ConfigServer Community Forum

Hi.
I have many blocked IPs in csf with do not delete comment. But every day I got notifications from server about new brute force attacks via some of these IPs.
What's the problem ?

Hi

I work with ConfigServer Security & Firewall - csf v6.45 and I'm receiving this emails continuosly.

Server:
Primary IP:
Service: lfd
Notification Type: failed
Notification: lfd failed @ Thu Feb 20 13:59:39 2014. A restart was attempted automagically.
Service Check Method:
Number of Restart Attempts: 63
Memory Information:
Used: 356MB
Available: 1521MB
Installed: 1877MB
Load Information:...

I have interrupted the restart process of csf and now can do anything but connect from the console.

In the /var/lib/csf there is a file csf.lock

I I disable the firewall than it works?

What should I do??

Good day!

Could you please recommend how to make LFD watch one of the IP that is on my interface (local).

I use Squid to connect to my proxy server. When I try to login to webmin and fail on purpose (to check), LFD does nothing? From other IPs it works fine!

How to force LFD to watch one of my local IPs?

Hello,

I have a server being attacked in the form of a botnet. I am getting 50 emails a day (since the last two days) like this:

Time: Tue Feb 4 17:07:09 2014 -0500
IP: 213.186.183.252 (JO/Jordan/-)
Failures: 5 (smtpauth)
Interval: 3600 seconds
Blocked: Permanent Block

Log entries:

2014-02-04 17:06:15 dovecot_login authenticator failed for ( )
:59438: 535 Incorrect authentication data...

I see the below in lfd logs.
Exceeded POPRELAY limit* from xxx.xxx.xxx.xxx (102 in the last hour)
what dies POPRELAY actually mean ?

csf.conf shows this value as 100

csf v6.44

Since the update, script alerts with a sample of the first 10 emails seem to carry false positives.

2014-02-20 07:15:03 cwd=/ 2 args: /usr/sbin/exim -bpu
2014-02-20 07:15:04 1WGDXq-002WrH-7F => user1 R=localuser T=local_delivery
2014-02-20 07:15:04 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1WGDXs-002XAv-Ap
2014-02-20 07:15:04 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc...

I have installed (latest) csf on a Proxmox server (Debian 7.4) and I want to start using ipv6 (which is enabled on the server with a /64 subnet.

My ipv6 settings in CSF:

IPV6 = 1
IPV6_ICMP_STRICT = 1 (to disallow incoming ICMP via ipv6)
IPV6_SPI = 1

I am pinging my server however from a remote site (

and I getting a normal response (0% loss)

Why?
Does this mean that CSF is not working on...

I can't believe that I am writing about this matter again! I don't know if it a bug or it's me (most likely) but this time it doesn't seem that obvious!

I have to detect failed logins to my XMPP server (Prosody). The log line (with spaces as it is):

Feb 19 15:02:04 domain.ru:log_auth warn Failed authentication attempt (not-authorized) from IP: 1.2.3.4

The regex is:...

CSF 6.43

I don't see the firewall security level option any more? This was great, made it easy to set per-defined levels. Any idea why its gone now?

Hi

I have a email server being dictionary attacked by a botnet of over 1000 bots and am trying to find a permanent solution .

I tried limiting port 25 to only AU and GB it stopped the botnet but it also stopped mail from other countries so had to remove it this morning and the bots are now back.
is there a way to limit email login to only those countries without affecting mail received....

I've changed the ssh port as a default practice. On two new servers, both running cPanel & cPanel DNSONLY, CSF reports Check SSH on non-standard port

22 is no longer the sshd_config Port setting and is working correctly, what am I missing?

I have another older cPanel server and two non-cpanel hosts that report correctly, all are similarly configured. I do use a port < 1024, is this an issue?...

Dear guys,

Could you please help me to fix my regex to filter login failure from Squid. Its log line is:

1392714132.861 0 1.2.3.4 TCP_DENIED/407 3922 CONNECT google.com:443 username HIER_NONE/- text/html

I need to catch TCP_DENIED/407 part. Here is what I did in my regex.custom.pm but it fails to catch it:

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\ TCP_DENIED\/407/)) {...

I have updated to 6.44 and was happy to see that now you can add custom ports if LF_SELECT is set to 1 instead of editing /usr/sbin/lfd

I set up custom ports for IMAPD as follows:

PORTS_imapd = 143,993,9993

The problem is that tempbanned gets only 143,993 and 9993 in not on the list at all! I also tried leaving only the port I need, 9993 and still same issue.

I am not even sure how is...

hello,

i'm installing csf on cloudlinux server with cagefs enabled. when doing Check Server Security , the test SYSLOG_CHECK option check kept showing in red.

RESTRICT_SYSLOG is set to 3 and i can see mysyslog group is created with gid 494

on other server which is centos based, this doesn't happen. SYSLOG_CHECK option check shows in green after i set RESTRICT_SYSLOG to 3

is this supposed to...

I just wanted to double check, if I set up correctly in csf.deny , blocking of all outgoing mail to particular IP. I did it like this:

tcp|out|d=25|d=1.2.3.4 # Description (do not delete)

Not sure if it should be as the way above or tcp|out|s=25|d=1.2.3.4 # Description (do not delete)
:confused:

When I use /etc/rc.d/init.d/csf restart it says that I should use csf -r.
That works oke.

However, normally you often also should restart LFD and that worked before (if I'm not mistaken) with lfd -r too.
This does not work anymore, if you do a lfd -r to restart lfd, you get the following error notice in lfd.log and it wont restart:
*Error* attempt to start lfd when it is already running, at...

I am not sure if this is possible as I have not been able to find it, but can you configure CSF to look at another logfile and based on information cause a lock on an IP or PORT based on what it sees?

Example: I have another application that allows people to log on and would like CSF to watch that applications log files and issue a block if they have x number of invalid attempts.

I know I...

Hello,

I am trying to drop all attempts to penetrate our server via FTP from arround 30 countries, so for the moment I am using:
CC_DENY_PORTS = CN,RU,TW,VN,ID,TH,TR,KR,IR,BA,BG,BY,...
CC_DENY_PORTS_TCP = 21
CC_DENY_PORTS_UDP = 21

This is creating a very long list of IP addresses that I can see in the View iptables Rules

My purpose is to only allow 1 country, and drop all others to FTP...

I have been testing it for hours and now could surely say, it's not working the expected way.

I have the following in regex.custom

if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\ \ \ user (\S*) not found:/)) {
return ( Failed domain.org directory authentication from ,$1, DomainOrgUserNotFound , 3 , 80,443 , 604800 );
}

Despite of settings in custom.regex for port numbers in...