Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm in no way a sysadmin, so bear with me a little.

I have a cloud server running Centos 5. I have Virtualmin/Webmin with a handful of sites running without issue. I also have CSF installed to stop persistent bot attacks.

I can access all my sites HTTP and HTTPS (without SSL) and they work fine.

When I attempt to access my Webmin's web interface

https://myhost.co.uk:10000

My browser hangs, eventually times out. I can no longer access any of my sites due to CSF adding my IP to the temp disallow list, here's the log entry:

*Port Scan* detected from 213.86.xxx.xxx (GB/United Kingdom/-). 16 hits in the last 187 seconds - *Blocked in csf* for 3600 secs

Once I unblock my IP and add it to the temp allow list, I can access the web UI login page.

Any ideas why the initial request is being disallowed?

share|improve this question
1  
Is port 10000 in your TCP_IN and TCP_OUT settings? –  ceejayoz Jan 9 '13 at 17:40
    
No - I just added them in and it seems to have fixed the issue. Feel free to answer this question and I'll accept it. –  Dan J Jan 10 '13 at 12:03
    
Glad to hear it, will do! –  ceejayoz Jan 10 '13 at 16:38

1 Answer 1

up vote 3 down vote accepted

CSF will consider any hits to ports not whitelisted in csf.cfg's TCP_IN setting to be a port scanning attempt.

Since 10000 is a legitimate port for you, add it to the list in TCP_IN and TCP_OUT and you'll be good to go.

share|improve this answer
    
If you do this, then anyone can access the Webmin login. We use approved IP addresses and using GLOBAL_DYNDNS in CSF, so we cannot allow port 10000, so in this case for us, this solution is not a solution. Its best to identify the reason for port scanning. We have many port scanning to one server, not our others, very strange. –  Laurence Cope Feb 2 at 12:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.