ConfigServer Community Forum

Hi

I have a email server being dictionary attacked by a botnet of over 1000 bots and am trying to find a permanent solution .

I tried limiting port 25 to only AU and GB it stopped the botnet but it also stopped mail from other countries so had to remove it this morning and the bots are now back.
is there a way to limit email login to only those countries without affecting mail received....

I've changed the ssh port as a default practice. On two new servers, both running cPanel & cPanel DNSONLY, CSF reports Check SSH on non-standard port

22 is no longer the sshd_config Port setting and is working correctly, what am I missing?

I have another older cPanel server and two non-cpanel hosts that report correctly, all are similarly configured. I do use a port < 1024, is this an issue?...

Dear guys,

Could you please help me to fix my regex to filter login failure from Squid. Its log line is:

1392714132.861 0 1.2.3.4 TCP_DENIED/407 3922 CONNECT google.com:443 username HIER_NONE/- text/html

I need to catch TCP_DENIED/407 part. Here is what I did in my regex.custom.pm but it fails to catch it:

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\ TCP_DENIED\/407/)) {...

I have updated to 6.44 and was happy to see that now you can add custom ports if LF_SELECT is set to 1 instead of editing /usr/sbin/lfd

I set up custom ports for IMAPD as follows:

PORTS_imapd = 143,993,9993

The problem is that tempbanned gets only 143,993 and 9993 in not on the list at all! I also tried leaving only the port I need, 9993 and still same issue.

I am not even sure how is...

hello,

i'm installing csf on cloudlinux server with cagefs enabled. when doing Check Server Security , the test SYSLOG_CHECK option check kept showing in red.

RESTRICT_SYSLOG is set to 3 and i can see mysyslog group is created with gid 494

on other server which is centos based, this doesn't happen. SYSLOG_CHECK option check shows in green after i set RESTRICT_SYSLOG to 3

is this supposed to...

I just wanted to double check, if I set up correctly in csf.deny , blocking of all outgoing mail to particular IP. I did it like this:

tcp|out|d=25|d=1.2.3.4 # Description (do not delete)

Not sure if it should be as the way above or tcp|out|s=25|d=1.2.3.4 # Description (do not delete)
:confused:

When I use /etc/rc.d/init.d/csf restart it says that I should use csf -r.
That works oke.

However, normally you often also should restart LFD and that worked before (if I'm not mistaken) with lfd -r too.
This does not work anymore, if you do a lfd -r to restart lfd, you get the following error notice in lfd.log and it wont restart:
*Error* attempt to start lfd when it is already running, at...

I am not sure if this is possible as I have not been able to find it, but can you configure CSF to look at another logfile and based on information cause a lock on an IP or PORT based on what it sees?

Example: I have another application that allows people to log on and would like CSF to watch that applications log files and issue a block if they have x number of invalid attempts.

I know I...

Hello,

I am trying to drop all attempts to penetrate our server via FTP from arround 30 countries, so for the moment I am using:
CC_DENY_PORTS = CN,RU,TW,VN,ID,TH,TR,KR,IR,BA,BG,BY,...
CC_DENY_PORTS_TCP = 21
CC_DENY_PORTS_UDP = 21

This is creating a very long list of IP addresses that I can see in the View iptables Rules

My purpose is to only allow 1 country, and drop all others to FTP...

I have been testing it for hours and now could surely say, it's not working the expected way.

I have the following in regex.custom

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\ \ \ user (\S*) not found:/)) {
return ( Failed domain.org directory authentication from ,$1, DomainOrgUserNotFound , 3 , 80,443 , 604800 );
}

Despite of settings in custom.regex for port numbers in...

Hello, suddenly I'm getting nf_ct_ftp errors. This happens when a web application is connecting with ftp to localhost:

kernel:nf_ct_ftp: dropping packetIN= OUT=lo SRC=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=112 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=21 DPT=39314 SEQ=3905477813 ACK=2162575321 WINDOW=256 RES=0x00 ACK PSH FIN URGP=0 OPT...

Is there a way for me to ignore the ip or hostnames of our incoming anti-spam systems in LFD? I am getting relay alerts from LFD. I dont want to completely whitelist the ip from all checks, just these relay checks.

I have noticed that when putting cc deny codes the server performance will go down, here is my cc deny list: ua,tw,ru,al,dz,tr,pl,cz,de if I put them and wget a 1gb file the server will download it at just 6 Mbps, if I leave the field empty I will download the same file at 90mbps.

I need to put the list like this because of hackers of wordpress and joomla sites mostly.

Can anyone help?

Hi,

I wrote a small regex to help me identify ip addresses trying to access my system (hackers) and block them.

For some reason it's not working but the regex was tested and it returned matching results. I'm not sure what I'm missing please help.

Here's the regex I wrote:
# Added for Freeswitch
if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^.*?\ sofia_reg.c:(.*?) SIP auth failure...

Dear guys, hi!

Is there a way to make LF_SELECT work with custom ports. For example, if I change IMAP port to some 34433, then it doesnt work, as on deny list you only have 143,193 and no custom port is appearing there?

I checked lfd.pl and found a set of default ports there:

if ($config{LF_SELECT} and !$config{LF_TRIGGER}) {
$ports{pop3d} = 110,995 ;
$ports{imapd} = 143,993 ;...

Hi group

This is our first post and welcome to everyone.

Since we recently installed ConfigServer Security & Firewall (csf v6.38), it transpires that some of the third-party enquiry forms we have had running for a number of years without problem have stopped working.

Just wondering if there might be some setting in CSF that we have missed or incorrectly configured that might be causing the...

I recently installed webmin in a BOA (Aegir) server.
Apparently csf is blocking port 10000 used by webmin.
How can I open this port for access?
I got temporary blocked when attempting to access.
Thank you.

Hello.
Is there any ways to limit packets per second from same ip address with csf?
All what i've found is PORTFLOOD - which could limit connections per time, and CONNLIMIT which can limit connections per port.
Our server is under some kind of packet flood(looks like it's a LOIC), so, we really want to know if this restrictions available with csf.
Thanks in advance.

opencart always used, but some time now, I've been having problems with locks ip in the server firewall.

I talked with the server administrator and he told me that the locks are happening due to several simultaneous connections to the database.

I am running simple routines in admin panel as product registration, or module configuration.

follows LOG blocking the ip:

Jan 29 08:14:52 web1...

Hi guys, i hope you can help me,

since update to 6.38 on dec 10 of 2013, im receiving a lot of email a few times each day, just like this:

-------------------------------------------------------------------------------------------

Time: Sat Jan 11 21:40:14 2014 -0430
Account: munin
Resource: Virtual Memory Size
Exceeded: 201 > 200 (MB)
Executable: /usr/local/cpanel/3rdparty/perl/514/bin/perl...