ConfigServer Community Forum

Would it be possible to do either of the following:

1. Log all csf/lfd blocks and removes to a database of some nature, to enable this to be queried for use elsewhere by non-privelidged accounts

or 2. Add some form of hook script to be run after an IP is blocked or removed from the blocklist (much like cpanels postupcp method)

My reason for asking is I am trying to create some form of...

Hi:

May I suggest further documentation on the different debug levels? On that regard, the verbose level could be configured manually (ie. list of all possible items/categories of alerts with 0/1 option). This could help sysadmin to track/monitor/manage some issues more closely.

see this post for further reference:

What do you think?

Cheers!

S.

First I'd like to thank Chirpy and crew for all the great work they've done for us hosts. I've paid for their services, and have recommended it to my friends because of how professional they are, and of course how great their product is. Thanks :-)

Now onto my suggestion for csf...

It would be really nice to be able to use bluetack formated ip blocklists in CSF. From my understanding this...

Hi,
It is possible to change CSF in such a way that users from banned IP can see info page?
I mean lastly I had few clients complaining about server non working, but it turn out they IP was blocked because of their fault (wrong cpanel/ftp/pop3 password) :rolleyes: .
In this case customers are pointless and dont know what to do. I would like to give them some option/ info about it.

Its possible?...

On the Messenger protion I know we can edit the messenger files. I was wonder if there was a way to dynamically put text into the messenger to say why it was bloked.

For example in the csf.deny we put

196.168.0.0/10 #Trying to inject hacking scripts

Could messenger pull the text past the # and in the code we could have something like:

Our firewall blocked your IP because etc...

And possibly...

I would like to get opinions and ideas about automatically sending an email to the network abuse (or other) email address of the owner of every IP number that attempts to hack into my system. I get a lot of SSH login failures, a fair number of rejected TCP SYN messages, and some port scanning activity. The hacking activity comes from all over the world. After looking up the network information on...

Is there possibility to block domain name not IP like in csf.deny, or add string if this string will be in domain, the domain will be blocked like:

example: *rapidshare*

If it's possible by iptables maybe it's good to add like new option?

hi, I would like to know if it's possible to add the variable keys authentication in sshalert.txt,
since it is essential to know this information when there are more of an active key.

thanks for help!!!!

What do You think about WHM (root) login notification?

Hello,

Please consider adding dovecot (IMAP & POP binaries) to the stock-default LFD process ignore list; this will help to limit the that is triggered by simple IMAP and POP usage.

Executable Path:
/usr/libexec/dovecot/imap
/usr/libexec/dovecot/pop3

Thank you for your time and consideration. :)

I've noticed in small boxes that after a lite DOS was occured and the system memory have reached its top value, the lfd hangs, can't fork errors are issued, lfd is dead, and the temporarily blocked IP addresses remain blocked in iptables. I've also noticed that that blocks are not cleared nor un-orphaned when you start the csf again. That's cool because, under a DDoS attack, your iptables will be...

I think it would be possible but maybe somewhat a security risk...but can easily take all pre-cauctions when doing this.

I have a few reseller clients and some of their clients get banned, but they would have to contact me to remove from the deny list and add them to the allow list.

^Only long solution, The fast solution is a more security risk , Set->Reseller Account with root permissions,...

HI,

I read a tutorial for limiting the servers bandwidth using iptables....

tc qdisc add dev eth0 root handle 1: cbq avpkt 1000 bandwidth 100mbit
tc class add dev eth0 parent 1: classid 1:1 cbq rate 256kbit allot 1500 prio 5 bounded isolated
tc filter add dev eth0 parent 1: protocol ip prio 16 u32 match ip dst 0/0 flowid 1:1

Would it be possible to add this functionality into CSF so that...

Hello,

Please add the ability to define specific protocols to be accepted, such as Generic Route Encapsulation or gre (47) for VPN tunnels.

The following are examples of the iptables rules required in the aforementioned configurations:
-A INPUT -p gre -j ACCEPT
-A OUTPUT -p gre -j ACCEPT

or

-A INPUT -p 47 -j ACCEPT
-A OUTPUT -p 47 -j ACCEPT
Preferably, each entry would be at the beginning...

I got some lovely messages from LFD this morning telling me that the mail queue had X,000 emails in it (EEK)... problem was I was asleep and didn't see the emails till around 3 hours later (25,000 emails in the queue by now). I do have my server limited to 1000 emails per domain, but I have a feeling this is ignored if they hack in or use exim direct? Anyway back to the point - the warnings are...

Currently, after XXX entries in the deny file, csf automatically starts removing the oldest entries. Is there a way to have a list of permanent deny entries that never get auto removed? Is this the global deny list, or would this be a new feature?

Rob

Hi,

Is there a way to track all WHM/cPanel/FTP logins and not just the failed ones? What we would love to see is the name of the country the person successfully logged in from in an email. Some of our clients are a bit careless when it comes to creating strong passwords.

We understand that many of the servers that support hackers are in the US but many of them are not. We do not have many...

#1 - File Integrity Checking

Being able to monitor important folders and files for changes. IE : /etc , /etc/passwd, groups , shadow, config files, system binaries . Based on md5 checkings ?

I know we got the ct states option which is a big help but I figured I would offer this suggestion from experience.

I got to noticing on a server I didn't have ct_states on that it was counting last_ack, fin_wait, close_wait etc as connections. I know about the skip time wait option but usually there is just as much of the other connection states.

I think the ct default should count...