Hello,
Brand new to CSF and really enjoy it's features. I am running Centos 5.9 with DirectAdmin and would like to know where I can enable and configure the Block IP features to operate in the Brute Force Monitor section. In advance I thank you for your response.
B -
I can manually open a connection to my SMTP Server over Port 465 from the command prompt, which tells me iptables is allowing outbound connections properly.
# iptables -L | grep -i smtp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
However, a script fails to connect to my SMTP server (SMTP using...
I keep getting this error in logs today
Unable to retrieve blocklist DSHIELD - Unable to download: 599 - Net::SSLeay 1.49 must be installed for https support
I have Net::SSLeay1.55 and I don't intend to downgrade. Have you any idea what is wrong
First of all thank you for creating this great security suite.
I believe LF_CPANEl isn't working propperly for me, I've set it to a low value (3) but CPHulk is still registering login failures past 3 failed attempts per IP.
In Watch System Logs I can see blocks made by LF_FTPD, LF_MODSEC and LF_SSHD but none by LF_CPANEl.
I am running an Asterisk system with the SIP port open to the internet. I would like csf to block SIP brute force. I have spent many hours searching and testing but my custom regex doesn't do anything. I don't see anything logged from my custom script in lfd.log and my ip is not being blocked.
I have setup a modsec script to help protect my wp-login.php file. Essentially the script that I've found will block access for the offending IP address for 5 minutes upon 10 failed login attempts over a 3 minute duration.
I'd like to utilize the LF_MODSEC portion of CSF to add them to the iptables firewall so that they're blocked right at the front door.
However, you can also set up a cluster such that some members only provide
notifications to others and do not accept blocks from others. For example, you
may have a cluster of servers that includes one that hosts a support desk that
you do not want to block clients from accessing. In such an example you might
want to exclude the support desk server from...
Found several attempts from an IP address in Russia that is attempting a brute force attack
on a sites wp-login.php script. I see every few seconds an attempt in the users domlogs file.
This causes the servers load to increase, and as soon as I block the IP, the load comes down.
/usr/local/apache/domlogs/USERNAME/domainname.tld
Can lfd monitor these logs as well, and block IP's that hit...
The CSF works after installing and activating the CSF. Test IPtables shows that everything is ok. All configuration is in default mode.
I tried to block an IP from the main screen with Quick Deny, server became inaccessible. I can't connect with putty, webmin, and all websites are down.
I can only connect through the console access provided by the hosting company, and if I disable the CSF and...
Yesterday I re-ran EasyApache (version 3.22.5) on my Cpanel / WHM server and since that time I have been getting 10-15 of these messages every hour or so:
Email subject line is:
lfd on : Suspicious process running under user
Me being my username, it's not nobody
Executable:
(deleted)/usr/bin/php
The file system shows this process is running an executable file that has been deleted. This...
CSF is not running on vps server. Trying to restart gives this :
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
Restarting bandmin acctboth chains for cPanel
Upgrading csf gives:
Oops: Unable to download: 599 - Could not...
OK so we decided to block some well known exploit and spam IPs and countries (mainly China and similar) using BOTH csf (CC_Deny setting) on the server and htaccess on specific domains.. Now here's the kicker and problem.
These blocked IPs are still getting thru to Apache and other services and generating page requests, email login hack attempts, etc..
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum