ConfigServer Community Forum

Dear Team

i have vps with Xeon 4 cores and 3GB ram with Shared hosting environment

Some users giving lot of load to server with many https connections .. some are trying Dos attacks on server

I need prevent all these

Any one please suggest Generic settings for CONNLIMIT and PORTFLOOD to Stop Dos and some other attacks ..

Please suggest these settings ..

thamks

My IP table is Good. No Error.

TCP_IN = 20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,2095,2096,30000:35000

But still my FTP has the same problem. Connection error or Try PASSV mode this kind of error!

100Times I Restart CFS and FTPD.

I also try to reinstall csf! :(

But same.. Plz Help me!

I have created /etc/csfuibuttondisable and CSF button colors continue the same.

Sergio

Is there an instruction on how to add this to /etc/csfuibuttondisable - is at a file? a selection in the firewall configuration?

I am trying to allow a particular IP address to access port 3306. I have removed 3306 from the TCP_IN list in csf configuration, and am trying to add the IP address to the csf.allow file. I have tried the following:

d=3306:s=11.22.33.44
d=3306|s=11.22.33.44
tcp:in:d=3306:s=11.22.33.44
tcp|in|d=3306|s=11.22.33.44

...where 11.22.33.44 is the IP address I want to allow, but after restarting the...

Is it possible to refresh the Dyndns allow list using a URL?

The reason is my firewalls will check every 15 minutes if my IP has changed, but in emergencies this is quite bad, but its rare, so I dont want to set it to refresh every 1 minute.

So I wondered if I can kick start this refresh externally, like from a URL or something? So in an emergency I update my IP, then I call this URL to...

Hi,

I'm running csf 6.30 on Cloudlinux and having issues with some css files not loading.

Log:

Failed to load resource: the server responded with a status of 503 (Service Unavailable) file.css

When I turn off csf this error disappears. Any ideas what can cause this?

EDIT: Not only CSS files are affected, seems to be all random, can it be because of to low CT_LIMIT?

For the last several months I've spent several hours a day battling with dictionary attackers and various hacker attempts on my server, and most of that time was busy inputting IP's to block through the firewall. But your last upgrade has been a godsend! Now you automatically detect and block 99% of the cretins who were causing my server overloads just a month ago. I hardly know what to do with...

Is there some way that CSF can be used to effectively prevent the attack described in CVE-2010-5107? I'm not overly concerned about this issue (it *has* existed for 11 years, after-all) but the third-party company that does security scans for PCI compliance wants it resolved. The suggested solution is to upgrade OpenSSH to 6.2 to use new feature that mitigate this risk but 6.2 is very new and...

Hello everyone,

Does anybody experiences this particualr issue? When I have csf enabled, my server shows a very bad ping, up to 70% packet loss in my ping report. But when I disabled it, ping goes back to 100%.

Can anybody help?

Thanks n advance.

We have found that if a user is in a screen or tmux session and they su or sudo su an alert is not fired. If the user exits their screen/tmux session, the alerts will fire just fine.

It seems to be poorly documented that who am i does not properly return a user when the session is in screen/tmux. However, logname and other env variable such as $SUDO_USER will return the base user.

Is lfd making...

Im getting 2 emails an hour about a maintenance process using wget

Ive tried adding the process to a ignore files a couple different ways and have not been successful

Any pointers would be helpful

Time: Mon Apr 11 07:01:44 2011 -0500
PID: 18054
Account: taccpount
Uptime: 102 seconds

Executable:
♦

Command Line (often faked in exploits):

wget -q -O /dev/null

this server has been...

I recently made a change in one of my firewall settings and was going to restart csf and lfd. However, there is an error regarding the CLUSTER_PORT that I don't understand. That's not a change that I made and it is saying:

CLUSTER_PORT sanity check. CLUSTER_PORT = . Recommended range: 1023-65535 (Default: 7777)

When I go and look at the Cluster port section of the firewall, it's not a field...

Run

/scripts/upcp --force

And try again

Hi, folks. I've seen a few posts around the web about this problem from other OVH customers, but sadly no solutions... I've gotten a bit further than previous posters, but now I'm stuck. Can anyone point me in the right direction?

I've set up csf on a dedicated CentOS server at OVH. It's using a 3.8.13 kernel that they've compiled, rather than the stock 2.6.X kernel. It works great except for...

The ? i have is:

Why are ip's that i have entered into the Quick Deny fnc still getting thru the Firewall attempting to login to my wp admin panel? I have set the security level to Medium.

:confused:

Hello

I have server with cpanel/WHM on board and 2 IP, 1 public and 1 private.

What need is to deny to user to ping private lan, because private lan must still to internal usage.

cpanel support reply us this:
I see CSF Firewall is installed so you may want to look at adding specific port and destination rules in /etc/csf/csf.deny and /etc/csf/csf.allow.

Any idea ? I don't know if this is...

hi

how can i allow specific port for specific ip using GUI web interface?

We are being hit hard by a botnet and hundreds of ip's are poring in requesting many requests , in order to mitigate attack we set

CONNLIMIT = 80;200

and
PORTFLOOD = 80;tcp;200;5

the original was to set those at 80/20 but Softlayer admin says that we should count how many links ( a href ) we have on the pages,

on each page we have no more than 15 images loading but we do have plenty of...

Hi
I wanted to ask since released software version CSF
I have full of people who can not get into my server
I wanted to ask with this new feature related to UDP packets
What should I name this feature set
I defined as:
UDPFLOOD = 1
UDPFLOOD_LIMIT = 70 / s
UDPFLOOD_BURST = 250

UDPFLOOD_ALLOWUSER = named

Is this a good bank or abnormal at all?
Still I get UDP attacks is not clear why it blocks...