ConfigServer Community Forum

I'm currently having a huge amount of port tracking hit on one server : Sample Hit message :

Sample of port hits:
Aug 12 08:12:49 web17 kernel: Firewall: *TCP_OUT Blocked* IN= OUT=eth3 SRC=174.142.183.40 DST=69.46.36.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=19088 DF PROTO=TCP SPT=50260 DPT=9050 WINDOW=14600 RES=0x00 SYN URGP=0 UID=568 GID=565 Aug 12 08:12:51 web17 kernel: Firewall: *TCP_OUT...

Hello,

I am getting the following email many times since a blocked hacking attempt by almost the same IP. What is the meaning of this message ? How to ride of the message ?

202.0.0.0/8 is blocked by CSF.

Sample of port hits:
Apr 16 20:08:03 server kernel: Firewall: *UDP_OUT Blocked* IN=
OUT=venet0 SRC=xxx.xx.xxx.xxx DST=202.137.3.120 LEN=73 TOS=0x00 PREC=0x00 TTL=64
ID=51303 PROTO=UDP...

Hello,

What is this all about? We receive this when our clients install a new San Andreas server

We receice this email:

Sample of port hits:
Sep 29 11:03:10 server1 kernel: Firewall: *UDP_OUT Blocked* IN= OUT=eth0 SRC=94.176.*.* DST=83.103.133.168 LEN=117 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=7777 DPT=52209 LEN=97 UID=32043 GID=32044
Sep 29 11:03:12 server1 kernel: Firewall: *UDP_OUT...

Hi, I'm using Mandrill's SMTP sending method, which works OK but periodically (sometimes 1 day, sometimes 5 days) stops working. At that point if I go into the CSF configuration and simply click Change without changing anything, after it reloads CSF and LFD the mail sends again.

The error message that shows when it stops working is smtp error: could not authenticate.

The SMTP is set to send...

I have done a look through the forum and (amazingly) didn't find anything that matched - so, I guess I used the wrong search term!

I am testing (hence the seemingly strange restrictive values) my SSH Configuration and have these settings:

LF_TRIGGER = 1 (I don't care what service you try to access)
LF_TRIGGER_PERM = 1 (permanently block)
LF_SELECT = 0 (complete block)
LF_SSHD = 1 (active)...

What does this mean?

Excessive resource usage: lotusm (549 (Parent PID:23184))

Time: Fri Nov 15 10:09:15 2013 -0800
Account: lotusm
Resource: Process Time
Exceeded: 3261 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/perl/514/bin/perl
Command Line: spamd child
PID: 549 (Parent PID:23184)
Killed: No

Hi,

It appears that after an upgrade from CSF/LFD v7.58 to 7.59 (01/27/15) the System integrity check e-mail is no longer being send on one of our servers.

I've already tried to solve this by restarting the firewall and changing LF_INTEGRITY from 3600 to 0 and then back to 3600 again, but this did not fix it.

Any ideas would be appreciated!

The server is running CentOS 6.6, WHM 11.48.0 build...

Hello,

This is happening on a brand new server. (I.e. which was setup recently running latest cP with mod_security and CSF + CXS setup)

I have white listed Google bot, pingdom and Cloudflare IPs in csf.allow but they keep getting blocked due to mod_security (cPanel's new mod_sec rules are messy)

See the example.
root@server # csf -g 188.138.118.144
Chain num pkts bytes target prot opt in out...

Hi @ all,

how can I enable full access to a IP address? With full access I mean on any port range TCP and UDP, without having to add this port to the TCP_IN.

I've tried it with csf.allow but looks like it's not opening all ports.

Thank you very much in advance.

Regards
Andreas

I currently have LFD configured for 400 Ip blocks, which is filling up fast.
I understand that once the table has reached 400, they will fall off the end.
What's a reasonable upper limit without causing too much overhead ?

Hello, i'm new here. I have 2 vps and i have installed CSF. Can someone help me to configure corectly? I was attacked several times. Thank you.

Hi there,

I have used CSF for a number of years and never had an issue with it. All of a suden I have lost ALL access to the server. Thankfully it is running as a VPS and I can reboot it and its fine for approx 10 mins then locks again.

The ONLY way to fix this is to disable CSF and then the server is fine.

I have tried getting support but got told to ask her so I am kindly asking for some...

Hello

We have set max ip csf.deny 1000

Is it possible auto flush all blocks when csf.deny reached on 1000 entries?

Regards

I keep getting blocked if I use more thna a couple options in WHM. Yet the block doesn't show in the CSF block table. maybe a temp block or something with iptables.

Basically I logged into the WHM saw CSF was off, started it and I was blocked shortly after.

So I flushed csf -f and I had access again.

But within minutes csf stopped running and I was blocked.

I see this in the messages log a...

Hi since cPanel has upgraded, we are now using cpanel logaholic (which looks really good) we are getting Suspicious process running under user cpanellogaholic, I dont want to ignore the executable /usr/local/cpanel/3rdparty/php/53/bin/php-cgi
is there any other way to stop the warnings?

thanks in advance,

Executable:

/usr/local/cpanel/3rdparty/php/53/bin/php-cgi

Command Line (often faked...

I would like to aggregate logs from multiple servers to some service like FluentD or Logstash + Kibana + Elasticsearch.

I know that CSF (LFD actually) can log everything to syslog, but there is a huge difference between information in syslog and e-mails which are sent to some mailbox. So the question is - is there a way to enable e-mail like logging to disk (where e-mail like equals all...

Hi,

I'm trying to setup csf firewall on hostgator vps. I'v setup csf firewall on multiple servers before and never had an issue with it .

Unfortunately on this server each time I enable csf firewall, all traffic is beeing dropped.
e.g.
Feb 14 02:08:25 hostname kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=Macaddres SRC=UserIP DST=ServerIP LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=52420 DF...

Could someone point me in the right direction because I feel quite lost.
I have tried to search for an example or clue on this forum and Google. But I can't find a working custom regex.

I'm on a Debian server with DirectAdmin

The following is found in /var/log/proftpd/auth.log
ProFTPd 123.123.123.123 PASS (hidden) 530

Since this format is not caught by default I have tried to create a custom...

I have a question about using IPSet with CSF. I'm fairly familiar with IPset but I'm not sure how it works with CSF. For example:

# ipset create bruteforcers hash:ip hashsize 4096
# iptables -I INPUT -m set --match-set bruteforcers src -j DROP
# ipset add bruteforcers 128.230.193.152
# ipset test bruteforcers 128.230.193.152
128.230.193.152 is in set bruteforcers.
# iptables -L | grep...

Hi all,

Need some advice.

LF_MODSEC = 5
LF_MODSEC_PERM = 300

LF_CXS = 1
LF_CXS_PERM = 300

I have the following settings and have Modsecurity, CXS and CSF installed though IPs are not being blocked after 5 ModSec hits:

ModSecurity: Warning. Pattern match 200 at RESPONSE_STATUS.
ModSecurity: Warning. Pattern match 200 at RESPONSE_STATUS.
ModSecurity: Warning. Pattern match 200 at...