ConfigServer Community Forum

Is there possibility to block domain name not IP like in csf.deny, or add string if this string will be in domain, the domain will be blocked like:

example: *rapidshare*

If it's possible by iptables maybe it's good to add like new option?

hi, I would like to know if it's possible to add the variable keys authentication in sshalert.txt,
since it is essential to know this information when there are more of an active key.

thanks for help!!!!

What do You think about WHM (root) login notification?

Hello,

Please consider adding dovecot (IMAP & POP binaries) to the stock-default LFD process ignore list; this will help to limit the that is triggered by simple IMAP and POP usage.

Executable Path:
/usr/libexec/dovecot/imap
/usr/libexec/dovecot/pop3

Thank you for your time and consideration. :)

I've noticed in small boxes that after a lite DOS was occured and the system memory have reached its top value, the lfd hangs, can't fork errors are issued, lfd is dead, and the temporarily blocked IP addresses remain blocked in iptables. I've also noticed that that blocks are not cleared nor un-orphaned when you start the csf again. That's cool because, under a DDoS attack, your iptables will be...

I think it would be possible but maybe somewhat a security risk...but can easily take all pre-cauctions when doing this.

I have a few reseller clients and some of their clients get banned, but they would have to contact me to remove from the deny list and add them to the allow list.

^Only long solution, The fast solution is a more security risk , Set->Reseller Account with root permissions,...

HI,

I read a tutorial for limiting the servers bandwidth using iptables....

tc qdisc add dev eth0 root handle 1: cbq avpkt 1000 bandwidth 100mbit
tc class add dev eth0 parent 1: classid 1:1 cbq rate 256kbit allot 1500 prio 5 bounded isolated
tc filter add dev eth0 parent 1: protocol ip prio 16 u32 match ip dst 0/0 flowid 1:1

Would it be possible to add this functionality into CSF so that...

Hello,

Please add the ability to define specific protocols to be accepted, such as Generic Route Encapsulation or gre (47) for VPN tunnels.

The following are examples of the iptables rules required in the aforementioned configurations:
-A INPUT -p gre -j ACCEPT
-A OUTPUT -p gre -j ACCEPT

or

-A INPUT -p 47 -j ACCEPT
-A OUTPUT -p 47 -j ACCEPT
Preferably, each entry would be at the beginning...

I got some lovely messages from LFD this morning telling me that the mail queue had X,000 emails in it (EEK)... problem was I was asleep and didn't see the emails till around 3 hours later (25,000 emails in the queue by now). I do have my server limited to 1000 emails per domain, but I have a feeling this is ignored if they hack in or use exim direct? Anyway back to the point - the warnings are...

Currently, after XXX entries in the deny file, csf automatically starts removing the oldest entries. Is there a way to have a list of permanent deny entries that never get auto removed? Is this the global deny list, or would this be a new feature?

Rob

Hi,

Is there a way to track all WHM/cPanel/FTP logins and not just the failed ones? What we would love to see is the name of the country the person successfully logged in from in an email. Some of our clients are a bit careless when it comes to creating strong passwords.

We understand that many of the servers that support hackers are in the US but many of them are not. We do not have many...

#1 - File Integrity Checking

Being able to monitor important folders and files for changes. IE : /etc , /etc/passwd, groups , shadow, config files, system binaries . Based on md5 checkings ?

I know we got the ct states option which is a big help but I figured I would offer this suggestion from experience.

I got to noticing on a server I didn't have ct_states on that it was counting last_ack, fin_wait, close_wait etc as connections. I know about the skip time wait option but usually there is just as much of the other connection states.

I think the ct default should count...

Hi Chirpy :)

Any chance to get an alert email in such case ?

Mon Jun 16 23:41:51 2008 lfd: Error: Log line flooding/looping in /var/log/exim_mainlog. Reopening log file
Mon Jun 16 23:41:51 2008 lfd: Watching /var/log/exim_mainlog...
Mon Jun 16 23:41:57 2008 lfd: Error: Log line flooding/looping in /var/log/exim_mainlog. Reopening log file
Mon Jun 16 23:41:57 2008 lfd: Watching...

I know csf allows you to use the DShield block list. Have you considered adding the ability to send firewall logs to DShield? I'm looking into doing this outside of csf, but it would be really nice if it were just a matter of enabling it in the configuration.

Hi,
it would be nice to just enter into the main page of CSF in WHM and could see were it says:
View/Unblock the temporary IP bans the number of IPs banned. Somenthing like this:
View/Unblock the temporary IP bans (10 IPs blocked)

Regards,
Sergio

Hi,

Will be usefull to see status of mysql connections (show processlist) and exim queue. If total queue messages number (exim -bpc) is lower enough (let's say below 1000), the summ can be also display (exim -bp | exiqsumm -c)

Thanks,
Daniel

Is it possible to filter certain ICMP types as per the following list?

# 0: echo reply
# 3: destination unreachable
# 4: source quench
# 5: redirect
# 8: echo request
# 9: router advertisement
# 10: router solicitation
# 11: time exceeded
# 12: parameter-problem
# 13: timestamp request
# 14: timestamp reply
# 15: information request
# 16: information reply
# 17: address mask...

hi,

i got a question: if i whitelist a whole /24, why do i still get mail notification about blocked connections from those ip addresses? same happens with single ip whitelisted, and when i checked the iptables rules, the ip was multiple times added to DROP list.

this happens on generic install centos 5.1 64 bit.