ConfigServer Community Forum

Is there a way to blacklist an IP based on the repeated failures like the following logs?

I get these from journalctl not sure if they are also logged somewhere else.

Jun 01 23:13:07 myhost.goo.edu sshd : Unable to negotiate with 139.59.240.248 port 55732: no matching key exchange method found. Their offer:...

Is it possible to do advance filtering using the command line?

It seems like the only possible way is to write the directly to the rule file?

Hello,

I'm using csf and have the follow config:
LF_SSHD = 15
LF_SSHD_PERM = 1

Even so ssh logins are being blocked on single login attempt

IP: X.X.X.X (GB/United Kingdom/-)
Failures: 1 (sshd)
Interval: 600 seconds
Blocked: Permanent Block

Log entries:
Sep 20 08:16:34 web7 sshd : Invalid user ubuntu from X.X.X.X port 45160

Cant understand why this is happening. Checking the logs i only...

Hello,

I'm using LF_DISTSMTP to help to detect compromised email accounts.

It works fine but I have a few email accounts for sending reports that have distributed logins.

Is it possible to LF_DISTSMTP ignore this specifics accounts? How can I do that?

Thank you

Hello,

This is only few lines. We have a maybe tousend of line. And CSF didn't stop this. Which config missing our CSF ?

Regards,

139.880043136 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.882366931 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.884717429 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.887074679 43.239.141.121...

Here are the ^PT_ related settings:
# grep ^PT_ /etc/csf/csf.conf
PT_LIMIT = 60
PT_INTERVAL = 60
PT_SKIP_HTTP = 0
PT_ALL_USERS = 1
PT_DELETED = 1
PT_DELETED_ACTION =
PT_USERPROC = 10
PT_USERMEM = 1024
PT_USERRSS = 256
PT_USERTIME = 1800
PT_USERKILL = 1
PT_USERKILL_ALERT = 1
PT_USER_ACTION =
PT_LOAD = 30
PT_LOAD_AVG = 5
PT_LOAD_LEVEL = 6
PT_LOAD_SKIP = 3600
PT_APACHESTATUS =...

Hi ,

I just installed CSF on an Asterisk box.
Is there any setup I could use in order to block IP addresses that failed to login on SIP / port 5060 with the help of CSF ?

Thanks !

Hi guys,
If I have a user getting blocked with an ip address say 203.57.138.20 (Not real IP address)
I now want to find in the logs why he was blocked. This IP address is currently unblocked so looking at csf.deny does not help

Kind Regards

Steve

Hi guys,

I'm running Postfix on a generic Centos 8 server and I'm trying to lock it down with CSF. I've done a fresh install, reviewed the conf, set testing = 0 and restarted the service.

The postfix maillog (/var/log/maillog) is showing a lot of SASL authentication failures like this:

May 5 09:21:38 myserver postfix/smtps/smtpd : connect from unknown
May 5 09:21:39 myserver...

Hello,

I would like to know if it is possible to use different users without having whm installed on my server, on this server I have a different application but I want to create users that can only unblock IP's.

Thanks.

Hi and thanks in advance!

I have installed in my WHM the plugin ConfigServer Security & Firewall

Its blocking NODE.js connections to externals APIs calls and I dont know how to avoid it.

(If I disabled the firewall all works)

Could you gime a clue please?

Thank you !

hello,
i have a server in cloud and i want access only from my ip

so i add in csf.allow my ip
and in csf.conf i set
TCP_IN =
UDP_IN =

same for ipv6

but when i reboot server, is offline...
i can't access in ssh but if i access with console (on provider panel) and try to ping 8.8.8.8
network is unreachable

of course server have a public ip, but is not static settings but keep ip from DHCP...

It is possible to edit the file that sends the email to include other parameters such as:
Client IP
Page title
Because then I will know which client is doing something wrong in the system.

Original email I receive:

Time: Tue May 11 20:40:43 2021 -0300
Account: xxxxxx
Resource: Process Time
Exceeded: 1813 > 1800 (seconds)
Executable: /usr/local/bin/php-cgi
Command Line:...

I used to have this enabled and had made the necessary changes to the exim configuration to make it work. I have now disabled it in both CSF and exim configuration, and restarted both firewall and lfd, and exim. I have ports 465, 587 and 25 enabled and open for SMTP auth.

But I can't connect to the server from Apple Mail for SMTP. Apple reports: Unable to verify account name or password.

I...

Hello,

I see everyday similar action. How can I block with CSF firewall ? For example more than 50 packet per IP blocked. CT_LIMIT not help this problem.

From 205.209.159.201 - 1548 packets

Regards,

Hello
after installing CSF all emails goes to SPAM
even after set this SMTP_BLOCK to off
SMTP_BLOCK = 0

it still goes to SPAM

and when ever I stop CSF or uninstall it .. all my emails goes to INBOX normaly

what to do ?

I've been receiving this message for over 1 month - any ideas? Is it a configserver.com issue?

I obviously don't want to post my server IP here.

Thanks,

Rob

I get this alert every 5 minutes:

File: /tmp/systemd-private-c187857224034146b6d5778aa1a95646-ea-php73-php-fpm.service-Va0Oin/tmp/config.tmp.phlT82
Reason: Script, file extension
Owner: x:x (1009:1011)
Action: No action taken

What should I do about it?

Hello All,

I got all of the settings double checked to setup the CSF Cluster, I have all nodes sharing both send and receive and the firewalls are open on each, so when I cping test it comes back with pong, so communications is happening.

My test was to add an ip on a deny list and then check if that IP is on the deny list on all the servers in the cluster.
I added a comment as well, so I was...

Hello,

I have a 6 domain on me server. I need to block all icmp and ping one IP on my server. I tried this way.

icmp|in|d=ping|d=xxx.xxx.xxx.xxx

But not blocked ping, any idea ?

Regards,