ConfigServer Community Forum

For some odd reason CSF is blocking Softether VPN from working.

Essentially I keep csf enabled but flush all the firewall rules. I then connect via VPN(L2TP) and connect successfully (ip is assigned) however the internet will not work. If i disable CSF the VPN works fine with internet passing through and everything. Again: When i have CSF enabled I am allowing all ports in and out (for testing...

Hi,

I have only been using csf for a week or so now and I keep getting emails every couple hours saying

Server:
Primary IP:
Service: lfd
Notification Type: failed
Notification: lfd failed @ Sat Mar 29 18:07:43 2014. A restart was attempted automagically.
Service Check Method:
Number of Restart Attempts: 1
Syslog Messages:
Mar 29 14:05:01 alpha lfd : SYSLOG check
Mar 29 14:00:00 alpha...

Hello ,

On VPS Centos 6 64 we have installed firewall, when a client was to import example something on Wordpress or upload on website something or even install script he gets timeout and erros. When the firewall gets disabled all working perfectly! Any advice?

How to disable the below message to get to the email ????

Time: Sun Mar 30 22:15:15 2014 +0300
IP: xxxxxxxx (IT/Italy/host52-118-dynamic-telecomitalia)
Failures: 5 (smtpauth)
Interval: 3600 seconds
Blocked: Permanent Block

Hello,

I am trying to find a way to control the sending of distributed attack emails notifications only. I can't seem to find a way to do this. The reason is there are so many of these notifications, upwards of a thousand a day, for smtp and ftp.

Is there a way to manage specific lfd email notifications?

L

Used the web-based configuration manager to set the config for CSF.

I see that there is a setting to take an IP / IP range from a temporary block to a permanent block.

I've enabled this functionality as such:

LF_PERMBLOCK = 1
LF_PERMBLOCK_INTERVAL = 86400
LF_PERMBLOCK_COUNT = 4
LF_PERMBLOCK_ALERT = 1

However, I am unsure where these settings are used. En general, what I am looking at doing is...

Getting hundreds of these attacks:

82.98.162.20 - - GET /administrator/index.php HTTP/1.0 401 -

I have enabled the HTACCESS and MODSEC and set the log files to the proper place, but these are not being stopped.

I have a setup with DirectAdmin and CSF.

Default HTACCESS_LOG = /var/log/httpd/error_log is set.
BUT this monitors only a site configured at /var/www

DA puts an error.log file for every virtual domain in /var/log/httpd/domains/domain.tld.subdomain.error.log

If I am not mistaken these log files in /var/log/httpd/domains are NOT monitored!

The preferred method of monitoring all error.log files...

Hello, i know that I can use this url:
cloudflare(dot)com/api.html?a=ban&key= &u=CLOUDFLARE_LOGIN&tkn=CLOUDFLARE_API_TOKEN
 
to send banned ips to cloud flare, and this

cloudflare(dot)com/api.html?a=nul&key= &u=CLOUDFLARE_LOGIN&tkn=CLOUDFLARE_API_TOKEN
to remove the ban.

The situation is pretty simple and common: we have CSF on the server, and some sites without cloudflare can block the...

Could an iptables expert look at this guide and see if it is compatible with CSF ?

If so, maybe it could be added to the server analysis page?

I am unable to find a way to address this in the csf.conf file, though I assume it is there...

It appears as though all traffic to all ports is allowed in if the source port is 53.

# iptables -L -n | grep spt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53

This would seem to open a hole for anyone to get in as long as they were using Port 53 out...

Hi an issue has started happening on my centos 6.4 x64 kvm vps only in the last 24 hours where all ports are being blocked so there is no access to the vps. The only access that works is via vnc in the Solusvm control panel. If i restart csf the problem clears for up to 20 mins sometimes but then it blocks ports again. checking the logs at the times of when the problem occurs im seeing this entry...

hello all -

there are many times a certain page, particularly a login-page, seems to get hit hundreds (or even thousands) of times per minute. obviously this is some sort of hack attempt.

i seem to recall there was some way in CSF to space out multiple hits to the same page from the same IP number. or put another way, maybe a way to only allow one page from one particular IP every 20 seconds or...

In the Server Services Check section of 'security test', all options are green, so I thought I had passed all checks.

Then I read the descriptions and they seem to _ALL_ be saying that in fact I _AM_ running all of the services and I'd be better off not doing so.

Should those checks not actually show up red as a failure then?

Here's the text displayed in one of them:

On most servers cups is...

CSF 6.47 or maybe a bit earlier version ( I've been on vacation for a several months :) ) seems to have made ALL my carefully researched CIDR block ranges and the few ISO country code blocks I use disappear!!!

I had a few hundred CIDR block ranges in CSF_DENY, and four ISO coutry code blocks established in CSF_config, and now they are totally gone.

ALL the CIDR entries were correctly marked as...

Hi,
just to report the following.

When an IP is added to the temporary list CSF.TEMP, the firewall rules created are as follow:
Chain num pkts bytes target prot opt in out source destination

DENYIN 50 0 0 DROP all -- !lo * 123.123.123.123 0.0.0.0/0

PREROUTING 68 0 0 REDIRECT tcp -- !lo * 123.123.123.123 0.0.0.0/0 multiport dports 80,2082,2095 redir ports 8888
PREROUTING 69 0 0 REDIRECT tcp...

Unable to download: 599 - Net::SSLeay 1.49 must be installed for https support

perl module versions installed:
Net::SSLeay 1.54
IO::Socket::SSL 1.79_01

and yet SSL failure still occurs?

tiny.pm code shows this

sub _assert_ssl {
# Need IO::Socket::SSL 1.42 for SSL_create_ctx_callback
die(qq/IO::Socket::SSL 1.42 must be installed for https support\n/)
unless eval {require IO::Socket::SSL;...

Is there a way to create a block rule, or any way to set it up to auto block based on the port? For example if a customer fails SMTP auth 15 times, can it just block them on port 25? Or if they fail an HTTP authentication X times it blocks them on port 80 only?

Also how about rules just being created for deny, why do we need deny and denyout for every block on an IP created.

Thank for the...

Team

I'm using Centos 5.10 with latest CSF installed. Yesterday I did some changes from UI. I only changed SU/SSH login alerts set to root and it was working great for like 6 hours. Today when I saw my mail box I got around 50 mails with this

===
lfd failed @ Wed Mar 26 06:55:41 2014. A restart was attempted automagically.
===

Then I quickly checked few things, but I was getting these errors...

how to disable Temporary ban i want to Complete disable it and if some one Attack only Ban them ;) is that possilbe