ConfigServer Community Forum

The permanent options support adding comments but the temp options only put manually added eg:

csf -d 203.0.113.1 Some comment

It would be great if the temp CLI options supported adding comments eg:

csf -td 203.0.113.1 30d Some reason they are temp banned.

Good Morning,
I've had a server that was allowed in a csf cluster (within csf.allow) that went bad and started attacking. Because it was in the csf.allow, it (of course) wasn't being blocked. I found that I couldn't remove it from the csf.allow file with a cluster command. My cluster includes 37 servers and I'm only about half-way through at this point. It would be really nice if a cluster...

Hi,

I've recently enabled LF_SYMLINK and have found its been blocking genuine traffic.

I use suPHP so of coarse all users should own their own files, but some users have files owned by nobody for whatever reason, these users are triggering the LF_SYMLINK because their userid is accessing the 'nobody' userid.

Could you add an option so that such triggers can be ignored?

I guess it could miss...

Hello,

I'm using generic CSF 6.0 on Gentoo.

I have a couple custom regexes that scans apache access_log and modsec_audit log. The regexes work correctly. When these rules match there is a flood of errors from a single ip, 10's of accesses per second.

Looking at strace, LFD seems to be trying to resolve the hostname for every logline that matches the pattern? Is this correct? On hosts with...

Good day:

Parallels H-Sphere logs to /var/log/proftpd/current for proftpd

The format for no such users is as below:

@4000000050813b0f0dc55a3c OUR_SERVER_IP (119.131.139.79 ) - USER .DOMAIN_NAME: no such user found from 119.131.139.79 to OUR_SERVER_IP:21
@4000000050813b1334953c2c OUR_SERVER_IP (119.131.139.79 ) - USER admin: no such user found from 119.131.139.79 to OUR_SERVER_IP:21...

Hello,

Currently I'm subscribed to all the mailinglists of software that I'm using, to know when there's a new version (apache mysql php etc).

The only one missing for me is CSF, I tried searching for a list but I don't think there is one.

Right now I just see csf updates by coincidence in DirectAdmin, I'd like to always update it asap.

OS: CentOS 5.8 x86_64
CSF Version: 5.71
SSH Version: openssh-4.3p2-82.el5

Hello.

We run quite a few CentOS 5 and a week or so ago serveral of our servers were the target of brute force SSH attacks. What we found though was that with:

LF_SSHD = 15
ST_DISKW_FREQ = 5

LFD was not blocking the the IP's (and there were many more than 15 brute force attempts per IP address per 5 minutes). As it...

Hello

Is it possible to block certain country (for example China) for certain services (eg. FTP)? We see many hacking attempts from compromised servers from China using users FTP details, but we can't block China from all services because many of our users send emails to from China.... Any idea how to setup such rules? Maybe with csfpost.sh?

Rather than add a new thread am adding to this one.

This issue has occured again with the latest cPanel update 11.36

You have package updating disabled, this can pose a security and stability risk. WHM > Update Config >cPanel Package Updates > Automatic

All updates are set to Automatic

Cheers,

George

Not sure if the title describes what I mean, so I'll explain.

Lately we are receiving brute force attacks (SMTP) from different spoofed IP addresses, but they all have in common host IP, for example:

2012-12-02 09:10:27 login authenticator failed for host100-107-static. 224-95-b. business. telecomitalia. it ([ 192.168.2.33 ]) : 535 Incorrect authentication data (set_id=scan)
2012-12-02 10:52:33...