ConfigServer Security & Firewall

learn more… | top users | synonyms

0
votes
1answer
6 views

csf Integrated User Interface not working

i've installed CSF on ubuntu 14.04 using their official install guide after disabling UFW with the following command : sudo ufw disable then i have modified csf.conf with the following values: ...
0
votes
1answer
34 views

cannot send emails to other Web servers

I'm trying to limit my server's open ports in CSF. The IPv4 port settings include: # Allow incoming TCP ports TCP_IN = "22,25,53,80,110,143,443,587,3654,53343” # Allow outgoing TCP ports TCP_OUT = ...
0
votes
1answer
130 views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
1
vote
1answer
44 views

SSH connection gets dropped when attempting to deploy site using rocketeer

I'm trying to deploy a Laravel site to a development server (cPanel based) using Rocketeer. I am having a problem maintaining the SSH connection, and the server is dropping the connection after ...
0
votes
2answers
56 views

Openning a port in my CentOS server [closed]

I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
1
vote
1answer
313 views

How to prevent brute force attacks on exim service through csf?

It's 3rd days that my VPS has too many brute force attacks on exim. Server features: CentOS 6 64-bit, CSF 7.03, DirectAdmin 1.43.3 I would like to stop these attacks. But I don't know what is the best ...
0
votes
1answer
240 views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
0
votes
0answers
334 views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...
0
votes
1answer
164 views

CSF cc_deny is not working

I tried to block a country in CSF Firewall I followed this post http://www.2daygeek.com/how-to-block-a-country-using-csf-firewall/ to block ip from China cc_deny ="CN" While I execute csf -r I ...
1
vote
1answer
141 views

CSF Blocking IP on Fail POP3 and cPanel

I have a VPS with cPanel and i am running around 400+ email accounts under a Office Network, I don't have STATIC IP but i am facing issue when any 1 of employee forget the password and try to access ...
-1
votes
1answer
121 views

Cpanel + CSF + suPHP = no php brute force protection?

I have NOT found anyone else talking about brute force detection in CSF with suPHP enabled. Maybe I'm not seeing the real picture or need but it feels that suPHP is weak at brute force detection. Is ...
0
votes
1answer
108 views

Cannot close Port 25 after installing postfix

Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf PORT STATE SERVICE 25/tcp filtered smtp After installing logwatch (which installs ...
0
votes
0answers
47 views

new attacks from banned IPs in CSF

I have many blocked IPs in csf with "do not delete" comment. But every day I got notifications from server about new brute force attacks via some of these IPs. When I want to add the attacker IP to ...
0
votes
0answers
340 views

How to set csf to block brute force attacker's IP beside DirectAdmin settings?

I have a VPS with CentOS, DirectAdmin and CSF. This is what I have set in DirectAdmin: But as I talked with DirectAdmin support team, when CSF is installed on the server, these settings don't ...
1
vote
1answer
86 views

WHM/CSF disregard failed logins to cpanel/webmail etc from certain country ?

Anyone knows if it's possible to disregard failed logins to certain services in WHM/CSF by country ? e.g. I would like that users that are accessing server from my country, don't get banned if they ...
0
votes
1answer
240 views

csf stop emails related to Process Tracking

I have enabled LSF with CSF since I would like to receive some informations but I am being bombed by the CSF with similar emails: Subject: lfd on [Hostname]: Excessive resource usage: www-data ...
0
votes
1answer
72 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
0
votes
1answer
708 views

Port forwarding through OpenVPN server

Here's my scenario: Remote OpenVPN server v2.3.2, 1 public IP, CentOS 6.4, 2.6.32-042stab079.6 Tunnelblick (OpenVPN client) What I want to do is route all the client traffic through the VPN - and ...
0
votes
0answers
383 views

Is CSF's recommended Connection Tracking Limit (CT_LIMIT) of 300 connections reasonable?

CSF recommends setting CT_LIMIT to 300 to block small ddos attacks as per http://configserver.com/free/csf/readme.txt I Would like to enable this connection limiting / tracking via CSF, as I have ...
0
votes
1answer
277 views

Proxmox 31 + KVM routing + IP subnet + csf

We have proxmox 3.1 server in netzner with routuing network and IP subnet block. We want to implement csf firewall without interfering the traffic of the KVM VMs, what would be the easiest way? We ...
0
votes
1answer
269 views

ConfigServer CSF and iptables config

I'm aware there is a /etc/sysconfig/iptables file, with rules for iptables (and what's the effective difference with /etc/sysconfig/iptables-config?). I installed CSF & LFD. You can configure ...
0
votes
0answers
91 views

Extract IPs from exim_rejectlog with particular error then automatically add IP to a csf or iptable

Is there a command to do this in linux? For example extract IPs from exim_rejectlog with particular error dropped: too many syntax or protocol errors Count how many times an IP is listed and if it ...
0
votes
1answer
134 views

Memcached ports and CSF

I've got a small / medium sized VPS powered by WHM and running a few personal websites alongside a Magento powered web-store. Not being a real expert when it comes to server configuration details I've ...
0
votes
1answer
134 views

Mail Authentication Randomly Failing

This started about 4 days ago on a production server. Clients started getting random incorrect password dialog boxes in their email programs, most use Outlook. This happens for email addresses on all ...
0
votes
1answer
954 views

Hacking attempt detected, Can we block user by PC-Name

Recently we notied that hackers are trying to hack our server, we have IP blocking softwares installed on our server but the thing is that, hacker is using dynamic ip addresses to try again and ...
0
votes
1answer
458 views

Ubuntu Server DDoS protection [duplicate]

I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
0
votes
1answer
204 views

Open torrent ports in csf

I use aria2 on my office with debian linux and aria2web to download some torrents on that. in brief it's a torrent client. but if i turn on csf, aria2c can't do that. which config should i do for csf ...
0
votes
1answer
72 views

How to block access from all hosting services? (like gutenberg.org) [closed]

gutenberg.org blocks access to all hosting services as per http://www.gutenberg.org/error403.php How to achieve this? Is there a list of hosting ips? Also, would these be added to CSF?
0
votes
1answer
611 views

IPTABLES nat maintaining source IP address with CSF

We have been using CSF on a virtualized (OpenVZ) environment successfully for a while combining venet and bridged interfaces so we can use public IPs + local addressed virtual systems. Kernel IP ...
1
vote
1answer
504 views

How to white-list specific PHP script process in CSF?

I repeatedly receive a "Suspicious Process" notice from lfd. I'm 100% positive that the PHP script triggering this warning is safe. I wrote it myself and it makes some cross server calls that must ...
0
votes
1answer
363 views

Does LFD check for failed HTTP Digest login attempts?

I am sure that LFD (Login Failure Daemon) checks Apache's error log for failed HTTP authentication attempts ie. log entries like: [Mon Feb 25 10:12:45 2013] [error] [client 10.0.0.1] user FAKEUSER ...
0
votes
1answer
2k views

cPanel server - Dovecot logins failing on specific IP address

I'm having a strange issue with one of our cPanel/WHM servers where it appears to be failing dovecot (IMAP/POP3) logins only from a specific IP address. The client was setting up a new workstation and ...
-4
votes
3answers
1k views

Not using SSH Pubkey Authentication is really serious security flaw compare to regular Password Authentication

How would using PubkeyAuthentication would be more secure than using PasswordAuthentication, considering the following facts: Default SSH port is moved from its default Firewall blacklists an IP ...
1
vote
1answer
363 views

csf/lfd parameter that prevent smtp attacks?

I have a 4~5MB logwatch like this every day! someone like to hack my smtp: .... --------------------- sasl auth daemon Begin ------------------------ SASL Authentications failed 3965 Time(s) ...
1
vote
1answer
1k views

CSF/LFD - Suspicious processes when running nginx+php5-fpm+ Mysql

I am running LFD/CSF on three servers and on all servers I have the same problem since the first day when I set-up the server and installed LFD/CSF. I have nginx + php5-fpm + MySQL installed and ...
0
votes
1answer
195 views

Interpreting CSF emails

I get emails from CSF every time it blocks someone. Here's one I got this morning: Time: Sat Jan 19 10:17:24 2013 -0800 IP: <REDACTED> (US/United States/-) Hits: 21 Blocked: ...
3
votes
1answer
609 views

CSF blocks my IP trying to access Webmin

I'm in no way a sysadmin, so bear with me a little. I have a cloud server running Centos 5. I have Virtualmin/Webmin with a handful of sites running without issue. I also have CSF installed to stop ...
1
vote
0answers
126 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
0
votes
2answers
324 views

Error when restarting csf on DirectAdmin server running centos

I just installed csf on a DirectAdmin server running CentOS. When i restart csf it however says: Restarting bandmin acctboth chains for cPanel open3: exec of /usr/local/bandmin/bandminstart ...
1
vote
1answer
948 views

MySQL port 3306 blocked in csf yet can still telnet to port 3306 from external host

We have a Centos 6 VPS that was recently migrated to a new machine within the same web hosting company. It's running WHM/cPanel and has csf/lfd installed. csf is set up with mostly vanilla config. ...
1
vote
1answer
200 views

LFD always stops working after ~30 days, until I give /etc/csf/csf.pl -r

When I give /etc/csf/csf.pl -r , I see lots of lines flushing, then I begin to get the notification emails again, (several emails per day), for example: Time: Wed Sep 12 08:39:47 2012 +0800 IP: ...
2
votes
1answer
186 views

Best way for automated ban / throttle of aggressive clients on a Linux / Apache webserver for a period of time?

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best ...
0
votes
1answer
246 views

Exclude minify from CSF/LFD

I have currently installed minify on on of my websites however I am currently getting hammered with email from CSF/LFD. Example: Time: Fri Aug 10 13:10:03 2012 +0700 File: ...
1
vote
0answers
119 views

CSF/LFD configuration settings

/bin/gtar -c -f - -X /home/{USER}/cpbackup-exclude.conf -X /etc/cpbackup-exclude.conf . How can I white list these strings? I've tried stuff like: pcmd: /bin/gtar -c -f - -X /home/* and still ...
1
vote
2answers
736 views

Automatic 777 file permissions when uploading files

When I upload new files to my CentOS server, with cPanel and CSF the files are all given 0777 permissions automatically. How do I change this? I don't want all my files to have 0777 permissions by ...
2
votes
1answer
229 views

What is the purpose of filtering egressing traffic (CSF)?

For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF). I tested it for small DoS attacks such a slowloris variants ...
0
votes
1answer
122 views

Is CSF overkill? [closed]

My server runs just my own sites (vBulletin forums - which are always patched with security fixes) and Rails sites using the latest version) so do I really need CSF? ...
0
votes
1answer
622 views

ConfigServer Security and Firewall — after setup, how much daily management required?

I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
0
votes
1answer
401 views

CSF Log Watching

I run suphp so the uid of scripts is for the user not the webserver. My log files are also in /home/$user/logs/error.log CSF only monitors /var/log/apache2/error.log However because of my setup i ...
1
vote
1answer
938 views

Config Server Firewall: Spamming my email | lfd on localhost: Suspicious process running under user www-data

I have just installed and configured CSF and I am getting 100s of spam emails containing this message. lfd on localhost: Suspicious process running under user www-data Time: Wed May 23 01:05:52 ...