usr/local/csf in addition to /etc/csf

6.47  - Overhaul of Apache regexes to cater for Apache v2.4 formats

        Fail with an appropriate error if attempting to use an IPv6 address
        but IPV6 is not enabled

        Fix to OUTPUT chain final packet failure still logging to LOGDROPOUT
        when DROP_OUT_LOGGING is disabled

        Strip leading and trailing spaces from form IP in csf UI

        DROP_OUT_LOGGING is now enabled by default on new installations

        ST_ENABLE is now enabled by default on new installations

        CC_IGNORE rewritten to use CC_LOOKUPS data to ignore countries. This
        provides a more consistent approach and quicker lookups with reduced
        memory footprint. CC_LOOKUPS must now be enabled to use CC_IGNORE

6.46  - HTTP::Tiny reverted to v0.041 as it breaks on some installations

6.45  - Modified LF_SCRIPT_ALERT to only report detected lines

        Modified Server Check for sshd_config port to be case-insensitive

        Modified PORTS_sshd check of sshd_config port to be case-insensitive

        HTTP::Tiny upgraded to v0.042

        Reverse sort temp bans in UI

6.44  - File globbing is now allowed for logs listed in csf.logfiles and
        csf.syslogs

        Added Server Reports recommendation for CloudLinux if running CentOS
        or RedHat

        Added Server Reports CloudLinux security feature checks

        Modified Server Report check for dovecot v2

        Updated Server Report version checks for Fedora, MySQL and Apache

        Added missing bracket to regex.custom.pm example

        Added new PORTS_* options to csf.conf to allow custom modification of
        LF_SELECT application ports

        Added Cached memory to the System Statistics

        Added full pseudo-breadcrumbs to cPanel csf UI

        Added new CLI and UI commands to backup/restore csf.conf and to apply
        preconfigured csf.conf profiles. See "man csf" and UI for more details
        of the "csf --profile [OPTIONS]" commands

        HTTP::Tiny upgraded to v0.041

6.43  - Modified RESTRICT_SYSLOG_GROUP to always include /dev/log and
        /usr/share/cagefs-skeleton/dev/log, if a socket, if syslog/rsyslog
        process is not found and also to cater for systems using systemd (e.g.
        Fedora, RHEL v7, etc)

        RESTRICT_SYSLOG_GROUP taken out of BETA as it appears stable and
        effective. Setting RESTRICT_SYSLOG to "3" is the recommended option

        Updated readme.txt RESTRICT_SYSLOG mitigations to include CloudLinux
        method to disable access to caged /dev/log

        csf --dr modified to remove matching IPs from csf.tempip

        File globbing is now allowed for all *_LOG file settings in csf.conf.
        However, be aware that the more files lfd has to track, the greater
        the performance hit

6.42  - New BETA option RESTRICT_SYSLOG_GROUP. This has been added for a new
        RESTRICT_SYSLOG option "3" which restricts write access to the
        syslog/rsyslog unix socket(s). See csf.conf and the new file
        /etc/csf/csf.syslogusers for more information

        Those running our MailScanner implementation, you must be running
        at least ConfigServer MailScanner Script v2.91 for logging to work
        with RESTRICT_SYSLOG_GROUP

        csf UI option added for editing csf.syslogusers

        Fixed a bug in PT_LOAD not producing PS output

6.41  - SECURITY WARNING:

        Unfortunately, syslog and rsyslog allow end-users to log messages to
        some system logs via the same unix socket that other local services
        use. This means that any log line shown in these system logs that
        syslog or rsyslog maintain can be spoofed (they are exactly the same
        as real log lines).

        Since some of the features of lfd rely on such log lines, spoofed
        messages can cause false-positive matches which can lead to confusion
        at best, or blocking of any innocent IP address or making the server
        inaccessible at worst.

        Any option that relies on the log entries in the files listed in
        /etc/syslog.conf and /etc/rsyslog.conf should therefore be considered
        vulnerable to exploitation by end-users and scripts run by end-users.

        There is a new RESTRICT_SYSLOG option that disables all those features
        that rely on affected logs. This option is NOT enabled by default.
        
        See /etc/csf/csf.conf and /etc/csf/readme.txt for more information
        about this issue and mitigation advice

        NOTE: This issue affects all scripts that process information from
        syslog/rsyslog logs, not just lfd. So you should use other such
        scripts with care

        Our thanks go to Rack911.com for bringing this issue to our attention

        UI design updates and fixes

        Modify Apache regex to support log lines containing thread ID

        Prevent lfd from blocking CIDRs triggered from log lines

6.40  - Fix for LF_INTEGRITY which was non-functional after changes in v6.38

6.39  - Added error output from IO::Socket::INET for CLUSTER_* commands from
        csf if present

        UI HTML fixes and form design elements added

        Improved error report for invalid csf.conf lines

        Removed Server Check tmp mountpoint checks

6.38  - Parameterise calls to system and Open3 where possible

        HTTP::Tiny upgraded to v0.039

        Modifications to csftest.pl

        Removed the UI "Pre-configured settings for Low, Medium or High" as
        they are outdated and meaningless. Users should go through the csf
        configuration and setup the firewall for their individual server needs

        Translate ampersand for HTML output

        Modified csf.blocklist for new installations to use the SSL URL for
        the TOR exit list now that they have forced redirection from the
        non-SSL URL, with a note to change URLGET to use LWP

        Modified csf.blocklist for new installations to specify an alternative
        TOR exit node list

6.37  - Fixed issue that produced false-positive failures for IP address
        actions through UI when checking for a valid IP address

        Modified lfd to support the use of either "password" or "pass" in
        /root/.my.cnf for ST_MYSQL

        Updated CLUSTER information in readme.txt

6.36  - Removed VPS PASV check from Server Check in UI

        Added new option URLGET - This option can be used to select either
        HTTP::Tiny or LWP::UserAgent to retrieve URL data. HTTP::Tiny is
        faster than LWP::UserAgent and is included in the csf distribution.
        LWP::UserAgent may have to be installed manually, but it can better
        support https:// URL's. HTTP::Tiny is selected by default

        Removed extraneous bracket in UI output when reporting errors in user
        supplied data

        Added new options LF_EXIMSYNTAX, LF_EXIMSYNTAX_PERM - These will block
        IP addresses producing repeated exim syntax errors, typically seen
        from: spammers, hackers and broken MUAs and MTAs. This option is
        enabled by default

        HTTP::Tiny upgraded to v0.036

6.35  - Security fix with included cse when using inbuilt User Interface:
        prevent XSS due to malicious directory/file names

6.34  - Load DYNDNS and GLOBAL_DYNDNS from last known values when restarting
        csf instead of waiting for lfd to load the initial rules

        Improved performance of file slurping

        Cluster documentation correction in readme.txt

        UI button style modifications

        Added specific check for Spamhaus drop lists so that retrieval is
        never attempted before 2 hours elapses between attempts whether those
        retrieval attempts are successful or not

         Improvements to SSHD regexes

        Modified mod_security logging to include the last triggered rule id if
        present

6.33  - Modified LF_PERMBLOCK to perform IP lookup on blocked IP

        Perform modprobe when using FASTSTART on server boot to ensure
        iptables modules are loaded

        Modified migration detection for particularly old csf installations

        Check that TAIL and GREP exist and are executable in UI

6.32  - Applied UI changes to inbuilt cse and Reseller UI's

        Improvements to Virtuozzo/OpenVZ system detection where
        /proc/vz/veinfo does not exist

        Added System Check on cPanel servers for disable-security-tokens

        If /etc/csuibuttondisable exists then the UI buttons will revert for
        those that cannot cope with the themed ones

6.31  - Fixed "Deny Server IPs" option in UI

        Additional SSHD regex

        Enable account tracking for LF_CPANEL login failures to allow for
        LF_DISTATTACK detection

        Ignore Server Check for register_globals for PHP v5.4+

        Added new option UI_SSL_VERSION, to allow the setting of the SSL
        protocol version that the UI server allows

        Added window Detach option to UI search system logs

        UI display changes

        Fixed files permissions issue affecting System Graphs and lfd Graphs
        in DA

6.30  - Prevent HTML rendering of watch and search system log file output

6.29  - Removed CLUSTER_PORT from sanity checking

        Modified changelog to state that HTACCESS_LOG needs to be correct for
        nginx LF_HTACCESS regexes

        Added new UI option to watch (tail) system log files listed in
        /etc/csf/csf.syslogs

        Added new UI option to search (grep) system log files listed in
        /etc/csf/csf.syslogs

        Improvements to "View iptables Log" output in UI

        Enable "SSL_honor_cipher_order" for UI IO::Socket::SSL sessions

6.28  - Fixed sanity check for UID_INTERVAL

6.27  - Modified Apache regexes for Apache v2.4+

        Fixed UI configurable lines display for lfd.log

        Fixed length display text for CLUSTER_KEY in csf.conf

        Ignore suspendedpage.cgi triggers for LF_SYMLINK on cPanel servers

        Updated sanity checks and ranges for csf.conf settings

        Added RESTRICT_UI to Server Check recommended options

        Modified Virtuozzo/OpenVZ FTP port check to verify kernel version
        before issuing PASV port warning

        Added new setting PS_DIVERSITY. To specify how many different ports
        qualifies as a Port Scan you can increase this value. The risk in
        doing so will mean that persistent attempts to attack a specific
        closed port will not be detected and blocked. The setting defaults to
        the original setting of 1

        Added 3 LF_HTACCESS regexes for nginx. Remember to set HTACCESS_LOG
        correctly for the location of the nginx error log

6.26  - Fixed UI issue with some settings sent via the Cluster Config option

        Modified CONNLIMIT_LOGGING rule insertion point

        Added new feature: Outgoing UDP Flood Protection. This option limits
        outbound UDP packet floods. These typically originate from exploit
        scripts uploaded through vulnerable web scripts. The feature is
        controlled by: UDPFLOOD, UDPFLOOD_LIMIT, UDPFLOOD_BURST,
        UDPFLOOD_LOGGING, UDPFLOOD_ALLOWUSER

        Update the TOR URL in existing /etc/csf/csf.blocklists file if still
        set to the old URL

6.25  - Fixed UI "Temporary IP entries > Flush all temporary IP entries"

        Fixed UI_USER and UI_PASS being emptied on saving the firewall
        configuration through the UI

        Fixed CLUSTER_KEY not displaying when RESTRICT_UI is disabled

6.24  - Security - Removed items from Cluster Config UI option if RESTRICT_UI
        enabled

6.23  - Security - added new option RESTRICT_UI. This options restricts the
        ability to modify settings within csf.conf from the csf UI. Should
        the parent control panel be compromised, these restricted options
        could be used to further compromise the server. This option is enabled
        by default on all installations

        Added entries to csf.pignore on new installations on cPanel servers
        for Dovecot v2.2 (cPanel v11.40+)

        Fixed UI Template validation error message

6.22  - Security Fix - Sanitised user data input to prevent running
        unauthorised commands via the UI. A user would require root access to
        exploit this, so vulnerability is probably low. Thanks to Steven at
        Rack911.com for reporting this issue

        Added Password ENV variable check to Server Check on cPanel servers

        Update cPanel ACL Driver installations to change force cache update
        using "touch" instead of removing the cache

        Modified TOR URL in /etc/csf/csf.blocklists to use:
        http://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1

6.21  - Modified auto-update logic to only create the /etc/cron.d/csf_update
        file if it does not already exist

        Fix permissions on csf man file and directory

        Modified webmin module paths to be relative rather than absolute so
        that webmin via mod_proxy works correctly

        Fixed "in" direction --tempallow/--tempdeny leaking into [comment]

        Added nginx regex for ModSecurity rule detection. Remember to set
        MODSEC_LOG correctly for the location of the nginx error log

        Fixed file permission/ownership problem on DirectAdmin servers for the
        /plugins directory

6.20  - Introduced a new directory structure to get closer to the Linux
        Filesystem Hierarchy Standard (FHS):
        /etc/csf/           - (mostly) configuration files 
        /var/lib/csf/       - temporary data files
        /usr/local/csf/bin/ - scripts
        /usr/local/csf/lib/ - perl modules and static data
        /usr/local/csf/tpl/ - email alert templates
        Existing data and templates files are migrated into the new structure
        automatically. Some files and directories are symlinked to /etc/csf/
        for backwards compatibility and ease of use. See the following for
        individual file locations in the new configuration:
        https://web.archive.org/web/20250801022207/http://blog.configserver.com/?p=7

        CC_LOOKUPS rDNS reporting improvements

        HTTP::Tiny upgraded to v0.033

        Removed Security Token check from Server Check Report now that it is
        implicitly set in v11.18.0+

        Switched the location of the csf.pl and lfd.pl binaries with their
        symlinks

        Code tidy for servercheck.pm, csfui.pl

        Allow comments to be appended to csf --tempdeny and csf --tempallow in
        the same way as csf --deny and csf --allow. Also made the options more
        flexible in usage of optional elements

        Added Comments field to UI for Quick Allow, Quick Deny, and Temporary
        Allow/Deny

        Added csf(1) man page and changed csf --help to use a text version of
        the new man page

        Fixed unnecessary open of csf.fignore

6.15  - Modified MaxMind City Database lookup code to be more resilent

6.14  - Added support for cPanel v11.38.1+ AppConfig addon registration

        NOTE: In accordance with the new conventions for v11.38.1+ AppConfig
        the url to the csf WHM plugin will change from /cgi/addon_csf.cgi to
        /cgi/configserver/csf.cgi. This will only happen with csf v6.14+ and
        cPanel v11.38.1+. Older version of csf will continue to use the old
        URL. This has no particular relevance to users accessing through WHM,
        but will affect direct URL access by users or third party
        applications

        Added support for cPanel v11.38.1+ Custom ACL driver. This creates an
        ACL (software-ConfigServer-csf) which must be used to grant resellers
        access via "WHM > Edit Reseller Nameservers and Privileges > Third
        Party Services > ConfigServer Security & Firewall (Reseller UI)" when
        running cPanel v11.38.1+

        Added Server Check for AppConfig restrictions for cPanel v11.38.1+

        Switched from using Geo::IP::PurePerl to Geo::IP perl module

        Added MaxMind GeoIP Anonymous Proxies to csf.blocklists for new
        installs

        Added new setting CSFDATADIR. This is the location of the csf and lfd
        temporary data. By default it is set to the current value of /etc/csf
        with the intention of moving this data to /var/lib/csf in the future
        in a move towards the Linux Filesystem Hierarchy Standard (FHS)

        Moved the default location for ST_DISKW_DD to /var/lib/dd_test for new
        installations

6.13  - Fixed Server Check for dhclient

6.12  - Added iptables UID logging for dropped outgoing packets

        New feature - DROP_OUT_LOGGING. Enables iptables logging of dropped
        outgoing connections. Where available, these logs will also include
        the UID connecting out which can help track abuse. Note: Only outgoing
        SYN packets for TCP connections are logged. The option is not enabled
        by default, but we recommend that it is enabled

        Option DROP_ONLYRES now only applies to incoming port connections

        New feature - User ID Tracking. This feature tracks UID blocks logged
        by iptables to syslog. If a UID generates a port block that is logged
        more than UID_LIMIT times within UID_INTERVAL seconds, an alert will
        be sent. Requires DROP_OUT_LOGGING to be enabled

        Modified Port Scan Tracking regexes to ensure only incoming
        connections are tracked

        Added Server Check for dhclient running

        Added Server Check on cPanel servers for antirelayd

        Added Server Check for a swap file (don't bother on Virtuozo)

        Added Server Check for xinetd, qpidd, portreserve and rpcbind in
        Services Check since most people won't use them

6.11  - Fixed SMTP_ALLOWLOCAL not functioning correctly. Added IPv6 support
        for SMTP_ALLOWLOCAL

        Removed SMTP_BLOCK restriction for IPv6 requiring port 25 to be
        present in TCP6_OUT

6.10  - New feature - separate Blocklist configuration file to allow for
        expansion of the available block lists. The following options have
        been removed from csf.conf and a new csf.blocklists file added to
        configure blocklists:
        LF_DSHIELD, LF_SPAMHAUS, LF_TOR, LF_BOGON

        During the upgrade if those options were enabled, then they will be
        enabled in the new csf.blocklists file. If you used a custom blocklist
        URL in one of those options you will have to manually add it to the
        new configuration.

        Modified UI to provide edit function for csf.blocklists

6.09  - Modified csf UI to detect Webmin install and symlink script and images
        directory so as to no longer require Webmin module update on a new csf
        version

        Tidied up csf UI html

        Fixed System Statistics graph display when using Webmin

        Modified Server Security check to only perform GENERIC test when using
        Webmin to prevent hanging processes

        Added CLI options --car, --carm. This removes an allowed IP in a
        Cluster and removes it from /etc/csf.allow

        Added new options LF_WEBMIN, LF_WEBMIN_PERM. This feature adds login
        failure detection for Webmin in WEBMIN_LOG

        Added new option LF_WEBMIN_EMAIL_ALERT. This feature sends an email
        if a successful login to Webmin is detected in WEBMIN_LOG

        Modified LF_SCRIPT_ALERT text in csf.conf for cPanel servers

        Modified proftpd regex to cope with non-standard format and to remove
        trailing colons from account name

        Modified LF_SCRIPT_ALERT regex to cater for paths containing spaces

        Improvements to LF_SCRIPT_ALERT memory usage and possible script
        detection

        Added alternative LF_SCRIPT_ALERT regex for specific 1H.com exim
        logging ACL

6.08  - Added IPV6_SPI workaround for CentOS/RedHat v5 and custom kernels that
        do not support IPv6 connection tracking by opening ephemeral port
        range 32768:61000. This is only applied if IPV6_SPI is not enabled.
        This is the same workaround implemented by RedHat in their sample
        default IPv6 rules

6.07  - Fixed issue with processing /proc/PID/stat for process information

6.06  - Prevent csf/lfd from failing to run if a non-critical configuration
        file does not exist

        In webmin, force table stylesheet to override webmin css. Requires
        webmin module reinstall on existing installations

6.05  - Improvements to minimal perl module detection on new installs

        Bugfix for default lfd.pl perl shebang

6.04  - Implement slurp routine for configuration files to cater for incorrect
        linefeeds

        Ignore leading and trailing spaces from lines in configuration files

        Fixed Include statements in csf.ignore not implemented in lfd

        Additional debug logging for RT_*_LIMIT added

        Replaced call to Time::HiRes::sleep with standard sleep

        Additional dovecot entries in csf.pignore for new installations

6.03  - Switched from using LWP to HTTP::Tiny to reduce memory footprint and
        reliance on the LWP perl module. The HTTP::Tiny module is included in
        the distribution, so no further action is necessary

        Modified lfd perl module loading to be conditional where possible to
        reduce lfd memory footprint

        Modify initial file processing to reduce lfd memory footprint

        Modify PS_PORTS processing to reduce lfd memory footprint

        Moved init of Geo::IP::PurePerl into iplookup subroutine

        Removed "DEFERRED" login failure checking from CPANEL_LOG regex due to
        false-positives

        Modify LF_DIRWATCH_DISABLE so that only files are added to
        suspicious.tar and removed. Suspicious directories will no longer be
        removed

        Removed File::Path - no longer required

6.02  - Modify MESSENGER HTML header to return code 403 instead of 200

        Modify UI daemon to fallback to IPv4 if IPV6 setting is not enabled

        Added new options LF_SYMLINK and LF_SYMLINK_PERM. This feature enables
        detection of repeated Apache symlink race condition triggers from the
        Apache patch provided by:
        http://www.mail-archive.com/dev@httpd.apache.org/msg55666.html
        This patch has also been included by cPanel via the easyapache option:
        "Symlink Race Condition Protection"

6.01  - Ensure all binaries are called with their full paths for the scheduled
        Server Security Check reports

        Allow csf -u/-uf/--update and -c/--check when csf is disabled

        Make RT_* checks IPv6 compatible

        Added dns query caching for ip lookups during lfd process lifetime

        Modify TOR rule loading to use FASTSTART in lfd if enabled

        Added iptables locking to FASTSTART code

        LF_INTERVAL now defaults to 3600 on new installations to better cope
        with slow brute force login attempts

        Removed references to .cpanel.net being ignored from the changelog as
        they no longer apply and could cause confusion

        Fix csf.rignore loader regex causing unnecessary DNS lookups if file
        has no entries

        Added "DEFERRED" login failure checking to CPANEL_LOG regex

6.00  - Major new option - FASTSTART:

        This option uses IPTABLES_SAVE, IPTABLES_RESTORE and IP6TABLES_SAVE,
        IP6TABLES_RESTORE in two ways:

        1.  On a clean server reboot the entire csf iptables configuration is
            saved and then restored, where possible, to provide a near instant
            firewall startup[*] during the boot sequence

        2.  On csf restart or lfd reloading tables, CC_* as well as SPAMHAUS,
            DSHIELD, BOGON, TOR are loaded using this method in a fraction of
            the time than if this setting is disabled

        [*] Not supported on all OS platforms

        FASTSTART allows for very quick startup at reboot and during
        uptime. If the Country Code blocking options (CC_*) are used, their
        tables are loaded by csf and lfd almost instantly, compared to many
        minutes for large countries previously

        FASTSTART is enabled on new installations (or those in TESTING
        mode). Existing installations will need to enable it manually

        Other Changes:
        
        Improvements to csf and lfd init routines

        LF_QUICKSTART renamed to LFDSTART, setting value preserved

        Fixed a problem with scheduled Server Security Check reports

        Crypt::CBC upgraded to v2.32

5.79  - Modified csf error routine to store failing error in csf.error and
        display an instructional message

        Check for libkeyutils-1.2.so.2 in LF_EXPLOIT option SSHDSPAM

        Modified the Server Report proxysubdomains check on cPanel servers

        Added new options CC_DENY_PORTS, CC_DENY_PORTS_TCP,
        CC_DENY_PORTS_UDP. This feature denies access from the countries
        listed in CC_DENY_PORTS to listed TCP/UDP ports. For example, using
        this FTP access port 21 could be blocked to only the specified
        countries

5.78  - Due to issues that some are experiencing with the switch from the
        state to the conntrack module a new settings has been added
        USE_CONNTRACK which is disabled by default except on servers running
        kernel 3.7+ where on new installations it will be enabled

5.77  - Add an exception for the useless Virtuozzo kernels iptables
        implementation so that csf uses the deprecated state module instead of
        conntrack

5.76  - Only add the /128 IPv6 bound address per NIC instead of the whole /64
        to the local IPv6 addresses

        Modify SSHD and SU regexes to allow for empty hostname field in log
        file

        Added new option UNBLOCK_REPORT. This option will run an external
        script when a temporary block is unblocked

        Additional entries in csf.logignore on new installations

        Switched from using the iptables state module to using the conntrack
        module in preparation of the formers obsolescence

        Removed LF_EXPLOIT_CHECK and replaced it with LF_EXPLOIT_IGNORE so
        that new tests can be easily added and then ignored desired

        Added new LF_EXPLOIT check SSHDSPAM to check for the existence of
        /lib64/libkeyutils.so.1.9 or /lib/libkeyutils.so.1.9, See:
        http://www.webhostingtalk.com/showthread.php?t=1235797

5.75  - Fixed issue with single quotes appearing in CC lookup names leading to
        lfd IP blocks to fail

5.74  - Additional entries in csf.pignore for the cPanel installation to cater
        for v11.36 processes on new installations

        Added workaround for cPanel /etc/cpupdate.conf check in Server Report
        for changes in v11.36

        Additional entries in csf.logignore on new installations

        Try harder to get a CPU temperature if lm_sensors is installed for
        System Statistics

        Enforce PORTFLOOD setting restrictions and issue warning if entry
        discarded

        Correct location of CC_ALLOWF in LOCALINPUT after update from lfd

        Make CC_[chain] actions more verbose in lfd.log

        Added new options CC_ALLOW_PORTS, CC_ALLOW_PORTS_TCP,
        CC_ALLOW_PORTS_UDP. This feature allows access from the countries
        listed in CC_ALLOW_PORTS to listed TCP/UDP ports. For example, using
        this FTP access port 21 could be restricted to only the specified
        countries

        Moved temporary and csf.allow/csf.deny rules from
        LOCALINPUT/LOCALOUTPUT chains to ALLOWIN/ALLOWOUT to allow for the new
        CC_ALLOW_PORTS feature

        Modified SMTP_PORTS to include ports 465 and 587 on new installations

        Added new option PT_FORKBOMB. Fork Bomb Protection. This option checks
        the number of processes with the same session id and if greater than
        the value set, the whole session tree is terminated and an alert sent

5.73  - Fixed issue with crontab line for TESTING option not being detected
        and removed when TESTING mode is disabled

5.72  - Added missing DD setting in DA and generic installations for ST_DISKW

        Modified IPv6 port settings to reflect IPv4 port settings for new
        installs in csf.conf

        If a deleted executable process is detected and reported then do not
        further report children of the parent (or the parent itself if a child
        triggered the report) if the parent is also a deleted executable
        process

        Parent PID added to PT_DELETED_ACTION parameters

        In the Server Report allow for spaces before Apache directives

        Updated instructions for modifying log_selector for exim
        configurations in readme.txt and Server Report

        Modify DD calculation for ST_DISKW for disks that report in GB/s

        Updated to use the new cPanel 11.36+ integrated perl binary if exists

5.71  - Fixed problem processing dd output for ST_DISKW on some systems

        Fixed dovecot imap login failure regex processing

        Added regexes for dovecot pop3 and imap raw logs (i.e. not syslog)

5.70  - Fixed an issue with PERMBLOCK introduced in v5.68

5.69  - Fixed duplicate entries in csf.conf on GENERIC installations

5.68  - New feature added - LF_DIST_INTERVAL. This option provides a separate
        timing interval for both LF_DISTFTP and LF_DISTSMTP. By default it is
        set to 300 seconds

        Implemented better handling of repeat blocks when an IP is already
        temporarily or permanenetly blocked

        Added missing inclusion of Time::HiRes in csf.pl

        Silence LF_DISTFTP and LF_DISTSMTP ignored IP logging to lfd.log
        unless DEBUG enabled

        Silence DYNDNS IP address updates to lfd.log unless DEBUG enabled

        RELAYHOSTS setting now defaults to "0" to improve security on cPanel
        servers

        Increased default value of DENY_IP_LIMIT to 200

5.67  - Fixed a problem with permanent IP blocking when using LF_SELECT

5.66  - Implemented a new locking system to try to mitigate an iptables bug
        when issuing concurrent iptables commands

        Implement flushing on the lfd pid file so that it is always accurate

        Improvements to csf --grep [ip] to escape regular expression matching

        New feature added - LF_REPEATBLOCK. This option instructs csf to deny
        an already blocked IP address the number of times set. See csf.conf
        for more information

        New feature added - LF_BLOCKINONLY. This option instructs csf to only
        block inbound traffic from those IP's and so reduces the number of
        iptables rules, but at the expense of effectiveness. See csf.conf for
        more information

        New feature added - ST_DISKW. This option adds disk write performance
        statistics to the stats graphs. See csf.conf for more information

        Fixed file location for Debian and derivative OS's for
        /etc/mysql/my.cnf in Server Check

5.65  - Removed some of the command locking as it was causing hangs

5.63  - Implemented a locking and retry system to try to mitigate an iptables
        bug when issuing concurrent iptables commands

5.62  - Added ModSecurity connection dropping to the LF_MODSEC regex

        Added new option - ETH6_DEVICE. By adding a device to this option,
        ip6tables can be configured only on the specified device. Otherwise,
        ETH_DEVICE and then the default setting will be used

        Added new option - LF_SCRIPT_ACTION. On cPanel servers, this can
        contain the path to a script that is run whenever LF_SCRIPT_ALERT is
        triggered

        Fixed stats graph average calculation and display if average equals 0

        Split Slow MySQL Queries stats graphs from MySQL Queries

        Improvements to Apache CPU Usage stats graphs

5.61  - On Debian systems, check for my.cnf in /etc/mysql/my.cnf in Server
        Check

        Add missing/changed images in the DA/Webmin installs. For webmin, the
        csf webmin module will need to be reinstalled

        Another fix for LF_NETBLOCK to skip IPv6 addresses

        Fixed csf --tempallow where -d [direction] was performing inout when
        in requested

        Fixed UI option "Edit the Log Scanner file (csf.logfiles)" which was
        incorrectly overwriting csf.dyndns instead of writing to csf.logfiles

        Changed ETH_DEVICE_SKIP device check from a failure to a warning

        Skip checks for register_globals and suhosin if running PHP v5.4.* in
        Server Check report

5.60  - Added new options to include the Spamhaus Extended DROP list. These
        additional netblocks are included in the main Spamhaus chain. The
        feature uses LF_SPAMHAUS_EXTENDED and LF_SPAMHAUS_EXTENDED_URL which
        are enabled by default, but used only if LF_SPAMHAUS is enabled. To
        force a reload of the SPAMHAUS list to include the Extended list,
        delete /etc/csf/csf.spamhaus file after upgrading to this version and
        then restart lfd

        Added new options to allow blocking of TOR Bulk Exit nodes. This works
        in the same manner as the LF_SPAMHAUS and LF_DSHIELD options. The
        feature uses LF_TOR and LF_TOR_URL and is disabled by default.
        Warning: This could block legitimate users who are trying to protect
        their anonymity, so use with caution

        Fix LF_NETBLOCK to skip IPv6 addresses as it is unsupported as has
        long been stated in csf.conf

        Added missing </pre> html elements in UI

        Added unblock button to UI IP searches when results is either in
        csf.deny or a temporary block

        Implemented a locking system to mitigate iptables stability issues
        when loading concurrent iptables chains in lfd

        Fixed bug in the display of the 30 days ST_SYSTEM stats

        Added new option ST_SYSTEM_MAXDAYS. This allows you to define the
        maximum number of days of stats to collect (default 30 days)

        Increased stats graph sizes

        Added CIDR checking of csf.allow to the CLI command csf --deny

        Added checking of csf.ignore to the CLI command csf --deny

5.59  - Fixed a loop which caused high load when using GLOBAL_IGNORE

        Improvements to GLOBAL_IGNORE load speed and effectiveness

        Improvements to CC_IGNORE load speed

5.58  - Corrected ST_APACHE error message return text

        Add meaningful message if stats graph generation fails in UI

        Added new icon in UI for "Quick Allow" that inserts the current
        visitors IP address

        Added new icon in UI for "Quick Ignore" that inserts the current
        visitors IP address

        Replaced some of the included icons

5.57  - Added new option PT_APACHESTATUS to configure the URL to the Apache
        Status URL during PT_LOAD alert report

        Added Apache Statistics to ST_SYSTEM. A new option ST_APACHE must be
        set to collect these statistics and PT_APACHESTATUS must be correctly
        set. ST_APACHE is disabled by default

        Modification to SYSLOG option to remove the later introduced "nofatal"
        option to improve backwards compatibility, also enable the "pid"
        option to log the process ID

        Added new options SYSLOG_CHECK and SYSLOG_LOG to check whether syslog
        is running. See csf.conf for more information. This option is disabled
        by default, but we recommend that it is enabled on all servers

        Added SYSLOG_CHECK to Server Check Report recommended settings

5.56  - Improvements to ST_MYSQL password detection in /root/.my.cnf where the
        password is quoted

        Improvements to the SMTP AUTH regex to cope with differing settings in
        exim log_selector

        Removed debugging code in SMTP AUTH regex detection

5.55  - Update Fedora version check now that v17 has been released

        Added MySQL Connection and Thread statistics to ST_MYSQL/ST_SYSTEM

        Modified Server Check Report for cPanel servers see whether mod_ruid2
        has been enabled making the Apache suEXEC check moot

        Improvements to the SMTP AUTH regex to cope with differing settings in
        exim log_selector

5.54  - Modified ST_MYSQL connection errors to advise disabling ST_MYSQL if it
        is not used

        ST_MYSQL now disabled by default on new csf installations

5.53  - Added Email Usage to the ST_SYSTEM System Statistics feature when RT_*
        options are enabled

        Fixed incorrect Min/Max calculations in System Statistics

        Improvements to Disk Usage stats in System Statistics for some virtual
        environments

        Added CPU Temperature to the ST_SYSTEM System Statistics feature when
        lm-sensors/coretemp installed and enabled (highest core temp recorded)

        Added MySQL graphs to the ST_SYSTEM System Statistics feature when
        ST_MYSQL is installed and enabled - requires DBI and DBD::mysql perl
        modules. Authentication is via new ST_MYSQL* options. The option is
        enabled on cPanel servers by default, disabled on others

        Modified stats collection routine to append data to the stats file on
        each minute interval and to clean up only on lfd startup. This is to
        help minimise the risk of the stats file being incomplete due to
        process termination

        Added new options LF_DISTSMTP, LF_DISTSMTP_UNIQ and LF_DISTSMTP_PERM.
        This option will keep track of successful SMTP logins. If the number
        of successful logins to an individual account is at least LF_DISTSMTP
        in LF_INTERVAL from at least LF_DISTSMTP_UNIQ IP addresses, then all
        of the IP addresses will be blocked. This option can help mitigate the
        common SMTP account compromise attacks that use a distributed network
        of zombies to send spam (exim MTA only). Not enabled by default

        Modified Server Check Report for cPanel servers see whether mod_ruid2
        has been enabled making the PHP Handler check moot

        Modified the ModSecurity regex to cater for the paid Atomic rules
        Apache error log non-standard format

        Modified non-cPanel new installs to disable ST_SYSTEM by default

5.52  - Alternative kill and status methods employed for lfd init process on
        Debian/Ubuntu

        Added new feature: System Statistics. This option will gather basic
        system statstics. Through the UI it displays various graphs for disk,
        cpu, memory, network, etc usage. The feature requires the perl module
        GD::Graph. It is enabled by default with the ST_SYSTEM option

5.51  - Updated Donation buttons

5.50  - Removed check for Melange on cPanel servers from Server Check Report

        Improvements to the cPanel exim SMTP AUTH login failure regex after
        changes in cPanel v11.32

        Added exe:/usr/local/cpanel/3rdparty/sbin/mydns to csf.pignore for new
        installs on cPanel servers

        Additional cmd/pcmd suggestions added to csf.pignore for new installs
        on cPanel servers (not enabled)

5.49  - Remove atd from Service Check in Server Check Report

        Ensure all DNS traffic between non-local IP addresses in
        /etc/resolv.conf is allowed through the firewall when DNS_STRICT_NS is
        not enabled

        Added exim to example script pt_deleted_action.pl

        Added /var/log/cxswatch.log to csf.logfiles for new installations

        Added new option LF_ALERT_SMTP which allows lfd to be configured to
        send alert emails via SMTP instead of through the SENDMAIL binary.
        LF_ALERT_SMTP needs to be set to the name or IP address of the SMTP
        server to use this feature

        Added new option CC_DROP_CIDR. Set this option to a valid CIDR to
        ignore CIDR blocks smaller than this value when implementing
        CC_DENY/CC_ALLOW/CC_ALLOW_FILTER. This can help reduce the number of
        CC entries and may improve iptables throughput

        Improved installation procedure for checking required perl modules

5.48  - New option LF_QOS added which matches hits against the mod_qos Apache
        module

        New option LF_CXS added which matches hits against the mod_security
        Apache module rule for cxs if implemented

5.47  - Improvements to non-core perl module loading

        Improvements to PT_LOAD Apache Status retrieval and messages

        Regex modifications to cater for Dovecot v2.1+

        On cPanel servers, block additional ports that exim uses in the WHM >
        Service Manager for RT_*_BLOCK

5.46  - Modified upgrade warning for integrated UI to not use the DA warning
        text

        Validate local IP addresses

        Only check local IPv6 addresses if IPV6 is enabled in config

        Separate IPv4 from IPv6 ignore CIDRs due to Net::CIDR::Lite
        restrictions

        Improvements to ignore files IP address validation

        Add server check for PHP v5.2.* to the obsolete/security risk list

        Add server check for RedHat/CentOS v4.* and Fedora < v15 to the
        obsolete/security risk list

        Removed server checks for RLimitMEM/RLimitCPU

5.45  - Only log Log Scanner in lfd.log if DEBUG set to 2 to allow empty
        reports if monitoring lfd.log

        Added new option LF_BOGON_SKIP. If you don't want BOGON rules applied
        to specific NICs, then list them in a comma separated list

        Added new option LF_CONSOLE_EMAIL_ALERT which will send an email if
        there is a root login to the server console. This is enabled by
        default

5.44  - New feature - Log Scanner. This feature will send out an email summary
        of the log lines of each log listed in /etc/csf/csf.logfiles. All
        lines will be reported unless they match a regular expression in
        /etc/csf/csf.logignore

         Set LWP::UserAgent agent to "csf/[version]" instead of the default

5.43  - csf and lfd modified to better handle !lo interface for compatibility
        with newer iptables versions

        Removed use of Sys::Hostname::Long

        Added new options LF_APACHE_403 and LF_APACHE_403_PERM. This option
        will keep track of the number of "client denied by server
        configuration" errors in HTACCESS_LOG. If the number of hits is more
        than LF_APACHE_403 in LF_INTERVAL seconds then the IP address will be
        blocked. See csf.conf for more information

5.42  - SECURITY FIX. Anyone running csf on a DirectAdmin server should
        upgrade to this release immediately:

        Add check for successful open of admin.list on DA servers to avoid
        a segfault, which could lead to a buffer overflow

5.41  - Added text description of allow/deny made by cPanel Resellers via UI
        in csf.allow and csf.deny

        If cPanel UI Resellers email alerts are enabled, a csf grep will be
        performed before an IP adress is unblocked and the output included in
        the alert email, together with the results of the UNBLOCK

        If cPanel UI Resellers email alerts are enabled, the results of an
        ALLOW or DENY will be included in the alert email

        Added logging of cPanel UI Reseller actions ALLOW/DENY/UNBLOCK to
        /var/log/lfd.log

        Update to urlget to not fail on empty file if successfully retrieved

        Take Integrated UI out of BETA as no reported issues

        Take csf.redirect out of BETA as no reported issues

5.40  - Added new feature - csf UI Reseller functions for cPanel. See
        /etc/csf/csf.resellers and WHM UI
     
        Improvements to cse Integrated UI

        Modified redundant cPanel function calls in UI

        Removed ModSecurity functionality in UI

        Modified WHM UI "Remove Deny" to be "Quick Unblock" that now removes
        a specified IP address entries from csf.deny and/or temporary blocks

5.39  - Fixed detection of the nat tables on some Virtuozzo VPS servers

5.38  - Modification to the Integrated UI to allow access to cxs if it is
        installed via UI_CXS

        Include an updated cse with csf for use with the Integrated UI via
        UI_CSE

        Added option UI_CIPHER to allow the SSL cipher suite to be set
        manually for the Integrated UI

        Added HTTP request internal memory limits to the Integrated UI

5.37  - Added new BETA feature - User Interface. This feature provides a HTML
        UI to csf and lfd, without requiring a control panel or web server.
        The UI runs as a sub process to the lfd daemon. See csf.conf and
        readme.txt for information and requirements

        Fixed issue with RT_* regex routine ignoring 127.0.0.1

        Fixed detection of DNSONLY cPanel installs

        Added Security Check on cPanel server checks for disabled "Proxy
        subdomains" and "Proxy subdomain creation"

        Added new option LF_CPANEL_ALERT_ACTION. If a LF_CPANEL_ALERT event is
        triggered, then if LF_CPANEL_ALERT_ACTION contains the path to a
        script, it will run the script and passed the ip and username and the
        DNS IP lookup result as 3 arguments

5.36  - Fix for the lfd child lock mechanism effectiveness

5.35  - Added new BETA feature - Port/IP address Redirection. This feature
        uses the file /etc/csf/csf.redirect to redirect connections from/to
        IP/port combinations to alternative IP/ports. See readme.txt for more
        information

        Updated syslog daemon checking in Server Report

        Set PT_DELETED to 0 by default on new installations

        Improvements to csf startup locking within lfd

        Improvements to error trapping between csf and lfd

        Check minimum values for interval settings and set to recommended
        values if too low during lfd startup to improve stability

        Added lfd child locks to improve stability due too server or network
        resource issues or too low an interval setting

        Updated Sanity Checks for settings

        lfd will now not start if TESTING is enabled

        Do not require write permissions to /etc/crontab when no changes
        required for TESTING mode enable/disable

        Prevent parricide by lfd children unless required

        Added nat table check in csf

        Fixed bug in csf --grep not matching the nat table

5.34  - Improvement to dovecot account name sanitisation checks in lfd

        Modified cronjobs for new installs to be compatible with anacron

        Added new option CLUSTER_BLOCK which is enabled by default. This
        allows you to disable automatic sharing of lfd blocks around a csf
        cluster, e.g. if you only wish to use the CLUSTER option to share
        settings and manual blocks and allows

        Added new option RT_ACTION. If an RT_* event is triggered,
        then if RT_ACTION contains the path to a script, it will be run in a
        child process and be passed a list of items (see csf.conf - for cPanel
        and DA only)

        Fix to DYNDNS Advanced Allow/Deny Filters using pipe separator

        Set permissions to 700 on *.sh, *.pl and *.php in /etc/csf/ instead of
        a blanket 600 of non-csf scripts

5.33  - Add link to the Changelog when csf is upgraded

        Extended urlget timeout to 300 seconds to help cope with the large
        MaxMind City Database download where enabled

        Include cpdavd login failures for LF_CPANEL. Added port 2077 and 2078
        to the cPanel block ports when LF_SELECT enabled

        Disable ftp Server Check reports if ftp server disabled in cPanel
        
        Added regex validation to any specified csf.pignore or csf.figonre
        entries to lfd

        Updated cPanel tier checks to cope with old STABLE and DNSONLY
        releases and newer v11.30+

        Improvement to account name sanitisation checks in lfd

5.32  - AUTO_UPDATES enabled for new installations in csf.conf

        Removed the JS LF_EXPLOIT_CHECK as it is no longer prevalent. If still
        set in csf.conf it will be ignored

        Check MESSENGER service to ensure privileges are dropped before
        starting the daemon

        Drop privileges when performing removal during LF_DIRWATCH_DISABLE

        For new installations, IPV6 enabled if IP6TABLES exists and an IPv6
        address is found in the output from IFCONFIG. IPV6_SPI is set
        according to the kernel version (i.e. whether SPI is supported or not)

5.31  - Updated the LF_TRIGGER_PERM explaination in csf.conf to properly
        reflect the possible settings of LF_TRIGGER

        Perform account name sanitisation checks in lfd

5.30  - Fixed a SECURITY BUG that can be exploited remotely via log file
        spoofing resulting in root privilege escalation. Our thanks to Jeff
        Petersen for reporting this issue

        All csf users should upgrade to this release immediately

5.22  - New feature: Connection Limit Protection (CONNLIMIT,
        CONNLIMIT_LOGGING). This option configures iptables to offer more
        protection from DOS attacks against specific ports. It can also be
        used as a way to simply limit resource usage by IP address to specific
        server services. This option limits the number of concurrent new
        connections per IP address that can be made to specific ports. See
        csf.conf and readme.txt for more information and about the format of
        the CONNLIMIT option and its limitations

        Minor csf UI Firewall Configuration virtual pagination improvements

        Updated cPanel Server Check update settings for v11.30+

        Removed cPanel Server Check for new versions due to changes in the
        v11.30+ versioning system making this redundant

        Updated MySQL Server Check for v5.1.*

        Added a warning to csf.conf for SYNFLOOD to only enable the option if
        you know you are under a SYN flood attack as it will restrict all new
        connection to the server if triggered

5.21  - Added port 500 to DROP_NOLOG for new installations

        Corrected the LF_APACHE_404 lfd log line output

        Added startup failure on invalid PORTFLOOD settings

        Make csf.pignore item selector case-insensitive (e.g. exe: and EXE:)

        All user: item selector examples removed from the default csf.pignore
        for all new installations (e.g. user:mailman). csf.pignore examples
        for some common processes can be found here:
        https://web.archive.org/web/20201202095726/http://forum.configserver.com/viewtopic.php?f=6&t=2059

        Updated DA and GENERIC default csf.pignore files for new installations

        csf UI Firewall Configuration virtual pagination improvements

        Updated Sanity checks for settings in csf.conf

        Modified Sanity checks for settings in csf.conf to always show the
        recommended range in the UI

        Set LF_GLOBAL to 0 instead of an empty string by default on new
        installations

        Added new option LF_LOOKUPS to toggle rDNS IP address lookups

5.20  - Updated installation scripts to distinguish between IPv4 and IPv6 port
        report

        Modified Virtuozzo VPS numiptent check to distinguish between host and
        client servers

        Added exe:/usr/sbin/ntpd to csf.pignore on new installations

        Don't perform the runlevel check on Debian/Ubuntu servers as it isn't
        indicative of a potential security issue as with other Linux distros

        Added new option PT_DELETED_ACTION which if defined with an executable
        script will run if PT_DELETED is triggered passing the process PID,
        executable and account. An example script is provided in:
        /etc/csf/pt_deleted_action.pl

        If CC_LOOKUPS enable for the MaxMind City Database then also display
        the Region, where available

        Added csf UI Firewall Configuration virtual pagination

        Rearranged csf.conf for csf UI Firewall Configuration virtual
        pagination

        Re-instated sanity check highlights in csf UI Firewall Configuration

        Improved Server Check recursion checking in included configuration
        files

        Added new options LF_APACHE_404 and LF_APACHE_404_PERM. This option
        will keep track of the number of "File does not exist" errors in
        HTACCESS_LOG. If the number of hits is more than LF_APACHE_404 in
        LF_INTERVAL seconds then the IP address will be blocked. See csf.conf
        for more information

5.19  - Added stats workaround for February/March calculations

        Added new option CC_IGNORE - this Country Code list will prevent lfd
        from blocking IP address hits for the listed CC's

        Reduced CC_* memory usage when loading zones

        Modified lfd logging for regex.pm and regex.custom.pm login failures
        to lfd.log to use the return reason from the regex match instead of a
        generic message. This does mean that the format for these messages has
        changed

        DA Server Check for proftpd - check whether pureftp=1 in DA config

        Replaced IP::Country and Geography::Countries with Geo::IP::PurePerl
        using the MaxMind GeoLite Country database for CC_LOOKUPS

        Added new option GUNZIP which is required to expand the MaxMind
        GeoLite Country database

        Extended CC_LOOKUPS which can now be configured to report Country Code
        and Country and City using the MaxMind City Database. See csf.conf for
        more information

        Added Donation buttons to csf UI main page

5.18  - Remove RT_POPRELAY_* from csf.conf on DA servers as it does not apply

        Improved Server Check for cPanel Update configuration check
     
        Modifed csf restart to not start bandmin during the stop phase

        Modified LF_DIRWATCH to remove dependency on File::Type

        Modified LF_DIRWATCH for speedups and removed the need for a file size
        limit

        Debian v6 support confirmed

        Added /etc/bind/named.conf.options to the list of named.conf files to
        check for recursion settings (for Debian)

5.17  - Updated Server Check for cPanel Update configuration check to cater
        for the new format

        Disable LFD service in DA on uninstall of csf using SED instead of
        REPLACE

5.16  - Fixed missing perm.png from DA install

        Fixed Temporary IP Entries table headers in UI

        If DENY_IP_LIMIT is reached, remove excess IPs from iptables as well
        as csf.deny (previously only removed from csf.deny)

        csf on cPanel servers automatically re-enables the cPanel Bandwith
        chains after iptables is configured. If bandmin is not functioning, or
        you don't use the bandmin stats you can disable this new option
        LF_CPANEL_BANDMIN (enabled by default on cPanel servers)

5.15  - Check for multiple Ports settings for sshd in /etc/ssh/sshd_config
        when the LF_SELECT option is enabled

        Updated SMTPAUTH regex to detect more login authentication methods

        Updated AUTHRELAY regex to detect more login authentication methods

        Added option to UI to permanently block temporarily blocked IP's

5.14  - Updated RELAY regex to detect the dovecot/courier login authentication
        methods on cPanel servers

        Updated Server Check Report to reflect cPanel/WHM changes in v11.28,
        including additional checks and updating reference text

        Added checks to LF_DIRWATCH_FILE to ensure watched resources exist on
        startup and while running a check. Those that do not exist are ignored
        and logged in lfd.log

5.13  - Added obsolete OS checks for Fedora v11 and v12, plus RedHat/CentOS v2
        and v3 in Server Check

        Fixed broken reference URL's in Server Check for cPanel servers

        Modified statistics to not display pie chart if no data is available

        Sort LF_DIRWATCHFILE output by time to improve the reported results

        Added new setting for AT_ALERT to only trigger on modification to the
        root account (i.e. not all superuser accounts)

        Tested successfully for support on Fedora v14 and Ubuntu v10.10

5.12  - Added some lfd blocking statistics which can be viewed via the UI.
        Requires gd graphics library and the GD::Graph perl module with all
        dependent modules

        Added 8th argument to BLOCK_REPORT for the setting that triggered the
        block

        Added setting that triggered a block to lfd log lines

5.11  - Removed erroneous Port Knocking messages in lfd.log when
        PORTKNOCKING_ALERT not enabled

        Added 'exe:/usr/bin/postgres' to the cPanel csf.pignore for new
        installations

        Added retry timeout in WHM UI for checking configserver.dev for
        new version information (to avoid repeated hangs when unreachable)

        Fixed LF_PERMBLOCK issue that flushed all temporary IP blocks, not
        just the IP being permanently blocked

        Added check to PHP Server Check that php -i output is complete

5.10  - Always report UID:GID of a DIRWATCH file incase the user account
        owning a reported file no longer exists

        Report error gracefully on CIDR->add failures and continue

        Added "query (cache)" check to BIND flooding regex

        Fix issue with killing Advanced Port blocks using the pipe separator

        Update warning messages to include xt_owner with ipt_owner

        Replace URL in Server Check for instructions on disabling IPv6

        Fixed a bug in LF_CPANEL_ALERT ip address tracking

        Added new option LF_CPANEL_ALERT_USERS to be used with LF_CPANEL_ALERT
        to alert for a specified list of WHM/cPanel account logins. See
        csf.conf for more information

        Added new feature: Port Knocking. See csf.conf and readme.txt for more
        information on the PORTKNOCKING, PORTKNOCKING_LOG and
        PORTKNOCKING_ALERT options

        Added new UI option: Quick Ignore, for IP addresses

5.09  - Added Server Check report check that klogd is running if using syslogd
        or that klog module is loaded if running rsyslogd

        Added Server Check report, checks for apache settings: TraceEnable,
        ServerSignature, ServerTokens and FileETag on cPanel servers

        Fixed ip6tables IPV6_SPI check warning for older kernels

        Added instruction to open outgoing TCP6 and UDP6 ports when using an
        older kernel for ip6tables

        IPv6 Final (no longer Beta)

        Added new option LT_SKIPPERMBLOCK. If LF_PERMBLOCK is enabled but you
        do not want this to apply to LT_POP3D/LT_IMAPD, then enable this
        option

        Added new option PT_USER_ACTION. If a PT_* event is triggered, then
        PT_USER_ACTION will be run in a child process and passed the PID(s) of
        the process(es)

5.08  - New option CLUSTER_MASTER which is the IP of the master node in a
        cluster allowed to send CLUSTER_CONFIG changes. This must be set in
        order to use CLUSTER_CONFIG options

        Added new Cluster CLI option --cfile (-cf) for sending a file to
        cluster members. The file will only be uploaded to the /etc/csf/
        directory

        Added new Cluster CLI option --crestart (-crs) to initiate a restart
        of csf and lfd on all cluster members

        Removed CLI option -ccr, --cconfigr [name] [value] in favour of the
        new --crs, --crestart option

        Modified regular expressions to cater for RFC3339 date format in log
        files. For example, RFC3339 date format used by default in rsyslog on
        CentOS v5.5

5.07  - Fixed bug introduced in v5.04 that ommitted two outgoing DNS lookup
        rules that could affect servers where iptables connection tracking
        isn't working correctly

5.06  - Increased PT_USERMEM default to 200 from 100 for new installations

        Fixed bug introduced in 5.04 when checking the GLOBAL_ALLOW list for
        report generation in lfd which caused lfd to fail in Net::CIDR::Lite

5.05  - Updated the Server Check report IPv6 text

        Fixed ip6tables command execution in iptables firewall during startup

5.04  - Added BETA IPv6 support. See csf.conf for more information on the new
        settings: IPV6 IP6TABLES IPV6_ICMP_STRICT IPV6_SPI TCP6_IN TCP6_OUT
        UDP6_IN UDP6_OUT

        New CLI option csf --status6 (csf -l6) added to list ip6tables rules

        Changed temporary DENY and ACCEPT working file formats to use a
        different record separator to cater for future IPv6 support

        Advanced Allow/Deny Filters now use | as the separator character to
        cope with IPv6 addresses. Legacy support remains for the old :
        separator for IPv4 addresses, though these should also now use | as
        the field separator

        In Server Check report, don't issue IPv6 warning if only ::1/128 is 
        bound to a NIC (i.e. loopback)

        Upgraded Net::CIDR::Lite to v0.21

        Upgraded from IP::Countries to Geography::Countries

5.03  - Added new option LF_DISTATTACK_UNIQ so that you can specify how many
        unique IP addresses are required to trigger LF_DISTATTACK

        Added new options LF_DISTFTP, LF_DISTFTP_UNIQ and LF_DISTFTP_PERM.
        This option will keep track of successful FTP logins. If the number of
        successful logins to an individual account is at least LF_DISTFTP in
        LF_INTERVAL from at least LF_DISTFTP_UNIQ IP addresses, then all of
        the IP addresses will be blocked. This option can help mitigate the
        common FTP account compromise attacks that use a distributed network
        of zombies to deface websites

        Changed DA default configuration of FTPD_LOG to "/var/log/secure"

5.02  - Added new options X_ARF, X_ARF_FROM and X_ARF_TO which allows sending
        X_ARF reports (see http://www.x-arf.org/specification.html). See
        csf.conf for more information

        Added new options SMTP_ALLOWUSER and SMTP_ALLOWGROUP so that users and
        groups that can bypass SMTP_BLOCK can be easily added. These default
        to the original values previously hard-coded

        Modified SMTP_ALLOWLOCAL to use the loopback device (lo) instead of
        127.0.0.1 to cater for multiple loopback devices and allows connection
        to locally configured IPs as well

        Modified lfd code to ignore any 127.0.0.0/8 address not just 127.0.0.1

        Added new option CLUSTER_LOCALADDR to send out cluster requests on an
        IP other than the default IP

        Added lfd check to enforce 0600 permissions on /etc/csf/

5.01  - Added a new 7th argument to BLOCK_REPORT that includes the log lines
        that triggered the block (excludes LF_NETBLOCK and LF_PERMBLOCK)

        Added new CLI option csf --tempallow (csf -ta) which works in exactly
        the same way as csf --tempdeny (csf -td) except it provides a method
        of temporary IP allows for a given duration. csf -t, csf -tf and
        csf -tr now apply to both deny and allow entries

        Allow the use of a duration suffix in csf -ta and csf -td for m, h and
        d (minutes, hours and days). Only one suffix allowed and only integers

        Updated UI entry for adding and removing temporary allows and blocks

        Display temporary block TTL in days hours minutes and seconds

        Added new CLI option csf --watch [ip] (csf -w [ip]) and configuration
        option WATCH_MODE. This new option logs SYN packets from a specified
        source as they traverse the iptables chains. This can be extremely
        useful in tracking where that IP is being DROPed or ACCEPTed by
        iptables. See readme.txt for more information

        Modified csf and lfd init scripts to be LSB-compliant

        Modified BOGON/DSHIELD/SPAMHAUS block list retrieval to only download
        the list if it has not already been retrieved within the configured
        interval. This is to help prevent blacklisting by the list provider
        for repeated downloads after frequent lfd restarts

        Fixed problem with csf -q and csf -sf not restarting the firewall if
        there was a previous startup error

5.00  - lfd Clustering, final release. This new set of options (CLUSTER*) in
        csf.conf allows the configuration of an lfd cluster environment where
        a group of servers can share blocks and, via the CLI, configuration
        option changes, allows and removes. See the readme.txt file for more
        information and details, setup and security implications

        Added new option LF_DISTATTACK. Distributed Account Attack detection.
        This option will keep track of login failures from distributed IPs to
        a specific application account. If the number of failures matches the
        trigger value, ALL of the IP addresses involved in the attack will be
        blocked. This option is currently disabled by default - see csf.conf
        for more information

        Added new option PT_USERKILL_ALERT if you want to disable email alerts
        for PT_USERKILL triggers. This option is enabled by default, i.e.
        alerts are sent

        Added new options LF_QUICKSTART in csf.conf and CLI options -q,
        --startq, -sf, --startf to allow deferral of csf startup to lfd
        instead of waiting for the CLI to perform the work. See the CLI help
        and csf.conf for more information

        Added UI option for "Firewall Quick Restart" which uses csf -q,
        "Firewall Restart" uses csf -sf

        lfd now restarts csf (if stopped and LF_CSF enabled) within the main
        process to enhance the integrity of the firewall

        Multiple login failure regex detection improvements

        Fixed typos in permblock.txt

4.99  - Improved csf locking to enhance the integrity of the firewall

        Log lfd csf deny failures

        New SSHD regex added

        Improved the dovecot regex's

        New Beta option: lfd Clustering. This new set of options (CLUSTER*) in
        csf.conf allows the configuration of an lfd cluster environment where
        a group of servers can share blocks and, via the CLI, configuration
        option changes, allows and removes. See the readme.txt file for more
        information and details, setup and security implications

4.89  - New SSHD regex added

        Added Server Check to check whether SSHD UseDNS is set to "no" - it
        should be disabled

        Added an Important Note to the readme.txt regarding the sshd UseDNS
        setting

        Speedup for LF_DIRWATCH regex matching

4.88  - Fixed URL's in Server Check report for cPanel if Security Tokens are
        enabled in v11.25+

        Added ipv6 explanation that the information is determined from the
        output from ifconfig and display ipv6 addresses found

        Added the ability to use Include statements in csf.deny and csf.allow,
        see readme.txt for information and restrictions

4.87  - Ignore csf.rignore for LT_POP3D and LT_IMAPD

        Removed unnecessary csf.locks during some GLOBAL list updates

        Updated Copyright notice

        Modified the block message for LF_MODSEC and LF_SUHOSIN to be more
        appropriate (i.e. not "login failures")

        Added new block options for BIND denied requests: LF_BIND,
        LF_BIND_PERM, BIND_LOG. This works in the same way as the other
        similar blocks, e.g. LF_SUHOSIN. It will block IP addresses that have
        had BIND (named) requests denied more than LF_BIND times in
        LF_INTERVAL seconds. Currently named client denied log lines for
        "update" and "zone transfer" trigger the option

        Modified GLOBAL_ routines to continue if retrieval for one fails
        instead of immediately exiting

        Added IPv6 check to Server Check

        Display DNS lookup results for IP addresses if CC_LOOKUPS is enabled
        on single line comments (lfd.log, csf.deny, etc)

        Added new options LF_PERMBLOCK_ALERT and LF_NETBLOCK_ALERT so that the
        respective email alerts can be disabled

        Updated IP::Country

4.86  - Added Dovecot regex checking for LT_POP3D and LT_IMAPD

        Modified Server Check for Fedora v10 EOL now that Fedora v12 has been
        released

        Improved Dovecot IMAP and POP3D login failure regex

        Ignore RELAYHOSTS setting for LT_POP3D and LT_IMAPD

        Fixed TLSCipherSuite Server Check for proftpd

        Added SSHD regex for "Did not receive identification string from IP"
        failures

4.85  - Further improvements to ICMP rule filters

        Added backup mod_security log viewer for non-cPanel servers

4.84  - Mod_security log viewer removed from csf in favour of cmc

        Improved ICMP rule filters. This could help some hosts that experience
        connection issues with csf

        Added ICMP regex checking to Port Scan Tracking. Add ICMP to PS_PORTS
        to include this, i.e. to Port Scan for all ports use:
        PS_PORTS = "0:65535,ICMP"
        This is now the default on new installations

4.83  - Added multiple checks to the Server Check for new cPanel v11.25 
        security settings

        Tidied up and rearranged the main UI

        Removed redundant UI options

        Added total perm bans to UI

4.82  - Removed the need for UI lfd cron restart jobs on Direct Admin

4.81  - Fixed case sensitivity issue introduced in v4.80 with port specific
        lfd deny lines being ignored

4.80  - Modified WHM login regex to only trap successful root page displays
        for LF_CPANEL_ALERT

        Apache status for PT_LOAD now checks http://127.0.0.1/server-status on
        GENERIC/DA servers. You need to ensure that the server-status page
        has access from 127.0.0.1 in the apache server-status Location
        container

        Extended SU log file regex for Debian servers

        Sanitise UI file edit HTML output

        Improvements to the removal of alternative firewalls script

        Added new options GLOBAL_DYNDNS, GLOBAL_DYNDNS_INTERVAL and
        GLOBAL_DYNDNS_IGNORE which provide for retrieval of a global DYNDNS
        list via URL

        Improved firewall log lines detection for PS_INTERVAL and ST_ENABLE,
        especially on Debian

        Improved detection of already blocked IP addresses

4.79  - Withdrawn

4.78  - Modified DA installation to overcome permissions problems on some
        systems preventing the UI from working

4.77  - Expanded dovecot regex matching

        Fixed the generic installation to install regex.custom.pm

4.76  - Added check for FrontPage extensions to Server Check as they should be
        considered a security risk as they were EOL in 2006

        Added support for the impending cPanel v11.25 Security Tokens feature

4.75  - Added a [block] section to the Login Failure alert.txt template. This
        new report template will be copied to /etc/csf/alert.txt.new on
        existing installations, rename it to alert.txt to use it

        Modified existing lfd alerts to use currently used tags instead of
        appending block information to the IP address (alert.txt modified as
        above)

        Added new options trigger for RT_LOCALHOSTRELAY_* to csf.conf for
        email sent via a local IP addresses, separating the trigger from
        RT_LOCALRELAY_* which is now only for /usr/sbin/sendmail. See csf.conf
        for more information

        Added Relay Tracking to Direct Admin running exim. See RT_* and
        SMTPRELAY_LOG in csf.conf for more information

        Added csf.mignore to allow ignoring of specified usernames or local IP
        addresses from RT_LOCALRELAY_ALERT

        Modified csf UI to use a single dropdown for all lfd ignore files

        Added proftpd regex matching for "UseReverseDNS on" in proftpd config

4.74  - Removed FUSER from csf.conf as it is no longer used

        Added UNZIP to csf.conf which is required for Country Code to CIDR
        functions

        Modified the Country Code allow/deny/allow_filter feature to generate
        CC CIDRs from the Maxmind GeoLite Country database instead of using
        iplocationtools.com. Note: GeoLite is much more accurate that the 
        previous zones used. This also means that there are usually more CIDRs
        for each CC which adds to the burden of using this feature

4.73  - Added checks before Net::CIDR:Lite calls to ensure inputs are CIDR's
        to prevent module failures

        New feature - LF_CPANEL_ALERT. Send an email alert if anyone accesses
        WHM via root. An IP address will be reported again 1 hour after the
        last tracked access (or if lfd is restarted)

4.72  - Modified mail sending code to use a common procedure that copes better
        with differing combinations and variations of From:, To:, LF_ALERT_TO
        and LF_ALERT_FROM settings for lfd alerts

4.71  - Code speedups in csf --grep

        Added csf.allow and GLOBAL_ALLOW lookups during lfd blocking and note
        added to alert if ip match found

        Modified Server Check for Fedora v9 EOL now that Fedora v11 has been
        released

        Modified iptables output from csf.pl to exclude the Fedora v11
        intrapositioned negation messages

        Fixed typo in integrity.txt alert template for new installations

        Modified the email header for csf --mail

        Fix Relay Tracking from 127.0.0.1 to always report as a LOCALRELAY

        Modified lfd output filehandle names to avoid read/write conflicts

        Added Advanced Allow/Deny Filters for csf.dyndns. See readme.txt for
        an example

        Added new option CC_ALLOW_FILTER as an alternative to CC_ALLOW where
        only listed Country Codes are allowed, however normal port and packet
        filter rules are still applied to those connections. All other
        connections are dropped

4.70  - Modified UI access to csf.sips to display checkboxes instead of direct
        editing, for ease of use

        Fixed problem where RELAYHOSTS setting wasn't always being honoured

        Modified mod_security configuration editor to handle HTML elements

        Rewritten RT_*_ALERT regex and counting code to better deal with a
        variety of exim log output formats

        Added recipient count to RT_*_ALERT to include emails sent to multiple
        recipients. This option requires that the exim log_selector setting in
        the exim configuration includes the option: +received_recipients
        So, the recommended log_selector setting is now:
            log_selector = +subject +arguments +received_recipients

        Modified Server Check cPanel version check to cater for x86_64 OS's

        Added check to prevent Server Check mail report cron duplicates

        Added abbreviated UI for mobile phone access to Quick Allow, Quick
        Deny and Remove Deny. Direct URLs:
            cPanel: https://1.2.3.4:2087/cgi/addon_csf.cgi?mobi=1
            DA: https://1.2.3.4:2222/CMD_PLUGINS_ADMIN/csf/index.html?mobi=1
            Webmin: https://1.2.3.4:10000/csf/?mobi=1

4.69  - Added Gentoo (generic) support

        Added Server Check for MySQL LOAD DATA LOCAL

        Modified Server Check for enable_dl to also check whether dl is in
        disable_functions

4.68  - Added ipv6 IP detection for proftpd login failures

        Removed ossec and webmin from the Server Check services section

4.67  - Modified the Country Code allow/deny feature to use
        iplocationtools.com now that ipdeny.com has gone offline

4.66  - Modified OS version check to prevent Fedora v10 obsolete
        false-positive in Server Check

        Modified the exim SMTP AUTH regex to use the latest cPanel/exim format

        Added failure notification for DYNDNS entry lookups in lfd if they
        fail to resolve or timeout

4.65  - Modified Firewall Security Level UI to set PS_LIMIT within range

        Fixed problem processing template for SU_ALERT

        Empty csf.dshield on upgrade to work around problem where DSHIELD
        blocked themselves in their own BLOCK list

4.64  - Removed SMTP_BLOCK warning on VPS servers where ipt_owner doesn't work
        if SMTP_BLOCK isn't actually enabled

        Added new CLI option (csf -uf) which forces an update of csf+lfd

        Added new CLI option (csf -df) which removes and unblocks all entries
        in /etc/csf.deny (excluding those marked "do not delete")

        Added new UI option to that removes and unblocks all entries in
        csf.deny (excluding those marked "do not delete") and all temporary IP
        bans

        Added csf file names to the csf UI options

4.63  - New feature - Added new CLI option: csf --mail (or csf -m) which can
        take an email address as an argument. It will display the Server Check
        in HTML or send the output to the email address if present

        Added option to UI Server Check to schedule csf to generate the report
        and email the results to the address specied at the interval specified

        Removed MySQL check from cPanel DNSOnly Server Check

        Updated the perl v5.8.8 Server Check comment

        Fixed sanity check for RT_*_BLOCK

        Fixed copy of install.txt for generic installs and upgrades

        Modified UI for Deny Servers IPs > Change to indicate that csf needs
        restarting, not lfd

        Added built-in replacement function for the Messenger Service message
        files for [HOSTNAME] which will be replaced by the servers FQDN
        hostname. Updated the sample Messenger index templates

        Updated the uninstall scripts to remove the cronjob and logrotate
        files

        Added colour highlights to the Quick Allow and Quick Deny UI boxes

4.62  - Fixed problem with SU_ALERT alert report in v4.61

        Modified the Server Check for cPanel update settings to check for
        daily updates more accurately

        Added Server Check for cPanel tree

        Upgraded IP::Country

        New feature - Added sanity check to configuration values in csf, UI
        Server Check and UI Firewall Configuration. In the UI Firewall
        Configuration: lines highlighted in red fall outside the recommended
        range; lines highlighted in pale green differ from the default on
        installation

        Added cPanel Security Check to check that at least one configured
        nameserver is on a different server

        Added proftpd checks to csf (for VPS servers) and in Server Check

        Added DirectAdmin Checks to UI Server Check for: SSL login to DA;
        proftpd cipher; nameserver on a different server; PHP version and
        configuration checks; Apache version; dovecot cipher

        Removed resolv.conf localhost check

4.61  - Modified lfd iptables command error handling to log errors and
        continue instead of terminating when in TESTING mode

        Removed loading of iptables modules from csftest.pl to avoid modprobe
        problems with some OS kernels

        Added Connection Tracking check for pre-existing block to cater for
        linux connection status timeouts

        Moved LF_CSF check to the start of the lfd processing interval

        New option LF_ALERT_FROM. If set, the value of this option will
        override the From: field in all of the lfd alert templates. This
        change also uses the From: field in the template (or this option if
        set) as the value for the SENDMAIL -f option

        Modified POP/IMAP Server Checks for the chosen mail server only on
        cPanel servers
        
        Modified FTP Server Checks for the chosen ftp server only on cPanel
        servers

        Added SMTP Tweak to Server Check on cPanel servers and removed block
        on csf starting if enabled

4.60  - Modified cipher checks to strip out quotes

        Modified Apache cipher message to remoind that you have to rebuild the
        Apache configuration and restart for changes to be effective

4.59  - Added proftpd regex for Plesk server log file format

        Modifed the Server Check cipher checks for pure-ftpd and Apache to use
        openssl to ensure SSLv2 is disabled

        Added cPanel Server Check checks for dovecot, courier-imap IMAP and
        POP3D SSL cipher list

        New option SAFECHAINUPDATE added. If enabled, all dynamic update
        chains (GALLOW, GDENY, SPAMHAUS, DSHIELD, BOGON, CC_ALLOW, CC_DENY,
        ALLOWDYN) will create a new chain when updating, and insert it into
        the relevant LOCALINPUT/LOCALOUTPUT chain, then flush and delete the
        old dynamic chain and rename the new chain. See csf.conf for more
        information. This option is disabled by default, but we do recommend
        that it is enabled on non-VPS servers with restrictive numiptent
        values

        Added SAFECHAINUPDATE to the firewall Server Check (except for
        Virtuozzo VPS servers)

        Modified Server Check on cPanel to make the PHP v4 warning clear and
        to warn where PHP v5 and v4 have both been compiled (PHP v4 is
        obsolete and should not be used at all anymore)

        Added WHM checks for skipparentcheck and cpsrvd-domainlookup to
        Security Check

        New option LF_ALERT_TO. If set, the value of this option will override
        the To: field in all of the lfd alert templates

4.58  - Modified exim cipher check in Server Check to use openssl to test the
        expanded configured cipher suites to ensure SSLv2 is disabled

4.57  - Improved exim configuration option detection in Server Check

        Added Exim Configuration checks to DirectAdmin Server Check

        Modified csftest.pl to perform a modprobe on all used iptables modules
        before testing

        Added PASV port hole warning on VPS servers to the output of csf on
        start and to the cPanel (if using pure-ftpd) Server Check

        Added lfd to the DirectAdmin Service Monitor

        Added back a revised Firewall Security Level option to UI

4.56  - Added TCP_OUT port 2222 for the DA default configuration for new
        installations

        Added ICMP protocol to Advanced Allow/Deny Filters. See readme.txt for
        more information and examples

        Updated readme.txt to reflect the Control Panel UI availability for
        cPanel, DirectAdmin and Webmin

        Modified mod_security configuration file check to the TLD only of
        /usr/local/apache/conf/ and only files ending in .conf

4.55  - Fixed issue with csf.conf not being loaded for the Server Check Report

        Removed erroneous chkconfig check from Server Check Report

        Disabled various checks in Server Check Report for non-cPanel servers

        Modified Debian/Ubuntu init entry creation and removal procedure

        Modified Server Check to search for multiple named.conf locations

4.54  - Bug fix to Exploit Check code

        Fixed problem with iptables logs not being collated if PS_INTERVAL is
        disabled but ST_ENABLE is enabled

        Fixed potential problem with SMTPRELAY_LOG not being scanned when
        RT_RELAY_ALERT, RT_AUTHRELAY_ALERT or RT_POPRELAY_ALERT enabled

4.53  - Upgraded the csf Webmin UI module to the new csf UI and added
        installation/upgrade instructions to the install.txt for Webmin

        Fixed image locations and javascript in DA and webmin UI

        Updated the uninstall scripts and the uninstall section of install.txt

4.52  - Reverted lfd signalling on cPanel servers to allow UI restarts of lfd

        Added warning in DA UI to upgrade csf from the root shell due to
        restrictions in DirectAdmin

        NOTE: DA users should upgrade csf to this version from the root shell
        using "csf -u" and not use the Upgrade button in the UI

4.51  - Fixed csf --upgrade (csf -u) for DA installations

4.50  - Added restrictions information regarding the PORTFLOOD setting and
        ipt_recent to readme.txt (i.e. hit count max is 20)

        Modular development of csf UI

        Added DirectAdmin UI and installation support for csf/lfd

        Added Statistics options (ST_ENABLE, etc) to generic csf installation

        Added SMTP options (SMTP_BLOCK, etc) to generic csf installation

        Removed pre-configured firewall settings through UI for redevelopment
        as it has become out-dated

        Modify csf UI to signal lfd to start/restart/enable only. A one
        minute cron job will actually perform the signalled function. The CLI
        is unaffected and performs the command immediately. This is introduced
        to overcome fork issues from within an Apache session

4.41  - Added information about runing external iptables commands using
        csfpre.sh and/or csfpost.sh to readme.txt

        Added new CLI option csf --addrm (csf -ar) to remove an IP address
        from csf.allow and delete the associated iptables rules

        Removed the need for the MONOLITHIC_KERNEL option and made modprobe
        perform silently on csf startup. Added the relevant information
        regarding some Monolithic kernels and the need for a PASV port range
        hole to readme.txt

        Added timeout to csf modprobe to avoid startup hanging on buggy
        kernels

4.40  - Added workaround for php --info bug in Server Report when checking PHP
        configuration settings

        Modified LF_INTEGRITY to regenerate the md5sum comparison file
        immediately after a match is found instead of waitng for the next
        cycle

        Fixed LF_INTEGRITY aborting if the temporary md5sum file is empty

4.39  - Updated csf.conf to clarify that LF_PERMBLOCK_COUNT and
        LF_NETBLOCK_COUNT with act if more than the number of hits are
        detected, not on the exact number set

        Modified csf WHM UI to use csf -u to upgrade csf when a new version is
        available

        Added new script /etc/csf/csftest.pl which will test the servers
        iptables modules for functionality. The tests are for the required
        iptables modules and the optional modules for the SMTP_BLOCK,
        PORTFLOOD and MESSENGER features. This adds a useful diagnostic tool
        for kernel/iptables problems and to check whether the features above
        will function

        Added csf WHM UI option to run csftest.pl

        Updated the csf install.txt to run csftest.pl before running up csf

4.38  - Improved detection of working ipt_owner iptables module on VPS servers
        such that if ipt_owner does not work SMTP_BLOCK and UID/GID blocks
        will be automatically disabled and csf will continue to start

4.37  - Default setting for ICMP_OUT_RATE set to 0 - this is the recommended
        setting for cPanel servers which use ping times to determine fastest
        mirrors for various update functions

        Modified PT_LOAD_ACTION code to stop duplicate load emails from being
        send by lfd

        Moved ETH_DEVICE_SKIP to the top of the INPUT/OUTPUT chains

        Allow enabling of SMTP_BLOCK and use of UID/GID advanced port filter
        rules on VPS Servers for as ipt_owner is now apparently supported on
        the latest kernels. However, if the latest kernel isn't being used or
        the VPS host hasn't included the ipt_owner iptables module for the
        client VPS, then csf will fail with an error

4.36  - Modified Process Tracking to allow regex exceptions in csf.pignore for
        deleted executable processes

4.35  - Modified regex.pm detection of iptables kernel log lines to cater for
        alternative formatting

        Restored the substitution of the NULL separator with spaces for the
        /proc/PID/cmdline in Process Tracking

4.34  - Added code to Process Tracking to translate non-printable characters to
        especially help detect and report deleted executable file processes

        WARNING: Removed hard-coded exceptions for spamd, cpanellogd, cpdavd
        and awstats.pl from lfd.pl. If you want to ignore such processes for
        Process Tracking, you will need to add appropriate ignore rules to
        csf.pignore for them

4.33  - Disable ST_LOOKUP by default on new installations

        Modified lfd stats performance when ST_LOOKUP is enabled and added a
        warning for this setting to csf.conf for when DROP_IP_LOGGING is
        enabled

4.32  - Modified the su tracking regex to better trap RHE/CentOS v5 su login
        attempts

        Added a Server Check for "FTP Logins with Root Password"

        Added new WHM UI option to display Last X iptables Log Lines. Note
        that the report will only display log lines since this update. The
        new statistics will be expanded in future developments. Added new ST_*
        options to the cPanel csf.conf to control the recording of stats

        Removed fwlogwatch from distro and will use self-produced reports

4.31  - Added warning for those that enable PT_USERKILL in csf.conf - i.e. It
        is not a good idea to use that option

        Modified PT_USERKILL to not kill (deleted) processes (these should be
        restarted manually after investigation) as per the documentation

4.30  - If you add the text "do not delete" to the comments of an entry in
        csf.deny then DENY_IP_LIMIT will ignore those entries and not remove
        them. Updated csf.deny information text for new installations

        Made the (deleted) process text even more explicit for those that are
        not reading csf.conf or the FAQ for their explanation

        Updated DSHIELD information URL in csf.conf

        Added new feature - csf.rignore is an ignore file that lists domains
        and partial domains that lfd should ignore. Read /etc/csf/csf.rignore
        for more information

        Option GOOGLEBOT removed. This feature is now performed using
        csf.rignore. If GOOGLEBOT was previously enabled it will be added to
        csf.rignore

4.29  - Added Slackware support (tested on v12.2.0)

        Added Fedora v10 support

        Added new option GOOGLEBOT - Prevent *.googlebot.com from being
        blocked by lfd. See csf.conf for more information

        Added csf version from/to to output from csf --update when upgrading

4.28  - Fixed GENERIC csf problem with csf.pl perl modules

4.27  - New Feature - Port Flood Protection. This option configures iptables
        to offer protection from DOS attacks against specific ports. This
        option limits the number of connections per time interval that new
        connections can be made to specific ports. See csf.conf and readme.txt
        for more information. This option is only available on servers with
        the ipt_recent kernel module

        cPanel DNSONLY compatibility added - Thanks to JJ for the assistance

        Improved Cipher suite checking and advice for Apache and FTP in Server
        Check

        Remove md5sum check from JS exploit check as it is covered by
        LF_INTEGRITY and causes confusion

        Added new option LOGFLOOD_ALERT which will send an email alert based
        on logfloodalert.txt if lfd skips logs lines due to log file
        processing problems

        Added new option PT_DELETED together with the FAQ explaination as to
        why lfd reports deleted processes. The option can be disabled to
        ignore such processes

        Rearranged LOCALINPUT and LOCALOUTPUT rule positions to allow
        exceptions to SMTP_BLOCK

4.26   - New Feature - Country Code to CIDR allow/deny. This feature can allow
         or deny whole country CIDR ranges. The CIDR blocks are downloaded from
         http://www.ipdeny.com/ipblocks/. For more information, see CC_ALLOW,
        CC_DENY and CC_INTERVAL in csf.conf

        Expanded the dovecot regex to include more login failure permutations

        Added exe:/var/cpanel/3rdparty/bin/php to csf.pignore on cPanel
        servers

        SMTP_ALLOWLOCAL set to 1 on new cPanel installations by default

4.25  - Fixed bug in csf --grep when CIDRs used in advanced port filters

        Fixed problems with aborted Server Check Report

        Fixed position of the lo device rule in the OUTPUT chain which broke
        SMTP_BLOCK

        Added new option SMTP_PORTS which is used by SMTP_BLOCK to block all
        listed ports (not just port 25). This is populated on installation or
        when TESTING = 1 if an additional port is listed in "WHM > Service
        Manager > exim on another port". Otherwise, SMTP_PORTS needs to be
        updated manually. The default setting contains port 25

        SMTP_BLOCKs will now log if DROP_IP_LOGGING is enabled

4.24  - Added workaround for issue with WHM image display in the addon header
        for cPanel v11.24

        Added cPanel v11.24 FTP Anonymous Upload checks in Server Report

        Added cPanel v11.24 FTP Cipher Suite checks in Server Report

        Added cPanel v11.24 Apache Cipher Suite checks in Server Report

        Added cPanel v11.24 Exim Cipher Suite checks in Server Report

        Added Fedora v8 to the obsolete OS list now that v10 is out

        Updated dovecot regex in regex.pm for v1.1.6 used by cPanel

        Will only display if cPanel version is >= 11.24

4.23  - Added skip to connection and process tracking for empty tcp6 
        connection data

        Fixed PT_LOAD email output of ps and vmstat

4.22  - Additional fixes for an issue on VPS servers where temporary block
        removal from csf.tempban failed

4.21  - Fixed an issue on VPS servers where temporary block removal from
        csf.tempban failed

4.20  - Modified csf.tempban processing code in lfd to perform more stringent
        file locking to preserve temporary bans if lfd is writing during
        shutdown

        Modified Port Scan tracking of IP's to not attempt multiple blocks on
        the same IP address in the same log line processing batch

        Fixed broken timestamp in lfd.log for dates < 10th of the month

        Various code modifications to improve performance and stability

4.19  - Reverted the tied file changes as they were causing a deadlock
        situation locking csf.tempban

        Improved the process tracking detection of deleted executables of
        running processes

4.18  - Modified temporary IP address storage to use a tied file to preserve
        temporary bans if lfd is writing during shutdown

4.17  - Replaced the use of backticks in csf, lfd and the WHM UI with calls to
        IPC::Open3

        Various lfd and csf code improvements and tidy up

        Ensure lfd parent dies cleanly on error

        Debug information improved and timer modified to use Time::HiRes for
        more accuracy

4.16  - Removed port 953 from the TCP and UDP allow lists for new csf
        installations as it's not necessary to whitelist as bind listens on
        the localhost device for such control connections by default

        Added exe:/usr/sbin/nsd, exe:/usr/libexec/dovecot/pop3-login,
        exe:/usr/libexec/dovecot/imap-login to new and old cPanel
        installations csf.pignore to cater for cPanel support for both nsd and
        dovecot (currently in EDGE)

        Only use Cpanel::Rlimit if it's available in WHM UI

4.15  - Fixed a problem in v4.* where use of GALLOW and ALLOWDYN was allowing
        connections from blocked IP addresses in csf.deny or temporary blocks.
        The GALLOW, GDENY and ALLOWDYN chains have been split into GALLOWIN,
        GALLOWOUT, GDENYIN, GDENYOUT, ALLOWDYNIN and ALLOWDYNOUT to correct
        this. Many thanks to Brian for his help in tracking this issue down.

4.14  - Implemented the use of cPanel routine Cpanel::Rlimit to remove process
        resource limit restrictions as the cPanel memory limitation setting
        was causing the Server Check to abort with memory allocations problems
        through WHM on some servers

        Modified port checking for 23 and 53 in Server Check to no longer use
        the fuser binary and use the port mappings directly from /proc

        Modified lfd and Server Check to check for IPv6 bound processes as the
        IPv4 and IPv6 connections are stored in a different file to IPv4 only
        bound processes

4.13  - Updated various comments in csf.conf

        Fixed call to csfpost.sh from csf

4.12  - Modified lfd Login Failure tracking to use a per IP address rolling
        LF_INTERVAL window rather than a static one for all tracked IPs. This
        makes login failure counting more accurate and blocking more
        responsive

        Added new feature - Block Reporting. lfd can run an external script
        when it performs and IP address block following for example a login
        failure. BLOCK_REPORT is to the full path of the external script. See
        readme.txt for format details

        If csf is installed or upgraded via an SSH session the connecting IP
        address will now be automatically added to csf.allow (note: it is not
        added to csf.ignore so lfd may still block it). This IP can be removed
        after testing if desired

        Modified the lfd.log format to the standard:
        <mon> <mday> <hour>:<min>:<sec> <host> lfd[<pid>]: <text>
        If you parse lfd.log you will need to update your scripts!

        Added DEBUG option - for internal use only

4.11  - Fixed addition of exe:/usr/libexec/hald-addon-keyboard to csf.pignore
        for existing installations

        Modified the calculation for the position of LOCALOUTPUT in the OUTPUT
        chain 

        Added /etc/cron.d/lfdcron.sh to restart lfd daily

        Added exe:/usr/libexec/dovecot/imap and exe:/usr/libexec/dovecot/pop3
        and exe:/usr/sbin/mysqld_safe to csf.pignore

        Modified SCRIPT_ALERT regex to cope with exim log format changes in
        FC8+

        As per RFC5322, adding port 587 to the default TCP_IN list of ports
        for new installations (i.e. it is now recommended for SMTP servers to
        offer port 587 access for MUA to MTA traffic rather than port 25 which
        is for MTA to MTA traffic)

        Added informational text to Process Tracking email report if a process
        is running an executable that has been deleted

        Added csf version to the daemon startup log line in lfd.log

4.10  - Added /usr/libexec/hald-addon-keyboard to csf.pignore

        Modified the static DNS port rules to always allow all OUTGOING (only)
        connections to/from port 53 udp/tcp. This should help the situation
        where some servers iptables block outgoing port 53 udp connections
        despite the port being open

        Added new option DNS_STRICT which will remove all static DNS rules and
        allow access only through SPI. For stability reasons, it would be
        advisable to leave this option disabled (default)

4.09  - Modification to cPanel version to restart chkservd using
        /scripts/restartsr_chkservd instead of the init script as the latter
        is removed in the latest EDGE release that puts chkservd under the
        control of tailwatchd (/scripts/restartsrv_chkservd is a stub for
        restarting tailwatchd in the latest EDGE instead of a direct restart
        script in older cPanel versions). chkservd is restarted when csf
        is installed/uninstalled/upgraded/disabled/enabled

4.08  - Added a new timing system to more accurately trigger lfd tasks. This
        should alleviate timing issues such as those seen with LT_POP3D and
        LT_IMAPD and improve the overall effectiveness and performance of lfd

        Added new method for reaping child processes. If you find that zombie
        lfd processes start to build up you can revert to the old reaper by
        enabling new option OLD_REAPER

4.07  - Messenger service now supports advanced filter permanent port block
        redirection

4.06  - Moved the GALLOW, GDENY, SPAMHAUS, DSHIELD and DYNDNS rules to the
        LOCALxxPUT chains so that the entries can be correctly listed with
        ACCEPT's at the top and DENY's at the bottom of the chain

        Repositioned the cPanel Bandmin acctboth rule entry in the INPUT and
        OUTPUT chains so that bandwidth accounting is kept accurate

        Fixed a problem processing advanced port filters in GLOBAL_ALLOW and
        GLOBAL_DENY

4.05  - Moved resolver ACCEPT rules to the top of the INPUT and OUTPUT chains

4.04  - Fixed problem with rule placement for ETH_DEVICE_SKIP

        Ensure all ALLOW requests are inserted before DENY requests after csf
        has been restarted

        Ensure that fwlogwatch stats creation uses IPTABLES_LOG file

        Only perform operations on the nat table if MESSENGER service is
        enabled

        lfd Process Tracking will now ignore MESSENGER_USER messenger services

        Added new option PT_ALL_USERS so that all Linux accounts on a cPanel
        server are checked in Process Tracking, not just cPanel users. This
        option is disabled by default on cPanel servers. Enabling this option
        may require adding exceptions to csf.pignore

        Additional exceptions added to csf.pignore for cPanel servers for the
        new PT_ALL_USERS option

        PT_SKIP_HTTP now disabled by default for new installations

        Added PT_ALL_USERS and PT_SKIP_HTTP checks to the WHM Server Check

4.03  - Fixed problem where the new LOCALxxPUT chains were only processing tcp
           requests

        Fixed problem with insertion of SMTP_BLOCK rules exceeding the rule
        count in the OUTPUT chain under certain circumstances

4.02  - If csf fails with an error lfd will now die and require a restart
        after the issue with csf is resolved. csf commands apart from start
        and restart are also disabled

        Released from BETA

4.01  - Allow the Messenger Service to be used on VPS servers. However, if the
        ipt_REDIRECT module is missing csf will fail to start correctly and
        abort

        HTML Messenger service server now only reads a limited line length
        instead of unlimited input to prevent overflows

4.00  - New feature - Messenger Service. This feature allows the display of a
        message to a blocked connecting IP address to inform the user that
        they are blocked in the firewall. This can help when users get
        themselves blocked, e.g. due to multiple login failures. The service
        is provided by two daemons running on ports providing either an HTML
        or TEXT message. See csf.conf and readme.txt for more information	 
        (not available on VPS platforms and others missing the ipt_REDIRECT
        kernel module)

        Moved INPUT and OUTPUT chain rules for blocks and allows to their own
        respective chains LOCALINPUT and LOCALOUTPUT. This means that no IP
        blocks will be listed in the INPUT or OUTPUT chains, but in the new
        ones

        Re-organised all of the INPUT and OUTPUT chain rules to give
        precedence to the LOCALINPUT rules before invoking other chains and
        port ALLOW rules

        Moved the SYNFLOOD protection chain rule to be the first chain rule
        after the LOCALINPUT chain rule

        Moved the lo device rules to the always be at the top of the INPUT and
        OUTPUT chains

        Modified the syslog regex matches to only match on local entries to
        cope with centralised syslog configurations

3.43  - Improved application IP block checking

        Restored the option LF_SCRIPT_PERM with additional checks for
        directories within the cPanel homedirs and for symlinks. Warning
        added to csf.conf for this option

        Added random query-source port setting for BIND to the Server Report

3.42  - Corrected information for LF_TRIGGER_PERM in the generic csf.conf to
        be the same as the cPanel csf.conf

        If LF_SELECT is enabled make sure all cPanel ports are blocked on
        cpanel login failure. This was only doing ports 2082,2083 and will now
        block 2082,2083,2086,2087,2095,2096

3.41  - Added new mechanism to allow custom regular expression matching with
        individual settings for lfd login failure detection. See
        /etc/csf/regex.custom.pm for details

        Modified all timestamps in lfd reports to also include the standard
        timezone offset (i.e. from GMT)

        Added new setting CC_LOOKUPS to control the new Country Code lookups
        (enabled by default)

        DROP_IP_LOGGING automatically disabled if PS_INTERVAL is enabled

        PS_INTERVAL enabled by default on new installations

        Doubled the number of lines before log file flooding detection will be
        triggered

3.40  - Added queuealert.txt to the WHM UI dropdown list for editing

        Clarified in csf.conf that setting LF_QUEUE_ALERT to 0 disables the
        check

        Added Country Code lookups for IP addresses. Any reported IP addresses
        will include the international CC where available. It should be noted
        that with international ISPs this may not be wholly accurate. Where
        possible the CC will be translated into the associated country name

3.39  - Added new option IGNORE_ALLOW which, if enabled, lfd will ignore IP
        addresses listed in the csf.allow file and not block them

        Added new option LF_QUEUE_ALERT, which will send an email alert using
        queuealert.txt if the exim queue length exceeds the value it is set
        to. The check is repeated every LF_QUEUE_INTERVAL seconds. If the
        ConfigServer MailScanner configuration is being used, both the
        MailScanner pending and exim delivery queues will be checked. This is
        a cPanel only option

        Added new option CT_PORTS to Connection Tracking so that you can 
        specify which ports you want to count towards CT_LIMIT, e.g. 80,443

        Modified Server Report check for register_globals in cPanel's php.ini
        incase the new cPanel WHM setting is being bypassed

3.38  - Additional SSHD regex added to regex.pm

        Improved the WHM UI reporting of the csf status: disabled, running,
        testing mode

        Added Enable/Start buttons to WHM UI next to the csf status if
        disabled/stopped

        Updated Server Report checks for csf status

        Changed the destination of the ConfigServer Services link at the
        bottom of the WHM UI to go to the csf web page

3.37  - Fixed an issue currently in cPanel EDGE that affects the use of the
        cPanel SafeFile module in WHM scripts

3.36  - Increased the IP lookup timeout for reported IP's from 5 to 10 seconds

        Improved lfd internal timing system for event triggers

        Added new feature - Account Tracking. The new AT_* options configure
        an alert system for account modifications which will send an email if
        there are new accounts added, existing accounts deleted plus password
        uid gid login dir and login shell changes. Each of these changes can
        be enabled or disabled. You can also enable tracking for superuser
        accounts only. That latter is the default setting. This feature uses
        the email template accounttracking.txt

        Added reason text to temporary IP bans

        Added Server Report check for ini_set in PHP disable_functions

        Added ossec to list of processes to disable as it will conflict and
        duplicate csf functionality

        Changed Server Check scoring text to instead show a coloured table
        indicating score

3.35  - Changes to WHM UI script for cPanel v11

        Removed cPanel v10 backported WHM UI settings, i.e. v10 no longer
        supported

        Added # of temp blocks to WHM UI "Temporary IP Bans" on main page

        Modified Server Report check for register_globals in cPanel's php.ini
        to use the new cPanel WHM setting

        Added Server Report check for passwords in WHM email setting

        Added Server Report check for WHM root/reseller login to users cPanel

        Modified Server Report nobody cron check to only fail on non-zero cron
        file

        Modified Server Report check for Fedora now that Fedora 7 is EOL
        (2008-06-13)

        Added new option DYNDNS_IGNORE to ignore DYNDNS entries when lfd
        blocking

3.34  - Modified regex matching to allow for trailing spaces in log lines

        Modified PT_LOAD routine to prevent multiple triggers resulting in
        more than one alert being email sent

        Removed the need for NETSTAT from lfd to reduce overheads and improve
        performance allowing CT_INTERVAL to be set lower. Now uses
        /proc/net/[protocol]

3.33  - Modified skip for su login checking from root to cater for (uid=0)

        Added option SYNFLOOD_BURST to allow configuration of --limit-burst
        when SYNFLOOD is enabled. Changed default values

        Added to --grep searches to csf.deny and temporary blocks in addition
        to iptables

        Modified SSH regex to improve login failures detection further

        Enabled LF_PERMBLOCK, PT_USERPROC by default on new installations

        Added vsftpd regex for ftp login failures

3.32  - Modified SSH regex to check for ipv6 addresses

        Added another regex to improve SSH matching

3.31  - Modified -denyrm to abort if left blank instead of clearing all blocks

        Added lfd check for existing temporary block to avoid duplicates

        Fixed regex handling for courier-imap POP and IMAP login failures

        Added --full-time to the ls command for LF_DIRWATCH_FILE. If you use
        this option, LF_DIRWATCH_FILE will likely trigger due to the changed
        output the first time you restart lfd after upgrading

        Fixed typo in Suhosin description in the Server Check Report

        Added Referrer Security to the Server Check Report

        Added register_globals check in cPanel php.ini to Server Check Report

3.30  - Security Fix: lfd vulnerabilities found which could lead to Local and
        Remote DOS attacks against the server running csf+lfd

        The DOS attacks could make lfd block innocent IP addresses and one
        attack could cause lfd to deplete server resources

        Modified the regular expressions in regex.pm to prevent them from
        being triggered by spoofed log line entries

        Option LF_SCRIPT_PERM removed

        Our thanks to Jeff Petersen for the detailed information describing
        these issues

        We recommend that all users of csf upgrade to this new version

3.28  - Fixed a bug with LT_POP3D and LT_IMAPD introduced in v2.88 which broke
        login tracking

        Modified relay tracking to not ignore RELAYHOST IP's

        Modified LF_SSH_EMAIL_ALERT to not ignore RELAYHOST IP's

        LF_SUHOSIN will now skip matches for "script tried to increase
        memory_limit"

3.27  - Modified csf -dr option to delete advanced filter IP matches as well
        as simple matches in csf.deny

3.26  - Added new CLI option to csf, -g --grep will search the iptables chains
        for a specified match which is either explicit or part of a CIDR

        Added WHM UI option for csf --grep
            
        Added new CLI option to csf, -dr --denyrm will remove an IP address
        from csf.deny and unblock it

        Added WHM UI option for csf --denyrm

3.25  - Added csf.suignore file where you can list usernames that are ignored
        during the LF_EXPLOIT SUPERUSER test

        New option PT_LOAD_ACTION added that can contain a script to be run if
        PT_LOAD triggers an event. See csf.conf for more information

        Added SUPERUSER check to Server Check Report

        Added Suhosin check to Server Check Report

3.24  - Allow comments after IP addresses in csf.dyndns

        Added new login failure option LF_SUHOSIN which detects alert messages
        and blocks the attacker IP after the configured number of matches

        Added a new exploit check for non-root superuser accounts

        Added a new configuration option LF_EXPLOIT_CHECK which allows you to
        configure which tests are performed by LF_EXPLOIT

3.23  - Modified the Server Report code for checking PHP variables to be more
        lenient when checking the output from /usr/local/bin/php -i

        Modified lfd calculation of Jiffies to use the POSIX::sysconf function
        to obtain the clock ticks instead of assuming 100 ticks for Linux

        Fix duplicate LF_INTEGRITY emails

3.22  - Changed DROP_IP_LOGGING logging advice in csf.conf to NOT use this
        setting if you use Port Scan Tracking as it will cause redundant
        blocks

        Added tag [hostname] to all of the alert reports. You will need to add
        this manually to the report text Subject: line (or anywhere else in
        the report that you would like it) for existing installations

        Added "A note about FTP over TLS/SSL" to readme.txt

3.21  - Fixed problem in Server Check that caused an error in some situations

        Modified netblock caching code to prevent repeated block attempts

3.20  - Corrected net block logic so that after a net or perm block occurs,
        subsequent log entries that would incur the same block are ignored

3.19  - New feature - LF_PERMBLOCK. Permanently blocks IP addresses that have
        had X temporary blocks in the last Y seconds. Uses email template
        permblock.txt

        New feature - LF_NETBLOCK. Permanently blocks network classes (A, B or
        C) if more than X IP addresses in a specified class have been blocked
        in the last Y seconds. This may help within some DDOS attacks launched
        from within a specific network class. Uses email template netblock.txt

        Modified MD5SUM comparision code to better reset md5sum checks after a
        hit
        
        Only issue Random JS Tookit warning if all the MD5SUM checks fail for
        the relevant files

        Removed POP flood Protection setting check from Server Report as it's
        no longer relevant to courier-imap

        Rewritten the Apache Check code for the Server Report to better
        detect the current running settings on all Apache and PHP versions

        Don't check Apache RLimitCPU/RLimitCPU limits on VPS servers as they
        aren't relevant (as they apply to the host VPS configuration) for the
        Server Report

3.18  - Fixed bug in the generic csf release where the default csf.conf was
        missing the DROP, CT_STATES and GLOBAL_IGNORE settings - Thanks to Jim
        for the help in tracking the issue down

3.17  - Rewritten the update code so that a new csf.conf is creating when
        upgrading. It now uses the latest csf.conf and transfers the existing
        settings to the new configuration file. This way all installations are
        sure to have all new settings and the latest comments. It also makes
        the release process for new builds much simpler

        Other installation/update improvements

        Updated APF/BFD removal procedure

3.16  - Fixed bug introduced in v3.14 for generic installation only

3.15  - Auto-whitelist all DNS traffic to/from IPs in /etc/resolv.conf

        Modified csf.conf text for new installations to account for
        auto-configuration of ETH_DEV which has been the case for some time:

# By default, csf will auto-configure iptables to filter all traffic except on
# the local (lo:) device. If you only want iptables rules applied to a specific
# NIC, then list it here (e.g. eth1, or eth+)
ETH_DEVICE = ""

# If you don't want iptables rules applied to specific NICs, then list them in
# a comma separated list (e.g "eth1,eth2")
ETH_DEVICE_SKIP = ""

3.14  - Added new format for cPanel (v11.18.3) login failures to regex.pm

        Added exe:/usr/libexec/gam_server to the default list of ignored
        binaries

        Fixed problem with SCRIPT_ALERT not picking up alternative /home
        directories from wwwacct.conf

3.13  - Added new option DENY_TEMP_IP_LIMIT which limits the number of IP bans
        held in the temporary IP ban list to prevent iptables flooding. If the
        limit is reached, the oldest bans will be removed/allowed by lfd on
        the next unblock cycle regardless of remaining TTL for the entry

        Added LF_FLUSH for the flush interval of reported usernames, files and
        pids so that persistent problems continue to be reported. Default is
        set to the previously hard-coded value of 3600 seconds

        Fixed uw-imap ipop3d regex

        Added check for TESTING mode when using csf -a or csf -d to only add
        to the respective csf.allow or csf.deny files and not insert into
        iptables to prevent errors if iptables has been flushed after reaching
        TESTING_INTERVAL

3.12  - Added SMTP AUTH failure regex for Kerio MailServers

        Fixed an issue where a permanent Port Scanning alert would report as
        a temporary block, eventhough a permanent block was performed

        Added regex for failed SSH key authentication logins (thanks to Paul)

3.11  - Use /proc for Process Tracking instead of ps output incase of
        exploited system binaries and to better determine resource usage of
        each process

3.10  - Modified INPUT and OUTPUT chain rules to always specify the ethernet
        device

        csf now re-applies temporary IP blocks on restart

        Added new CLI command to add temporary IP bans. See csf -h for the
        new csf -td command

        Added new options to WHM csf UI to unblock temporary IP bans

        Added new option to WHM csf UI to block IP temporarily for a specified
        TTL

3.09  - Fixed missing copy for the portscan.txt report for generic
        installations

        Added new option PS_EMAIL_ALERT to enable/disable Port Scan Tracking
        email alerts

        Added a sample of the port blocks that trigger the Port Scan to the
        report. This new report will be copied to /etc/csf/portscan.txt.new on
        existing installations, rename it to portscan.txt to use it

        Added Port Scan Tracking to WHM UI Firewall Security Level

        Added cPAddon update email setting check to Server Security Report

        Modified the SuEXEC link location to the cPanel v11 location in Server
        Security Report

        Added portscan.txt template to editable list in WHM UI

        Updated readme.txt

3.08  - Modified Port Scan Tracking to ignore blocked IP addresses incase
        DROP_IP_LOGGING is enabled

3.07  - Added Apache Server Status report to PT_LOAD for load average report
        monitoring. To benefit from this feature you will need to rename the
        new report file /etc/csf/loadalert.txt.new to loadalert.txt. The 
        reports (ps, vmstat and apache) are now included as MIME attachments
        in the email report instead of inline text

        New feature: Port Scan Tracking. This feature tracks port blocks
        logged by iptables to syslog. It can help block hackers attempting to
        scan the server for open ports, or to block them while trying to
        access blocked standard ports, e.g. SSH. See csf.conf for more
        information

        Upgraded the urlget module

3.06  - Added System Exploit Checking. This enables lfd to check for the
        Random JS Toolkit and may check for others in the future:
        http://www.cpanel.net/security/notes/random_js_toolkit.html
        It compares md5sums of the binaries listed in the exploit above for
        changes and also attempts to create and remove a number directory. The
        open is enabled by default. The report is generated from the
        exploitalert.txt template file

3.05  - Added perl regex checking to csf.pignore with the new options puser,
        pexe and pcmd. Text added to csf.pignore for new installations:

            # Or, perl regular expression matching (regex):
            #
            # pexe:/full/path/to/file as a perl regex[*]
            # puser:username as a perl regex[*]
            # pcmd:command line as a perl regex[*]
            #
            # [*]You must remember to escape characters correctly when using regex's, e.g.:
            # pexe:/home/.*/public_html/cgi-bin/script\.cgi
            # puser:bob\d.*
            # pcmd:/home/.*/command\s\to\smatch\s\.pl\s.*

3.04  - Added two new options ICMP_IN_RATE and ICMP_OUT_RATE which allow you
        to set the incoming and outgoing ICMP rate limits independently, or to
        disable rate limiting in either direction completely for ICMP packets

3.03  - Modified LF_DIRWATCH_FILE to use the output from "ls -lAR" instead of
        "ls -laAR"

        Modified rules so that only icmp ping is blocked and all other icmp
        packets allowed if ping disabled in csf configuration. This may well
        help improve iptables performance if ping was disabled

        Added rate-limiting for all icmp packets to prevent inbound flooding

        New option SYNFLOOD configures iptables to offer some protection from
        tcp SYN packet DOS attempts. SYNFLOOD_RATE sets the inbound packet
        rate per IP so the option can be tailored

        Added SYN flag checking of state NEW tcp connections if PACKET_FILTER
        is enabled. NEW tcp connections should always starts with a SYN

        Moved PACKET_FILTER rules to their own iptables chain called INVALID

        Fixed issue where some drops were not logging when logging enabled

        Added hourly flush interval of reported usernames, files and pids so
        that persistent problems continue to be reported

        Added RELAYHOSTS and SYNFLOOD to Firewall Security Level in UI

3.02  - Modified the text comments at the top of csf.allow for new installs:

            # Note: IP addressess listed in this file will NOT be ignored by lfd, so they
            # can still be blocked. If you do not want lfd to block an IP address you must
            # add it to csf.ignore

        Removed RELAYHOSTS check from Server Check report

        Don't show SMTP_BLOCK check if on a VPS in Server Check report

        PT_USERKILL, if set, will now also kill user processes that exceed
        PT_USERPROC

        Fixed problem where csf.tempusers was not being cleared down on an lfd
        restart

        Added two new csf command line options to flush IP's from the
        temporary ban list: -tr -tf (see csf -h for more information)

3.01  - Tightened DNS port configuration restrictions as the old rules were
        being catered for by iptables connection

        Added Kerio Mailserver POP3/IMAP regex's

3.00  - Added progress information to LWP downloads within csf

        Added numiptent checking for VPS servers. csf will flush iptables and
        lfd will stop blocking IP's if numiptent is nearly depleted. This
        should help prevent VPS lockouts due to insufficient server
        resources. If this happens, you will either need to reduce the number
        of iptables rules (e.g. disable Block List usage) or have the VPS
        provider increase numiptent. A value of ~700-1000 should be fine for
        most SPI firewall applications with full Block List configuration

        Added support for the BOGON List (Block List) with LF_BOGON - 
        http://www.cymru.com/Bogons/
        See link and csf.conf for more information

        Fixed problem with RELAYHOSTS not working

        Removed use of the replace binary

2.95  - Reduced memory overhead and added large file skipping for LF_DIRWATCH

        Improved performance of LF_DIRWATCH trigger checks

        Fixed problem with LF_SELECT temporarily blocking outbound access on
        all ports. Now now only the relevant inbound only port(s) will be
        blocked if triggered

2.94  - Fixed linux line-endings in some configuration files from v2.93 -
        doesn't affect existing installations

2.93  - Improved mod_security v2 regex for filter triggers

        Added MySQL v5 check

2.92  - Improved the cPanel version check for < v11 and whether up to date

        Added new CLI option -t (--temp) which lists the temporary IP bans and
        the TTL before the IP is flushed from iptables

        Added "View Temporary IP Bans" to WHM UI

        Changed WHM UI lfd Log auto-refresh default to unchecked

        Added regex for dovecot "Aborted login" messages in /var/log/maillog

        Added support for displaying mod_security v2 logs in WHM UI

2.91  - Added Fedora Core v6 to the obsolete OS check

        Added php v4 check

        Added apache v2.2 check

        Added Perl v5.8.8 check

        Added cPanel v11 check

        Modified Sys::Syslog use to utilise the ndelay and nofatal options

        Added new option GLOBAL_IGNORE which makes lfd ignore IP's listed in
        a globally located ignore file

        Added new option CT_STATES to Connection Tracking so that you can
        specify which connection states you want to count towards CT_LIMIT,
        e.g. SYN_RECV

2.90  - Ensured that Process Tracking doesn't affect processes running under
        root

        Added /usr/local/cpanel/bin/cpwrap to the csf.pignore file for new and
        existing installations

        Added Apache v2 checks to Server Checks Report

        Removed mod_evasive from Server Checks Report as it appears to be less
        relevant, especially with Apache v2

2.89  - Fixed the csf webmin module

        Added updates to the webmin module

        Completely removed use of cat in the WHM module and wget/cat from the
        webmin module

2.88  - Fixed typo in csf.conf for new installs LF_LOAD -> PT_LOAD

        Modified the courier IMAP and POP3D regex's to include connections
        over SSL in lfd

        Modified lfd to ignore cpdavd processes

        Modified the cPanel regex's to include cPanel v11 variants in lfd

2.87  - Fixed duplication of settings during generic configuration upgrade
        procedure

        Only display version confirmation update message when running csf -u
        interactively (Thanks to Brian Coogan for the perl tip)

        Fixed issue with temporary files not being truncated before being
        written to, which caused problems e.g. with global allow/deny files

        Added new option CT_SKIP_TIME_WAIT to exclude TIME_WAIT state from
        connection tracking

        Updated the csf webmin module to use the &ReadParse() routine to
        overcome problems when running through SSL (Thanks to Tim Ballantine
        for this tip)

2.86  - Added regex for SSH on Debian v4 and for "Failed keyboard-interactive"
        on RedHat

2.85  - Fixed a problem with v2.84 which broke permanent IP blocking in lfd -
         it's been a long week :-/

2.84  - Fixed problem with permanent LF blocks in lfd for individual
        application port blocks when set to permanent

        Added new SYSLOG option to csf.conf to allow additional lfd logging to
        SYSLOG (requires perl module Sys::Syslog)

        Added a minimum to LF_DSHIELD and LF_SPAMHAUS ip block lists refresh
        interval of 3600 to prevent getting yourself blocked!

2.83  - Fixed broken Server Check from v2.82

2.82  - Fixed a documentation for LF_TRIGGER_PERM

        Fixed issue where RT_[relay]_ALERT set to "0" was being ignored

        Fixed condition from v2.80 which prevented SCRIPT_ALERT from working

        If killproc.conf does not exist the Server Check now links to the
        Background Process Killer page instead of issuing a file missing error

2.81  - Added exe:/usr/local/cpanel/cpdavd to csf.pignore

        Added option to disable refresh in WHM csf UI when viewing lfd.log

        Removed debug code that prevented IP blocking -- oops

2.80  - Added new lfd feature - Relay Tracking. This allows you to track email
        that is relayed through the server (cPanel only). It tracks general
        email sent into the server, email sent out after POP before SMTP and
        SMTP_AUTH authentication, local email sent from the server (e.g. web
        scripts). There are also options to send alerts and block IP addresses
        if the number of emails relayed per hour exceeds configured limits.
        The blocks can be either permanent or temporary. Currently blocking
        does not function for LOCALRELAY email.

        Introduced a new blocking mechanism in lfd that allows a choice of
        permanent or temporary IP blocking. See csf.conf (LF_TRIGGER_PERM) for
        details on how to configure the various blocking options to use
        temporary instead of permanent blocks, e.g. for Login Failure blocking

        Modified new installations to default to using seperate triggers for
        login failures, instead of the global LF_TRIGGER value

2.79  - Bug fixes

        Added ACCEPT rule to 127.0.0.1:25 for the "cpanel" user if SMTP_BLOCK
        is enabled for the new cPanel Webmail configuration in v11

        Added new configuration option DROP that allows you to choose the drop
        target for rejected packets (see csf.conf for more information)

        Remove /etc/cron.d/csf_update on uninstall

2.77  - Closed vulnerability with temporary file checking

        Tighted log file regex's to prevent spoofed remote IP block attacks

2.76  - Improved file checking in Server Check script to prevent WHM failures

2.75  - Modified Server Check to only look at pure-ftpd settings if installed

        Simplified throttling mechanism


2.74  - Modified PHP Server Checks to use the php binary output instead of
        trying to find the active php.ini file

        Added PHP Server Check for register_globals

        Improvements to the Server Check code

        Fixed bug in TCP port 23 check in Server Check

        Added new option --check (-c) to check whether the installed verison
        of csf is the latest, no update is performed

        Added multiple csf configuration checks to the Server Check report

        Added throttling to LF_INTEGRITY and increased the timeout
        proportionally

2.73  - Modified SMTP_BLOCK warning on VPS servers to only display if the
        option is enabled

        Modifed the Server Services Check text to omit using -del with
        chkconfig and better explain that a process is enabled even if it is
        not currently running and needs to be disabled to prevent startup on
        boot

        Removed reliance on wget for updates and version checks

        Coding improvements in csf.pl and addon_csf.cgi

        Added /var/log/lfd.log tail automatic refresh to WHM UI

2.72  - Fixed problem with DENY_IP_LIMIT not counting all IP entries in
        csf.deny correctly

        Ignore and issue a warning if SMTP_BLOCK is enabled on a Vituozzo VPS
        since the Virtuozzo VPS kernel does not support ipt_owner

        Remove Shell/Fork Bomb Protection check in Server Check as the option
        breaks a Virtuozzo VPS if enabled

        Added more processes to check in Server Services Check

        Removed restriction on outbound source port rule construction

2.71  - Added CSS settings to support pre-v11 cPanel installations

2.70  - Modified to adopt cPanel v11 WHM theme

        Added ports 2077 and 2078 (cPanel WebDAV server) to csf.conf for new
        installations for v11 cPanel

        Added FC5 to the list of (or soon to be) unsupported OS's

        Fixed LF_SMTPAUTH not correctly being set to LF_FTPD when upgrading

2.69  - Added back LF_DIRWATCH_DISABLE functionality securely. Fixed bug where
        a suspicious directory would not be removed

        Added perl module check for File::Path

        Added path configuration to tar and chattr in csf.conf

        Added new option LF_SMTPAUTH which checks for SMTP AUTH exim login
        failures. When upgrading the new setting will be set to whatever you
        have LF_FTPD set to

2.68  - Security Fix - If you have LF_DIRWATCH_DISABLE on then this can lead
        to arbitray code being executed in the context of the user running lfd
        , i.e. root. This option has been disabled in the code until further
        notice. You will have to manually remove any reported files.

        Tightened csf file ownerships on installation

2.67  - Security fix - A major security issue has been found in the
        LF_DIRWATCH code that can lead to arbitrary code being executed in the
        context of the user running lfd, i.e. root, if that option is enabled
        and a hacker has access to create a crafted filename in one of the
        watched directories. This update closes this hole.

        *ALL INSTALLATIONS SHOULD BE UPGRADED ASAP TO AVOID POTENTIAL
        EXPLOITATION*

2.66  - Modified LF_CPANEL text in csf.conf for new installations to reflect
        the change in the SSL login handling by cPanel (i.e. it does now log
        SSL login IP's)

        Modified the log line monitoring in lfd to cope with log line flooding
        to prevent looping/excessive resource usage. Also recoded without the
        use of the POSIX routines

        lfd process name now shows which log file it is scanning

2.65  - New Feature: System Integrity Checking. This enables lfd to compare
        md5sums of the servers OS binary application files from the time when
        lfd starts. If the md5sum of a monitored file changes an alert is
        sent. This option is intended as an IDS (Intrusion Detection System)
        and is the last line of detection for a possible root compromise. See
        csf.conf for more information

2.64  - Modified lfd check for rotated system logs to re-open a log file if
        logs are emptied instead of rotated

2.63  - Added regex support for uw-imap (imap and pop3) login failures

        Added regex support for proftpd login failures

        Timeout version check incase version server is unavailable

2.62  - Fixed CIDR support issue with csf.ignore only recognising the first
        listed entry

2.61  - Fixed problem with lfd not being killed by /etc/init.d/lfd

2.60  - Added log file locations to csf.conf

        openSUSE v10 compatible (generic)

        Debian v3.1 (sarge) compatible (generic)

        Unbuntu v6.06 LTS compatible (generic)

        Added installation check for the LWP (libwww-perl) perl module

        Ran spell checker against the readme.txt file

2.59  - Fixed mod_security report not displaying if only 1 entry

2.58  - Tweaked the mod_security entry layout

2.57  - New feature: WHM UI mod_security v1 display last X entries in the
           audit_log

        New feature: WHM UI mod_security v1 edit files or directories in
        /usr/local/apache/conf/ that are prefixed with modsec or mod_sec

        Tweaked the pre-configured Firewall Security Level settings

2.56  - Fixed v2.55 fix for non-EDGE versions

2.55  - Fix to to support current EDGE in csf WHM UI

2.54  - Tightened the mod_security v1 regex after the changes in v2.52

2.53  - Modified Server Check to reflect withdrawn FedoraLegacy support for
        FC3 and FC4 which should now be considered insecure

2.52  - Separated the log file regex's into regex.pm for those feeling brave
        to tailor them for non-cPanel servers

        Unified installer for cPanel and non-cPanel installations - so that
        only install.sh needs to be run (checks for the existence of:
        /usr/local/cpanel/version
        If you install on a server intending to use cPanel before cPanel is
        installed, run the install.cpanel.sh script instead

        Added mod_security v2 regex when running Apache2 to lfd

        Added [iptext] tag for connectiontracking.txt to list all the
        connections of an offending IP. Add this manually for existing
        installations

2.51  - Major Enhancement: csf+lfd can now be installed and used on a generic
        Linux OS without cPanel using install.generic.sh - see readme.txt for
        more information

        PF INVDROP entries made bi-directional if PF logging enabled (reduces
        the number of INVDROP LOG rules by half)

        Fixed Process Tracking throttle control to correctly use PT_INTERVAL

2.50  - Removed option ALLOW_RES_PORTS from new installs, setting is ignored

        Check for LF at the end of form data for files edited through the WHM
        UI and append one if omitted

        Following the changes in 2.48 the LOGDROP chain doesn't distinguish
        between incoming and outgoing blocks. So, LOGDROP has now been split
        into LOGDROPIN and LOGDROPOUT

2.49  - Fixed issue if ETH_DEVICE was set and from changes in 2.48

2.48  - csf will now specify ! lo as the main ethernet device unless otherwise
        defined in ETH_DEVICE. This will mean that the firewall is applied to
        all ethernet devices on the server unless otherwise specified in the
        configuration

2.47  - Modified DYNDNS code to set listed domains IP addresses to be ignored
        as if they were listed in csf.ignore

        If adding an IP address to csf.allow that is already in csf.deny, the
        IP address will now be removed from csf.deny first and the DROP 
        removed from iptables. It will then be added to csf.allow as normal

2.46  - Added auto-detection of additional exim port (same as SSH port) which
        will be added to TCP_IN on csf installation (or if in TESTING mode)

        Only report PT_USERMEM and PT_USERTIME PIDs once

2.45  - Added workaround to restart the bandmin acctboth chains if csf is
        stopped or (re)started

        Rewritten the way RELAYHOSTS works so instead of using an iptables
        chain a check is done at block time on the IP address and if it is in
        /etc/relayhosts then it will be treated as if it is listed in
        csf.ignore

        Enabled RELAYHOSTS by default, which is now a boolean on off (1 or 0)
        instead of a time interval

        Added exe:/usr/local/cpanel/bin/logrunner to csf.pignore

        Added new options PT_USERMEM and PT_USERTIME to report excessive user
        process usage and optionally PT_USERKILL to kill such processes. An
        alert is sent using resalert.txt

2.44   - Added new option PT_LOAD which will detect if the server load average
         of choice exceeds a set threshold and send an alert

        Reduced the DROP_NOLOG default setting to not include ephemeral ports
        for new installations

        Moved DROP_NOLOG rules to the LOGDROP chain

2.43  - Added new option DROP_PF_LOGGING which will give detailed iptables log
        information on dropped packets that are INVALID or out of sequence.
        This can help tracking down why iptables may be blocking certain IP
        connections

2.42  - Improved the csf locking mechanism to avoid deadlocks

2.41  - Fixed syntax in lfd procedure for csf locking

        Added pre and post csf job detection. If /etc/csf/csfpre.sh exists it
        will be run before any of the csf iptables rules are applied. If
        /etc/csf/csfpost.sh exists it will be run after all of the csf rules
        have been applied. This allows you run your own iptables commands
        within those files. Each file is passed through /bin/sh

        Added two new command line options to completely enable and disable
        csf and lfd

        Added Enable and Disable options to WHM UI

2.40  - Added csf lock procedure to avoid iptables race conditions if multiple
        /simultaneous instances of csf or lfd are executed

        Added check for child reaper looping to dramatically reduce lfd load

2.39  - Added OS check to Security Check to warn if using RH7/9 FC1/2 which
        are no longer supported (or about to be retired)

        Made lfd more lenient when it cannot open a log file (reports the
        error but continues to function)

        PHP Server Check - if /opt/suphp_php_bin/php.ini exists use that for
        php settings

        Added new option RELAYHOSTS to csf.conf which allows you to
        automatically allow access to IP's listed in /etc/relayhosts at a
        specified interval

2.38  - Fixed DYDNS (forgot to add the rule to redirect packets to the
        ALLOWDYN iptables chain)

2.37  - Added canna to the Security Check

        New feature - added support for dynamic dns (DYNDNS) records. See
        csf.conf for more information

        Added dyndns file edit to WHM UI

2.36  - Added runlevel check to Security Check

        Added nobody cron check to Security Check

        Added melange server check to Security Check

        Modified the regex for the php.ini disable_functions check

        Added timing function to lfd that logs how long each stage takes. This
        can be enabled by editing lfd.pl and setting $timing=1 - this can help
        in tracking down performance issues with lfd

2.35  - Added specific exclusion for proftpd in lfd.pl process tracking

        Fixed bug with LF_GLOBAL being ignored

2.34  - Added a new option (beta for now) PT_SMTP. This option will check for
        outgoing connections to port 25, ecluding root, exim and mailman. The
        purpose of the feature is to log SMTP connections if you believe you
        have a spammer on the server who is bypassing exim to send out spam
        emails - this is traditionally a very difficult form of spam to track
        down. The option currently logs relevant process information to
        lfd.log to avoid an email alert flood.

2.33  - Code modification to allow csf+lfd to run without erroring on cPanel
        DNS-Only installations

        Added forced error checking on SMTP blocking iptables commands

        Added check in csf and lfd for duplicate settings in csf.conf

2.32  - Added new option SMTP_ALLOWLOCAL to allow local connections to port 25
        for web scripts, etc, if SMTP_BLOCK is enabled

        Added check to csf startup to fail if "WHM > Tweak Security > SMTP
        Tweak" is enabled otherwise it can break SMTP traffic completely. The
        SMTP_BLOCK and SMTP_ALLOWLOCAL options in csf.conf should be used
        instead

2.31  - Added automatic throttling code to help prevent lfd using excessive
        resources. Currently only added for LF_DIRWATCH and PT_INTERVAL. If
        the sub process takes too long to run, the interval between its next
        run is increased temporarily (for the duration lfd runs for, a restart
        will reset it) and will continue to extend this time to prevent
        excessive server load. However, it will also proportionately increase
        the time given for the sub process to complete so that it can at least
        attempt to get the check done. If you see throttling messages
        appearing in the lfd.log you should consider increasing the process
        interval as indicated permanently (i.e. within csf.conf)

        Added throttling to CT_INTERVAL

2.30  - Modified PT_USERPROC to respect all ignore entries in csf.pignore

2.29  - New feature - User Process Tracking. This option enables the tracking
        of the number of process any given cPanel account is running at one
        time. If the number of processes exceeds the value of the PT_USERPROC
        setting an email alert is sent with details of those processes. A user
        is only reported once, so lfd must be restarted to reinstate checking
        of all users. If you specify a user in csf.pignore it will be ignored.
        The alert file is useralert.txt

        Added useralert.txt for editing through the WHM UI

        Added PT_USERPROC to the Firewall Security Level settings

2.28  - Added /usr/local/apache1/bin/httpd and /usr/local/apache2/bin/httpd to
        csf.pignore

        Only perform strict iptables error checking when in TESTING mode

2.27  - Fixed another mis-configuation for outgoing global deny rule - Thanks
        again to Marie from Jagwire Hosting

2.26  - Fixed a mis-configuation for outgoing global deny rule - Thanks to
        Marie from Jagwire Hosting

        Allow advanced allow and block filters using the -a and -d options
        when running csf in CLI

        Added new option LF_SELECT. If you have LF_TRIGGER set to "0" and the
        application trigger levels set, you can now set LF_SELECT to "1" if
        you only want to block IP access to that application instead of a
        complete block

        Changed installer behaviour to only add SSH port to TCP_IN if TESTING
        is set to "1" - done to help those that don't want to always have the
        SSH port opened

2.25  - Modified lfd init procedure to use the init functions

        Modified behaviour of LF_TRIGGER. If LF_TRIGGER is set to "0" then lfd
        will instead trigger blocks based on the value of the application
        trigger, e.g. if LF_MODSEC is set to "3" then it will trigger on 3
        mod_security alerts. Or if LF_POP3D is set to "10" then it will
        trigger on 10 pop3d login failures. When in this mode, i.e. with
        LF_TRIGGER set to "0", login failures for different triggers are not
        cumulative, whereis LF_TRIGGER set to a number > "0" they are
        cumulative as before

        Modification to csf.conf to reflect the changes to LF_TRIGGER - only
        applied to new installations

        Rewrite of the iptables command invocation in lfd.pl to trap iptables
        errors and shutdown firewall if any found - should help prevent
        lockouts

        Allow advanced rules in Global Allow and Deny lists. Input and Output
        direction support included.

        Added Global Allow and Deny lists to the OUTPUT chain as well as the
        INPUT chain

        Added csf.signore where you can list scripts for LF_SCRIPT_ALERT to
        ignore. Updated WHM UI to allow easy file edits

2.24  - Fixed global allow/deny lists so that you can correctly not have to
        specify both an allow and a deny file

2.23  - Modified LF_SCRIPT checking to also look for HOMEDIR and HOMEMATCH
        from the cPanel configuration

        Added maildir check to Security Check

        Fixed a typo in advanced rules - Thank you to Victor from Touch
        Support for pointing this out

        Added binary executable check for LF_DIRWATCH files

        Added core dump check in cron directories to LF_DIRWATCH

        Added /var/tmp check to LF_DIRWATCH if inode with /tmp does not match

        Increased LF_DIRWATCH timeout from 10 to 20 seconds - if you still
        find it timing out, make sure that you have been clearing down your
        tmp directories

2.22  - Added CIDR recognition to csf.ignore

        Rewrite of the iptables command invocation in csf.pl to trap iptables
        errors and shutdown firewall if any found - should help prevent
        lockouts

2.21  - Fixed a problem on some installations where the update process emptied
        out csf.conf. If this has happened, you will need to remove
        /etc/csf/csf.conf and then rerun the installation procedure and
        reconfigure the firewall. If you're already running at least v2.18 you
        can probably simply restore /etc/csf/csf.conf.preupdate to csf.conf
        and then upgrade to this release

2.20  - Added workaround for different output from the fuser application in
        different OS's

2.19  - Added Security Check for recurions restrictions in named.conf

        Modified port 23 check to be quicker

        Added Security Check for localhost/127.0.0.1 entry in resolv.conf

        Added Security Check for webmin if running

        Added 3 more WHM Security Checks for domain parking

        Added Security Check for boxtrapper

        Added a Run Again button to the Security Check page

        Added Security Checks for cPanel and security package updates

2.18  - Fixed an issue with checking the /var/tmp symlink by comparing the
        inodes of /tmp and the symlink destination of /var/tmp

        Added checking of /usr/tmp

        Added checking of SSH PasswordAuthentication

        Modified update routine to take a copy of csf.conf before upgrading -
        the backup file is /etc/csf/csf.conf.preupdate

        Added check in /etc/cron.daily/logrotate for /tmp noexec workaround

2.17  - Fixed installation process where duplicate entries were being added to
        csf.conf for new settings. Routine added to remove duplicates and
        redundant settings

        Added logrotate script for for the lfd.log file

2.16  - Fixed syntax issue with the csf.deny application feature added in
        v2.15 that prevents csf adding the IP to csf.deny

2.15  - Added a list of the applications that lfd blocks a login failure for
        into csf.deny, e.g. (ftpd,mod_security)

        Extended LF_DIRWATCH with a new option LF_DIRWATCH_FILE. This feature
        will watch for changes in directories and files listed in csf.dirwatch
        using an md5sum for the ls output. If the md5sum changes between
        checks an email alert is sent using watchalert.txt

        Modified pid file locking for the lfd process to ensure duplicate
        processes won't run

        Completely reworked the child reaper code to prevent SIG_CHLD kernel
        errors. Removed DISABLE_SIG_CHLD_IGNORE from csf.conf for new installs

        Added new option to csf.fignore that allows you to ignore files owned
        by a specific user by adding an entry in the format user:bob

        Fixed bug in LF_DSHIELD timer code

        Wrapped LF_DSHIELD and LF_SPAMHAUS in a 10 second timeout to fetch
        their respective data

        New Feature - GLOBAL_ALLOW and GLOBAL_DENY options allow you to
        specify a URL where csf can grab a centralised copy of an IP allow
        and/or deny block list of your own. They are both retrieved after a
        LF_GLOBAL interval in seconds by lfd

        Added WHM UI changes for LF_DIRWATCH_FILE

2.14  - Modification to /var/tmp check to cater for symlinks with a trailing
        slash

        Added check for native SSL support in cPanel in Server Check for those
        versions that now support it

        Added MySQL port check to Server Check

        Added missing comments when clickcing Display All Comments

2.13  - Added cPanel version check to Security Check

        Added suspicious symlink checking to LF_DIRWATCH

        Added a Display All Comments to Security Check

        Added hyperlinks to WHM URLs in Security Check comments

        Fixed the Apache Limits comments of the Security Check

        Added shell limit checks to Security Check

        Added Background Process Killer to Security Check

2.12  - Removed duplicate /var/tmp tests

        Fixed another typo

2.11  - Typo corrections in output text

        Removed dependencies on external modules for the Server Check report

2.10  - Fixed /dev/shm test

2.09  - Removed the nodev check on /tmp etc

2.08  - Changed app name to ConfigServer Security & Firewall

        New Feature - Added Server Security Check report to WHM UI

2.07  - Improved suspicious directory detection

2.06  - Document update

        Change directory watching to only check for suspicious sub directories

2.05  - Fixed log file error if DShield or Spamhaus block list retrieval fails

        Added perl regex matching in csf.fignore (see updated readme.txt)

2.04  - Added /tmp/.horde/* to csf.fignore

2.03  - Fixed a looping issue with the temporary Connection Tracking block
        code

        Added a 10 second timeout for the LF_DIRWATCH child to prevent looping

2.02  - In LF_DIRWATCH, allow wildcard matching at the end of a file name in
        csf.fignore, such that /tmp/clamav* will ignore any files starting
        with /tmp/clamav, e.g. /tmp/clamav-1234

        Added a throttle to LF_DIRWATCH - if more than 10 emails are being
        emailed in one pass, LF_DIRWATCH will create the file
        /etc/csf/csf.dwdisable and then disable itself. To get it watching
        again, either restart lfd or delete that file

        Fixed a bug where LF_DIRWATCH always reported the same file when
        different files had been detected in a pass

2.01  - Added an LF_DIRWATCH exception for postgres /tmp files

        Prevent a file being reported more than once in an LF_DIRWATCH run

        Removed LF_DIRWATCH check for files being excecutable since too many
        apps set temporary files with the flag set, e.g. mod_gzip

2.00  - New feature: Directory Watching. LF_DIRWATCH enables lfd to check /tmp
        and /dev/shm and other pertinent directories for suspicious files,
        i.e. script exploits. These can optionally be moved into a tarball

        Directory Watching false-positives can be listed in csf.fignore which
        is accessible from the WHM UI

1.99  - Bug fix for multiple NICs in the lfd code

1.98  - Modified code to allow for multiple ethernet NICs so that all rules
        are applied to all NICs, for example, if you have IP's spread over
        eth0 and eth1. To do this you have to set ETH_DEVICE = "eth+"

1.97  - Tightened DNS port 53 connections in accordance with:
        http://www.oreillynet.com/pub/a/network/excerpt/dnsbindcook_ch07

        Moved no log dropping to the end of the chains

        Moved allowed IP's to before Block Lists

1.96  - Liberalised connections allowed to and from DNS port 53

1.95  - Fixed WHM UI update. If you're running v1.93 or v1.94 you'll have to
        update from shell to get to v1.95 using:
        csf -u

1.94  - Set DROP_IP_LOGGING to 0 by default to cut down on syslog traffic

        Added exe:/usr/local/cpanel/bin/cppop-ssl to csf.pignore

1.93  - Fixed problem where external resolvers were being used and responses
        from them were being dropped because they were coming back on
        ephemeral ports - added a scan of /etc/resolv.conf and external
        nameservers now have whitelisted source port 53 to ephemeral ports

        Drop logging of failed attempts to access port 53 so they don't
        consume syslog

        Moved update from /tmp do /usr/src

1.92  - Fixed bug where the DShield and Spamhaus block lists weren't being
        periodically updated by lfd

1.90  - Minor fix to pre-configured settings

1.89  - Added Pre-configured settings for Low, Medium or High firewall security
        to WHM UI

1.88  - Fixed csf DSHIELD block logging so it now goes to the BLOCKDROP chain

1.87  - Modified drop list chains to use their own drop logging to
        differentiate from normal drop - if drop logging enabled

1.86  - Modified lfd connection tracking to drop udp as well as tcp packets
        when blocking

        Added support for the DShield Block List with LF_DSHIELD -
            http://www.dshield.org/block_list_info.php
            See csf.conf for more information

        Added support for the Spamhaus DROP List with LF_SPAMHAUS -
            http://www.spamhaus.org/drop/index.lasso
            See csf.conf for more information

1.85  - Workaround for spam PT false-positives

        Added exe:/usr/bin/spamc to csf.pignore

        Added csf version to title bar in WHM

1.84  - Added new cpsrvd-ssl executable to csf.pignore for the new SSL native
        cPanel setup (currently in EDGE)

1.83  - Enhanced lfd.log logging for application failure detection lines

        Set lfd to ignore child processes to get rid of zombie children. If
        you see kernel messages regarding SIG_CHLD (it's a kernel bug) you can
        revert to the child reaper method by enabling DISABLE_SIG_CHLD_IGNORE,
        but you are likely to see harmless <defunct> lfd zombie processes

1.82  - Modified to only load LKM ipt_owner if SMTP_BLOCK enabled

        Extended the Advanced Allow/Deny Filters to allow use of UID and GID
        filtering for outgoing packets - see readme.txt for more details

        Modified code to deal with modprobe command output more cleanly

1.81  - Further modification for the newer xt iptables modules

1.80  - Modified iptables LKM modprobe code to cater for newer xt_* module
        naming scheme

1.79  - Added new feature to send an alert email if su is used to login from
        one account to another. Alerts are sent whether the attempt was
        successful or failed

1.78  - Added workaround for non-ASCII codes after /usr/sbin/pure-ftpd in lfd
        process tracking

1.77  - Added option DISABLE_SIG_CHLD_IGNORE for servers running old kernels,
        e.g. RH9/FC1

        Modified WHM UI textareas to expand to fit file contents

1.76   - Changed WHM interface to restart csf before lfd when restarting both

1.75   - Fix to prevent duplicates in csf.deny

         Added a slight pause between stop and start when restarting

        Code fix for TESTING mode crontab entry removal

1.74  - Fixed lfd to when reading csf.ignore when comments present

1.73  - Added new option LF_CSF to restart csf if iptables appears to have
        been flushed (i.e. stopped)

        Added new option LF_SCRIPT_PERM to disable directories identified by
            LF_SCRIPT_ALERT - see csf.conf for more information

        Workaround to child reaper when 2 children die at the same time

        Added workaround for PT spamd false-positives

1.72  - Fixed bug in (deleted) lfd checks

1.71  - Added some more exceptions to csf.pignore

        Lowered the default setting for LF_SCRIPT_LIMIT to 100

        Modified PT to check for deleted binaries on exemptions which happen
        when upcp runs and the binaries are replaced

1.70  - PT now only reports processes with open ports

1.69  - lfd tweaks

1.68  - Additions to csf.pignore

        Added new option PT_SKIP_HTTP - see csf.conf/readme.txt

        Updated readme.txt regarding unavoidable false-positives and possible
        mitigation.

1.67  - More tweaks to PT with additions to csf.pignore

1.66  - Updated csf.pignore file with additional executables

        lfd code tweaks

1.65  - Added very simple ASCII obfuscation for lfd PT skip lines

        Fixed port typo for entropychat port

1.64  - Updated CLI help and readme.txt for new csf -u command from v1.63

        Changed the format of the email templates for new installations -
        if you want to use the new format remove /etc/csf/*.txt and then
        install csf

        Added mechanism to prevent multiple email/block attempts from login
        attacks in lfd

        Added new feature - Process Tracking. This option enables tracking of
        user and nobody processes and examines them for suspicious executables
        or open network ports. Its purpose is to identify potential exploit
        processes that are running on the server, even if they are obfuscated
        to appear as system services. If a suspicious process is found an
        alert email is sent with relevant information - readme.txt for details

1.63  - Added feature to WHM UI to enable editing of the email templates

        Modified WHM UI to use fixed-width larger font for command output and
        edit boxes

        Added notice to install.txt and readme.txt about enabling klogd (on
        VPS systems in particular)

        Added autoupdates system using AUTO_UPDATES - see csf.conf for details

1.62  - Added to APF/BFD removal in WHM UI the logrotate configuration files

        Added comments system to csf.allow and csf.deny - see readme.txt for
        more information

1.61  - Tighten up some of the csf rules

        Added new fature - LF_SCRIPT_ALERT when enabled will scan
        /var/log/exim_mainlog for extended exim logging lines that show the
        cwd= line for paths in /home which indicate emails sent from scripts.
        If LF_SCRIPT_LIMIT emails from the same path are sent within an hour,
        an email alert is sent using scriptalert.txt containing the first 10
        probably exim mainlog line matches and also likely mailing scripts
        within the identifed path - an ideal tool to help identify spamming
        scripts sending out email through exim. The option is disabled by
        default as you do need to enable extended exim logging first as
        explained in the csf.conf file

1.60  - Modified lfd to use a child reaper instead of ignoring the CHLD signal

        Added login failure detection of cpanel, webmail and whm connections -
        this will only work for access to non-secure ports as cPanel doesn't
        know the IP address of the user when connection are over SSL due to
        the way stunnel works

1.59  - Added workaround to ethernet device detection for VPS servers

1.58  - Fixed problem where SSH port detection on installation would add an emtpy , if
        the SSH port had not been explicitly defined in sshd_config

        Modified csf and lfd ethernet device detection so that if specified in either
        csf.conf or /etc/wwwacct.conf dup IP's aren't checked - useful for bonded
        ethernet devices on some OS's

1.57  - Removed erroneous <CR>'s in lfd.log

        csf start automatically does a restart to avoid problems with any
        existing iptables rules or chains

        Added new option "Deny Server IPs" and associated file csf.sips to
        allow blocking of all traffic on server configured IP's if they're
        not in use

        Added notification to CLI and WHM UI if TESTING still enabled

1.56  - lfd modification to avoid a race condition with the ALRM calls

        Added new feature - /etc/csf/csf.ignore can contain IP addresses that
        are ignored by lfd. If an event is triggered it may be logged in
        lfd.log but will not result in an email alert - e.g. you could list
        your own IP address to avoid alerts from when you login over SSH, etc

        Added WHM UI option to edit the ignore file

1.55  - Fixed a strict refs issue in lfd

1.54  - Fixed IP DNS lookup routine to avoid empty () when no host found

        Added local DIE for ALRM calls for IP lookups and netstat commands

        Removed chkservd restart from /etc/init.d/lfd so that it behaves like
        other monitored services

        Improved error trapping routines to better report to lfd.log if the
        process dies

1.53  - Optimised logging in lfd

        Improved error handling and reporting in lfd

        Modified WHM UI report to include all data, not just a single day

        Improved DROP logging to SYSLOG

        Added logging of dropped ICMP connections

        Added new option DROP_IP_LOGGING to log IP addresses that have been
        blocked in csf.deny or by lfd with temporary connection tracking
        blocks

1.52  - beta test release

1.51  - Added DNS lookups for IP addresses in all lfd alert emails

1.5   - Added new feature - Connection Tracking. Enables tracking of all
        connections from IP addresses to the server. If the total number of
        connections is greater than CT_LIMIT then the offending IP address is
        blocked in csf, or temporarily blocked in iptables. This can be used
        to help prevent some types of DOS attack

        Added new feature - SSH login alerts. An email is sent if a successful
        SSH login is detected

        Fixed a descriptive issue with the WHM UI

        Modified so that lfd checks that it doesn't block a server IP

1.42  - Modified lfd login tracking to check the csf.allow file for an
        offending IP address and to skip it if it's allowed - note this only
        works for specified full IP addresses (not CIDRs or advanced port/IP)

1.41  - Added an exception for 127.0.0.1 when checking ethernet interfaces as
        VPS servers are setup with that IP on both the loopback and main
        interface

1.4   - Fixed error routine iptables flush command typo

        Modified interface checking for non-english Linux distributions

        Modified interface checking for IP addresses assigned to multiple
        interfaces by mistake (I've just seen this happen!)

        Set FORWARD chain to ACCEPT on stopping firewall

        Reorganised csf.pl code

        Added advanced port+ip filtering within csf.allow and csf.deny with
        the format: tcp/udp:in/out:s/d=port:s/d=ip (see readme.txt for info)

        Added link to readme.txt in WHM interface

        Added iptables status (Running/Stopped) to WHM interface

        Added Quick Allow and Quick Deny IP address options to WHM interface

1.33  - Added blocking of SSL POP3 and IMAP ports to LT (993/995)

        Added option to Restart csf+lfd within WHM interface when appropriate

        Added buttons to WHM interface to remove APF or BFD if still installed

        Removed csf nat and mangle chain actions

1.32  - Modified log line checking to deal with syslog compression. This is
        where syslog will add a line "last message repeated X times" if the
        next line it were to add is identical to the last. This could lead to
        login attempts being missed. But no more - lfd now checks for that
        line and repeats the processing of the previous log line X times to
        count all the login failures

1.31  - Removed some redundant code from csf

        Display error in csf if IP already in allow/deny file

        Stopped install.sh from overwriting email templates

        Added email notification for login tracking including a new email
        template tracking.txt

        Added mod_security apache module IP blocking in lfd

1.3   - Fixed a problem with the tick time in the alert report

        Changed the way allow and deny IP addresses are inserted into iptables
        so that using the command line -a or -d doesn't require a firewall
        restart

        csf -l now shows iptables line numbers

        Added login tracking (LT) options to keep track of POP3 and IMAP
        logins and limit them to X connections per hour per account per IP
        address. Uses iptables to block offenders to the appropriate protocol
        port only and flushes them every hour. All of these blocks are
        temporary and can be cleared by restarting csf

1.21  - Added the real log file failure entry matches to the alert email. Existing
        installations will need to add a [text] variable into
            /etc/csf/alert.txt

        Added link in WHM to the ChangeLog if a new version is available

1.2   - Fixed uninstall script to remove lfd from chkservd

        Fixed lfd so that checks were not made on options where a log file is
        shared

        Fixed lfd stop/start to dis/enable chkservd option

        Added upgrade feature to WHM when a new version of csf is available

1.11  - Use full paths to chkconfig within the csf installation scripts

        Documentation improvements

1.1   - Added option LF_EMAIL_ALERT which enables email alerts if lfd blocks
        an IP address. lfd now forks a child process to handle the IP blocking
        and email so that it doesn't hinder the daemon process from scanning
        the logs. It uses a template file for the email.

1.0   - Initial public release

        Set ALLOW_RES_PORTS to default to 1 after further RFC 1700 reading

        Check /var/log/messages and /var/log/secure for SSHD logins

        Clarified in the configuration file that only courier-imap/pop3
        connections are trapped in lfd

1.0RC2- Added filtering out of \r in WHM interface for allow and deny

        Fixed typo in WHM addon

        Added new configuration option ALLOW_RES_PORTS

1.0RC1- Added iptables reporting to WHM interface using fwlogwatch:
        http://sourceforge.net/projects/fwlogwatch/
        This processes /var/log/messages and extracts the iptables log entries
        (if logging is enabled) and produces a simple HTML summary report

0.2b  - Fixed modprobe errors on MONOLITHIC kernels that don't have the nat
        module installed

        Modified lfd to use asterix in the log message when blocking to
        highlight in Thunderbird in the same way as the kernel log messages if
        you use the "Quote Colors" extension - http://quotecolors.mozdev.org/

        Added list of TCP and UDP ports currently being listened on to install

        Set DNS_ZONE to default to 1

        Removed backups of csf.conf files as the WHM interface is stable

        Added ipt_owner module load for SMTP Tweak on LKM kernels

        Added ipt_LOG to the required module list for LKM kernels to ensure
        drop logging to syslog

        Added new configuration option DENY_IP_LIMIT

0.1b  - Initial beta release (24 May 2006)
