Skip to main content
Sign in

CloudLinux Knowledge Base

  1. CloudLinux
  2. Imunify Security Products
  3. FAQ

Why should LF_MODSEC be disabled when using Imunify360 with CSF?

Michael Cernyavsky
  • Updated

Issue

When Imunify360 is used with ConfigServer Security & Firewall (CSF), CSF may block IP addresses based on ModSecurity events if the LF_MODSEC value in /etc/csf/csf.conf is not set to 0.

This may cause false-positive IP blocks because CSF can count ModSecurity events generated by the Imunify360 Web Application Firewall (WAF) ruleset, including low-severity or monitoring rules that are not intended to trigger IP blocking through CSF.

Environment

  • Imunify360 
  • ConfigServer Security & Firewall (CSF) 
  • ModSecurity 
  • Imunify360 WAF ruleset

Solution

Set the LF_MODSEC variable to 0 in the CSF configuration file:

LF_MODSEC = "0"

This prevents CSF from blocking IP addresses based on ModSecurity events while allowing Imunify360 to handle WAF-related detections and IP management according to its own protection logic.

There are two possible scenarios depending on the CSF Integration status in Imunify360.

Scenario 1: CSF Integration is enabled

When CSF Integration is enabled, Imunify360 manages blocked IP addresses using Imunify360 IP lists. It may also remove blocked IP addresses from the CSF deny list so that Imunify360 can continue processing them, for example, to collect statistics or show a CAPTCHA challenge instead of immediately dropping the connection.

In this scenario, it is recommended to disable ModSecurity-based IP blocking on the CSF side by setting LF_MODSEC to 0.

If LF_MODSEC remains enabled, CSF may mistakenly block IP addresses based on Imunify360 WAF rules that are designed for monitoring or low-severity detection rather than direct IP blocking.

Scenario 2: CSF Integration is disabled

When CSF Integration is disabled, CSF and Imunify360 work as independent solutions. Imunify360 does not manage CSF lists, and IP addresses blocked by CSF remain in CSF-managed lists.

In this scenario, Imunify360 whitelists do not override CSF blocks. If an IP address is blocked by CSF because of LF_MODSEC, it must be reviewed and whitelisted directly in CSF if needed.

Even when CSF Integration is disabled, it is still recommended to set LF_MODSEC to 0 to reduce false-positive IP blocks.

Cause

CSF can count ModSecurity events toward the LF_MODSEC threshold. The default value is usually 5, which means CSF may block an IP address after several ModSecurity events are detected.

However, the Imunify360 WAF ruleset includes rules with different severity levels. Some rules may be used for monitoring or temporary detection purposes and are not intended to trigger IP blocking by CSF.

As a result, when LF_MODSEC is set to a non-zero value, CSF may block IP addresses based on events that Imunify360 does not treat as high-severity blocking events. This can lead to false positives.

Imunify360 is designed to handle WAF-related blocking independently and does not rely on the CSF Login Failure Detection mechanism for this purpose.

 

Useful links

Comments

0 comments

Please sign in to leave a comment.

Related articles