ConfigServer Community Forum

Thanks for the quick repsonse. That did the trick, I should have thought to try that before posting.

A couple of days ago I started seeing this in lfd.log: Jul 8 11:00:56 svr lfd[8991]: Unable to retrieve blocklist TOR - Unable to download: 403 - Forbidden I get the same response if I try and visit http://exitlist.torproject.org/exit-addresses from my desktop. After a little digging, I found this -...

Have you checked the FAQ?

http://www.configserver.com/techfaq/faq ... =67&page=1

Maybe Im just paranoid, but it seems to me that giving a banned IP any sort of response means allowing an active connection to the server which an attacker could possible exploit. I think I'd rather deal with the support overhead and rest assured that anyone blocked by the firewall is really blocked.

I understand the problems with having both of these enabled, and maybe I have something misconfigured or am missing something. The way I understand it if DROP_IP_LOGGING is disabled then no packets to blocked ip addresses are logged. Due to limited resources on the VPS I remove permanent blocks afte...

is there anyway to make it auto delete suspicious files becuz im getting backdoored and im not ready for an os reload till i get a good backup..:( What would define a suspicious file? Also, if your system is already compromised it is too late to get a good backup. How will you know that you are not...

Yep, works great now.

Thanks Chirpy!

Since upgrading to 3.19, when I run the Security and Settings report in CSF I get a message saying "a fatal error or timeout occurred while processing this directive" This is on a CentOS 4.4 VPS running Cpanel 11 with Apache 1.3. Other than that 3.19 and 3.20 seem to work great and I love ...

I'm afraid I probably won't be much help there. I know I'm running CSF with no problems on CentOS 4.6. If it were me I would start by watching /var/log/lfd.log and var/log/messages to see if I could spot something that was causing the load to rise. Barring that I would turn off as many of the featur...

Yesterday, I was told I'm getting SYN attacks. So I enabled the syncookie and enabled the SYN option in LFD options -- with "5" as the "SYNFLOOD_RATE" option. If the volume and frequency of the SYN attacks is high enough then they will overload any software firewall. This could ...