ConfigServer Security & Firewall

learn more… | top users | synonyms

0
votes
0answers
16 views

CSF game servers (team fortress 2) only 20 connections allowed [on hold]

I've question about CSF firewall. I've been running from my high-end dedicated server many websites and csf have been answer to my prayers. But when I try to run team fortress 2 servers only 20 ...
1
vote
1answer
17 views

SSH connection gets dropped when attempting to deploy site using rocketeer

I'm trying to deploy a Laravel site to a development server (cPanel based) using Rocketeer. I am having a problem maintaining the SSH connection, and the server is dropping the connection after ...
0
votes
0answers
10 views

CSF not blocking ports [closed]

Yesterday I've installed CSF on my VPS. I blocked many ports on my machine (allowing only these included in /etc/csf/csf.conf However, my services like teamspeak or mumble server are still able to be ...
0
votes
2answers
36 views

Openning a port in my CentOS server [closed]

I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
1
vote
1answer
101 views

How to prevent brute force attacks on exim service through csf?

It's 3rd days that my VPS has too many brute force attacks on exim. Server features: CentOS 6 64-bit, CSF 7.03, DirectAdmin 1.43.3 I would like to stop these attacks. But I don't know what is the best ...
0
votes
1answer
97 views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
0
votes
0answers
113 views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...
0
votes
1answer
84 views

CSF cc_deny is not working

I tried to block a country in CSF Firewall I followed this post http://www.2daygeek.com/how-to-block-a-country-using-csf-firewall/ to block ip from China cc_deny ="CN" While I execute csf -r I ...
1
vote
1answer
71 views

CSF Blocking IP on Fail POP3 and cPanel

I have a VPS with cPanel and i am running around 400+ email accounts under a Office Network, I don't have STATIC IP but i am facing issue when any 1 of employee forget the password and try to access ...
-1
votes
1answer
86 views

Cpanel + CSF + suPHP = no php brute force protection?

I have NOT found anyone else talking about brute force detection in CSF with suPHP enabled. Maybe I'm not seeing the real picture or need but it feels that suPHP is weak at brute force detection. Is ...
0
votes
1answer
92 views

Cannot close Port 25 after installing postfix

Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf PORT STATE SERVICE 25/tcp filtered smtp After installing logwatch (which installs ...
0
votes
0answers
40 views

new attacks from banned IPs in CSF

I have many blocked IPs in csf with "do not delete" comment. But every day I got notifications from server about new brute force attacks via some of these IPs. When I want to add the attacker IP to ...
0
votes
0answers
203 views

How to set csf to block brute force attacker's IP beside DirectAdmin settings?

I have a VPS with CentOS, DirectAdmin and CSF. This is what I have set in DirectAdmin: But as I talked with DirectAdmin support team, when CSF is installed on the server, these settings don't ...
1
vote
1answer
68 views

WHM/CSF disregard failed logins to cpanel/webmail etc from certain country ?

Anyone knows if it's possible to disregard failed logins to certain services in WHM/CSF by country ? e.g. I would like that users that are accessing server from my country, don't get banned if they ...
0
votes
1answer
117 views

csf stop emails related to Process Tracking

I have enabled LSF with CSF since I would like to receive some informations but I am being bombed by the CSF with similar emails: Subject: lfd on [Hostname]: Excessive resource usage: www-data ...
0
votes
1answer
67 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
0
votes
1answer
314 views

Port forwarding through OpenVPN server

Here's my scenario: Remote OpenVPN server v2.3.2, 1 public IP, CentOS 6.4, 2.6.32-042stab079.6 Tunnelblick (OpenVPN client) What I want to do is route all the client traffic through the VPN - and ...
0
votes
0answers
341 views

Is CSF's recommended Connection Tracking Limit (CT_LIMIT) of 300 connections reasonable?

CSF recommends setting CT_LIMIT to 300 to block small ddos attacks as per http://configserver.com/free/csf/readme.txt I Would like to enable this connection limiting / tracking via CSF, as I have ...
0
votes
1answer
251 views

Proxmox 31 + KVM routing + IP subnet + csf

We have proxmox 3.1 server in netzner with routuing network and IP subnet block. We want to implement csf firewall without interfering the traffic of the KVM VMs, what would be the easiest way? We ...
0
votes
1answer
200 views

ConfigServer CSF and iptables config

I'm aware there is a /etc/sysconfig/iptables file, with rules for iptables (and what's the effective difference with /etc/sysconfig/iptables-config?). I installed CSF & LFD. You can configure ...
0
votes
0answers
80 views

Extract IPs from exim_rejectlog with particular error then automatically add IP to a csf or iptable

Is there a command to do this in linux? For example extract IPs from exim_rejectlog with particular error dropped: too many syntax or protocol errors Count how many times an IP is listed and if it ...
0
votes
1answer
111 views

Memcached ports and CSF

I've got a small / medium sized VPS powered by WHM and running a few personal websites alongside a Magento powered web-store. Not being a real expert when it comes to server configuration details I've ...
0
votes
1answer
113 views

Mail Authentication Randomly Failing

This started about 4 days ago on a production server. Clients started getting random incorrect password dialog boxes in their email programs, most use Outlook. This happens for email addresses on all ...
0
votes
1answer
795 views

Hacking attempt detected, Can we block user by PC-Name

Recently we notied that hackers are trying to hack our server, we have IP blocking softwares installed on our server but the thing is that, hacker is using dynamic ip addresses to try again and ...
0
votes
1answer
415 views

Ubuntu Server DDoS protection [duplicate]

I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
0
votes
1answer
175 views

Open torrent ports in csf

I use aria2 on my office with debian linux and aria2web to download some torrents on that. in brief it's a torrent client. but if i turn on csf, aria2c can't do that. which config should i do for csf ...
0
votes
1answer
67 views

How to block access from all hosting services? (like gutenberg.org) [closed]

gutenberg.org blocks access to all hosting services as per http://www.gutenberg.org/error403.php How to achieve this? Is there a list of hosting ips? Also, would these be added to CSF?
0
votes
1answer
541 views

IPTABLES nat maintaining source IP address with CSF

We have been using CSF on a virtualized (OpenVZ) environment successfully for a while combining venet and bridged interfaces so we can use public IPs + local addressed virtual systems. Kernel IP ...
1
vote
1answer
396 views

How to white-list specific PHP script process in CSF?

I repeatedly receive a "Suspicious Process" notice from lfd. I'm 100% positive that the PHP script triggering this warning is safe. I wrote it myself and it makes some cross server calls that must ...
0
votes
1answer
324 views

Does LFD check for failed HTTP Digest login attempts?

I am sure that LFD (Login Failure Daemon) checks Apache's error log for failed HTTP authentication attempts ie. log entries like: [Mon Feb 25 10:12:45 2013] [error] [client 10.0.0.1] user FAKEUSER ...
0
votes
1answer
2k views

cPanel server - Dovecot logins failing on specific IP address

I'm having a strange issue with one of our cPanel/WHM servers where it appears to be failing dovecot (IMAP/POP3) logins only from a specific IP address. The client was setting up a new workstation and ...
-1
votes
3answers
863 views

Not using SSH Pubkey Authentication is really serious security flaw compare to regular Password Authentication

How would using PubkeyAuthentication would be in a single way more secure than using PasswordAuthentication, considering the fact that the server's Firewall blacklists an IP after 2 unsuccessful ...
1
vote
1answer
347 views

csf/lfd parameter that prevent smtp attacks?

I have a 4~5MB logwatch like this every day! someone like to hack my smtp: .... --------------------- sasl auth daemon Begin ------------------------ SASL Authentications failed 3965 Time(s) ...
1
vote
1answer
923 views

CSF/LFD - Suspicious processes when running nginx+php5-fpm+ Mysql

I am running LFD/CSF on three servers and on all servers I have the same problem since the first day when I set-up the server and installed LFD/CSF. I have nginx + php5-fpm + MySQL installed and ...
0
votes
1answer
157 views

Interpreting CSF emails

I get emails from CSF every time it blocks someone. Here's one I got this morning: Time: Sat Jan 19 10:17:24 2013 -0800 IP: <REDACTED> (US/United States/-) Hits: 21 Blocked: ...
3
votes
1answer
536 views

CSF blocks my IP trying to access Webmin

I'm in no way a sysadmin, so bear with me a little. I have a cloud server running Centos 5. I have Virtualmin/Webmin with a handful of sites running without issue. I also have CSF installed to stop ...
1
vote
0answers
117 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
0
votes
2answers
298 views

Error when restarting csf on DirectAdmin server running centos

I just installed csf on a DirectAdmin server running CentOS. When i restart csf it however says: Restarting bandmin acctboth chains for cPanel open3: exec of /usr/local/bandmin/bandminstart ...
1
vote
1answer
841 views

MySQL port 3306 blocked in csf yet can still telnet to port 3306 from external host

We have a Centos 6 VPS that was recently migrated to a new machine within the same web hosting company. It's running WHM/cPanel and has csf/lfd installed. csf is set up with mostly vanilla config. ...
1
vote
1answer
188 views

LFD always stops working after ~30 days, until I give /etc/csf/csf.pl -r

When I give /etc/csf/csf.pl -r , I see lots of lines flushing, then I begin to get the notification emails again, (several emails per day), for example: Time: Wed Sep 12 08:39:47 2012 +0800 IP: ...
2
votes
1answer
174 views

Best way for automated ban / throttle of aggressive clients on a Linux / Apache webserver for a period of time?

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best ...
0
votes
1answer
220 views

Exclude minify from CSF/LFD

I have currently installed minify on on of my websites however I am currently getting hammered with email from CSF/LFD. Example: Time: Fri Aug 10 13:10:03 2012 +0700 File: ...
1
vote
0answers
118 views

CSF/LFD configuration settings

/bin/gtar -c -f - -X /home/{USER}/cpbackup-exclude.conf -X /etc/cpbackup-exclude.conf . How can I white list these strings? I've tried stuff like: pcmd: /bin/gtar -c -f - -X /home/* and still ...
1
vote
2answers
618 views

Automatic 777 file permissions when uploading files

When I upload new files to my CentOS server, with cPanel and CSF the files are all given 0777 permissions automatically. How do I change this? I don't want all my files to have 0777 permissions by ...
2
votes
1answer
213 views

What is the purpose of filtering egressing traffic (CSF)?

For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF). I tested it for small DoS attacks such a slowloris variants ...
0
votes
1answer
120 views

Is CSF overkill? [closed]

My server runs just my own sites (vBulletin forums - which are always patched with security fixes) and Rails sites using the latest version) so do I really need CSF? ...
0
votes
1answer
615 views

ConfigServer Security and Firewall — after setup, how much daily management required?

I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
0
votes
1answer
322 views

CSF Log Watching

I run suphp so the uid of scripts is for the user not the webserver. My log files are also in /home/$user/logs/error.log CSF only monitors /var/log/apache2/error.log However because of my setup i ...
1
vote
1answer
837 views

Config Server Firewall: Spamming my email | lfd on localhost: Suspicious process running under user www-data

I have just installed and configured CSF and I am getting 100s of spam emails containing this message. lfd on localhost: Suspicious process running under user www-data Time: Wed May 23 01:05:52 ...
0
votes
1answer
433 views

Pros vs Cons of Rate Limiting ICMP [duplicate]

I am configuring Config Server Firewall and here is the default config for ICMP. I have read on the internet that disabling or limiting ICMP can cause huge headaches on your server. However I have ...