Notification to enable DoS protection on the server with Imunify360 and CSF

Issue

On the server with Imunify360 and CSF, there is a notification about the necessity to enable DoS protection.

However, there is no way to enable DoS protection in the Imunify360 settings, because CSF is detected.

Environment

• Imunify360
• CSF

Solution

It is necessary to check whether CSF returns the status correctly, and if not, fix it. An example of such a check and the error it produces is shown below:

# csf --status
You have an unresolved error when starting csf:
Error: Error processing command for line [339] (6 times): [Another app is currently holding the xtables lock. Perhaps you want to use the -w option?], at line 339 in /usr/sbin/csf
You need to restart csf successfully to remove this warning, or delete /etc/csf/csf.error

Then, make sure that Imunify360 is running not in PRIMARY_IDS mode. For example in CSF_COOP mode below:

# imunify360-agent rstatus --json -v | grep strategy
"strategy": "CSF_COOP",

After making the changes, after some time (about an hour later), the notification should disappear from the Imunify360 Dashboard.

Additional troubleshooting.

• The change of Imunify360 operation strategy is written in the console.log as follows:

INFO [2023-01-17 12:13:34,865] im360.plugins.strategy_checker: Strategy changed: PRIMARY_IDS -> CSF_COOP

Useful links

• https://docs.imunify360.com/ids_integration/#csf-integration