ConfigServer Community Forum

Hi I've noticed that some SKY IP ranges are not being correctly identified by the CC checking. On one server we have GB ignored, but I keep seeing LFD blocking them.

Time: Thu Feb 27 22:30:36 2014 +0000
IP: 5.65.121.x (GB/United Kingdom/xxx.skybroadband.com)
Failures: x (smtpauth)
Interval: x
Blocked: Temporary Block

If the country is being correctly identified via the geoip lookup - why is...

Hello,

In three installations of VPS with Centos 6, I have have configured csf to exchange information. All the cluster commands works perfect except the remove command.

My own ip got blocked. During the trial to identify, the C Block of my provider got blocked.

I was logged in Webmin in all servers. I have issued cluster remove ip address.

This did not function.

Hello,

I have updated csf to 4.46.

I found that Connection Tracking does not work although those ips are noted in tempip file.

For a very strick connection tracking, I have the following:

CT_LIMIT = 2
CT_INTERVAL = 200
CT_PORTS = 25,137,445

On the above ports there is constant spamming. The third connection should be imposing a temporary block (perm=0). This occurs very rarely although...

I think I am looking at a solution for this...kind of backward, but is there a way to tell CSF to only let IP addresses from USA log into WHM, CPanel, Email etc??

I really need to read up on CSF and understand it, but I am trying to calm a company down who is worried about the number of attempts they have had with people trying to log into their site.

Any help is apprecaited.

I'm just using the new option for using wildcards in logs as followed:
HTACCESS_LOG = /var/log/httpd/error_log /var/log/httpd/domains/*.error.log

Now we have a regexp.custom.pm like this:
if (($config{LF_HTACCESS}) and ($lgfile eq $config{HTACCESS_LOG}) and ($line =~ /^\ \ \ My protection (.*) banned IP: (\S+)/)) {
return ( Mytrap triggered ,$1, bottrap ,1, 80,443 , 3600 );
}

This makes a...

Probably something simple that I missed here, but I'd love some insight.

I changed the default FTP port on my host, and notified my members of the change. For the sake of conversation, I'll say I changed it to 888. I'm running Pure-FTPD, and change the bind port in pure-ftpd.conf.

I can FTP right in because my client is in the allow file, but nobody else can. I added the new port to csf.conf...

hello all - (newbie first time posting)

i have noticed my log files are filling up with wp-login.php attacks. my wordpress site itself is secured with a 2 second login-delay along with two separate captchas (yes its overkill but it helps me sleep at night)

however, there are thousands and thousands of attacks, most taking place between 4 and 6am (eastern standard time).

my problem is that one...

Can someone explain the process of changing the SSH on non-standard port,

(whm / cpanel)

Also, if this is changed to a non-standard port, what port is recommended?

After it is changed, what would need to be changed in CSF?

Thank you

I write this post because I have a problem I can not solve despite having made ​​the changes proposed in many other posts on the forum.
My server is set up to work in pure-ftpd
Some users are blocked firewall of some not
The changes that I have made ​​I have taken from this post:
viewtopic.php?f=6&t=4091&hilit=ftp+connection+tracking

Does anyone have the same problem or has found a way to...

Hello in my server i change the ssh port from 22 to 4176
i also open the tcp_in and tcp_out this port and delete the 22

I can login to the ssh. I also try from another ip to be blocked or alerted.
Nothing happened
In the allow ips this ip it is not stated there
also in deny

so what can i do to be informed or even alerted whenever someone tries to login in this port??

Thanks in adavnce

I'm seeing these (and similar) messages in my LFD log scanner files.

/usr/local/cpanel/logs/error_log:
repquota: Cannot open quotafile //quota.user: No such file or directory

What do they mean, and how can I fix them?

Hi.
I have many blocked IPs in csf with do not delete comment. But every day I got notifications from server about new brute force attacks via some of these IPs.
What's the problem ?

Hi

I work with ConfigServer Security & Firewall - csf v6.45 and I'm receiving this emails continuosly.

Server:
Primary IP:
Service: lfd
Notification Type: failed
Notification: lfd failed @ Thu Feb 20 13:59:39 2014. A restart was attempted automagically.
Service Check Method:
Number of Restart Attempts: 63
Memory Information:
Used: 356MB
Available: 1521MB
Installed: 1877MB
Load Information:...

I have interrupted the restart process of csf and now can do anything but connect from the console.

In the /var/lib/csf there is a file csf.lock

I I disable the firewall than it works?

What should I do??

Good day!

Could you please recommend how to make LFD watch one of the IP that is on my interface (local).

I use Squid to connect to my proxy server. When I try to login to webmin and fail on purpose (to check), LFD does nothing? From other IPs it works fine!

How to force LFD to watch one of my local IPs?

Hello,

I have a server being attacked in the form of a botnet. I am getting 50 emails a day (since the last two days) like this:

Time: Tue Feb 4 17:07:09 2014 -0500
IP: 213.186.183.252 (JO/Jordan/-)
Failures: 5 (smtpauth)
Interval: 3600 seconds
Blocked: Permanent Block

Log entries:

2014-02-04 17:06:15 dovecot_login authenticator failed for ( )
:59438: 535 Incorrect authentication data...

I see the below in lfd logs.
Exceeded POPRELAY limit* from xxx.xxx.xxx.xxx (102 in the last hour)
what dies POPRELAY actually mean ?

csf.conf shows this value as 100

csf v6.44

Since the update, script alerts with a sample of the first 10 emails seem to carry false positives.

2014-02-20 07:15:03 cwd=/ 2 args: /usr/sbin/exim -bpu
2014-02-20 07:15:04 1WGDXq-002WrH-7F => user1 R=localuser T=local_delivery
2014-02-20 07:15:04 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1WGDXs-002XAv-Ap
2014-02-20 07:15:04 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc...

I have installed (latest) csf on a Proxmox server (Debian 7.4) and I want to start using ipv6 (which is enabled on the server with a /64 subnet.

My ipv6 settings in CSF:

IPV6 = 1
IPV6_ICMP_STRICT = 1 (to disallow incoming ICMP via ipv6)
IPV6_SPI = 1

I am pinging my server however from a remote site (

and I getting a normal response (0% loss)

Why?
Does this mean that CSF is not working on...

I can't believe that I am writing about this matter again! I don't know if it a bug or it's me (most likely) but this time it doesn't seem that obvious!

I have to detect failed logins to my XMPP server (Prosody). The log line (with spaces as it is):

Feb 19 15:02:04 domain.ru:log_auth warn Failed authentication attempt (not-authorized) from IP: 1.2.3.4

The regex is:...