ConfigServer Security & Firewall

learn more… | top users | synonyms

1
vote
1answer
235 views

LFD always stops working after ~30 days, until I give /etc/csf/csf.pl -r

When I give /etc/csf/csf.pl -r , I see lots of lines flushing, then I begin to get the notification emails again, (several emails per day), for example: Time: Wed Sep 12 08:39:47 2012 +0800 IP: ...
2
votes
1answer
205 views

Best way for automated ban / throttle of aggressive clients on a Linux / Apache webserver for a period of time?

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best ...
0
votes
1answer
288 views

Exclude minify from CSF/LFD

I have currently installed minify on on of my websites however I am currently getting hammered with email from CSF/LFD. Example: Time: Fri Aug 10 13:10:03 2012 +0700 File: ...
1
vote
0answers
125 views

CSF/LFD configuration settings

/bin/gtar -c -f - -X /home/{USER}/cpbackup-exclude.conf -X /etc/cpbackup-exclude.conf . How can I white list these strings? I've tried stuff like: pcmd: /bin/gtar -c -f - -X /home/* and still ...
1
vote
2answers
787 views

Automatic 777 file permissions when uploading files

When I upload new files to my CentOS server, with cPanel and CSF the files are all given 0777 permissions automatically. How do I change this? I don't want all my files to have 0777 permissions by ...
2
votes
1answer
252 views

What is the purpose of filtering egressing traffic (CSF)?

For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF). I tested it for small DoS attacks such a slowloris variants ...
0
votes
1answer
123 views

Is CSF overkill? [closed]

My server runs just my own sites (vBulletin forums - which are always patched with security fixes) and Rails sites using the latest version) so do I really need CSF? ...
0
votes
2answers
645 views

ConfigServer Security and Firewall — after setup, how much daily management required?

I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
0
votes
1answer
519 views

CSF Log Watching

I run suphp so the uid of scripts is for the user not the webserver. My log files are also in /home/$user/logs/error.log CSF only monitors /var/log/apache2/error.log However because of my setup i ...
1
vote
1answer
1k views

Config Server Firewall: Spamming my email | lfd on localhost: Suspicious process running under user www-data

I have just installed and configured CSF and I am getting 100s of spam emails containing this message. lfd on localhost: Suspicious process running under user www-data Time: Wed May 23 01:05:52 ...
0
votes
1answer
503 views

Pros vs Cons of Rate Limiting ICMP [duplicate]

I am configuring Config Server Firewall and here is the default config for ICMP. I have read on the internet that disabling or limiting ICMP can cause huge headaches on your server. However I have ...
0
votes
1answer
5k views

Config Server Firewall: You need to install the missing perl modules and then install cxs

I am trying to install config server firewall however when i follow the tutorial and run install.sh i get the following error. Can anyone help? root@localhost:~/csf# sh install.sh Configuring for OS ...
0
votes
2answers
930 views

Should I disable iptables when I'm using csf?

Should I disable iptables when I'm using csf ? any help appreciated.
0
votes
1answer
862 views

How do to white list a specific IP with CSF?

I am using csf & lfd, I am trying to allow all traffic to a specific IP (my backup storage) which I'm using lftp to access. I have tried using csf.allow, but you have to specify a port or a ...
3
votes
2answers
3k views

How to make permanent changes to iptables of CentOS 5.5

I want to make an iptable rule permanent so if the server is rebooted I won't have to add the rule again. Specifically a rule I have related to nginx being reverse proxy of apache. iptables -t nat ...
2
votes
1answer
2k views

Allowing specific ports on specific interfaces/ip with CSF

I just learned about CSF, and like the logging/blocking possibilities it gives me. However it does not do the desired blocking. The situation is following, I have a server with multiple ip-addresses. ...
0
votes
1answer
750 views

Allow all IPs through a specific port range in CSF

How can I do this? For UDP it seems to work like this: udp:out:d=1_9000:d=0.0.0.0/0 but it doesn't seem to work when I change it to TCP and I need to enter a specific IP like ...
0
votes
3answers
3k views

How does iptables execute rules?

I've been having some trouble with a firewall blocking traffic between two servers recently and want to check how iptables handles multiple rules applying to the same IP. If I run iptables -L -n | ...
1
vote
3answers
1k views

How do I secure my OpenVZ host node?

I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure ...
0
votes
1answer
1k views

Block large number of IP addresses

I am running a centos server with WHM and Cpanel and using CSF as the firewall. I would like to block a whole range of IP addresses. I wanted to start off with China, and got a list of IP's from ...
0
votes
1answer
302 views

Help - DDOS Attack [duplicate]

I am under a DDOS attack. I'm trying to locate the IP address that is making 1100+ connections, however, when running the following command, it shows a 1100+ connection, but the ip address column is ...
0
votes
1answer
132 views

Can you load more files (instead of csf.allow) in CSF? like *.conf in Apache?

Currently I keep all of the blocked IPs for my CSF firewall in a single "csf.deny" file which is getting difficult to maintain. In an attempt to organize things a bit more (since not ALL of the IP ...
0
votes
1answer
271 views

Allow IP range through linux firewall

I need to set up a rule to allow ALL outgoing UDP connections on my VPS. I am not sure what I should be using. I have tried: udp:out:d=1_9000:d=* in my csf.allow but its not working (and it was a ...
4
votes
1answer
3k views

PPTP VPN iptables firewall issues csf

I am having a problem with iptables and a PPTP VPN, I have read related topics both on hear and online but still can't get it to work! I am trying to set up PPTP on an ubuntu server on our local ...
2
votes
1answer
706 views

csf dovecot and IP blocking

I'm using csf and noticed a lot of brute force password attempts into a particular pop3 account. csf does not appear to be blocking the IP addresses as it does with other processes. Is there a switch ...
1
vote
1answer
92 views

csf firewall deny

How can I pass a comment to the command csf -d so I do not have to edit csf.deny, find the line and add a comment as to why it was manually denied?
0
votes
2answers
1k views

flushed and removed iptables rules, but CSF restores them

Intending to clear my iptables rules (i have like a thousand rules which block many customer IPs, and I can't find which is doing it), I removed all csf.deny entries, then : service iptables stop ...
0
votes
1answer
325 views

Munin FW_Conntrack Timing Out

I recently installed CSF firewall. Immediately after this, my Munin has stopped showing me graphs for Connections through firewall and ipconntrack. I looked into log files and found this ...
1
vote
1answer
3k views

DHCP request error. Send_packet now permitted, How to debug, What does it mean

I recently installed CSF firewall and have made live a new server which is accepting around 600req/second. Its basically a reverse proxy and I found in pingdom and munin that for a particular time, ...
1
vote
1answer
691 views

CSF log files Interpretation

I just installed CSF firewall on my server and I have started seeing the following entries in my log file. Can some one help me understanding as to what is happening Thanks Feb 25 10:45:19 li235-57 ...
0
votes
3answers
1k views

How to check if CSF firewall is running

My ex-system admin installed CSF on a server witout Admin panel. I can see CSF installed but I am not sure if its currently running or not. I dont want to try to start / stop it. I realized there is ...
1
vote
2answers
547 views

How much of a linux security problem is “IP spoofing”?

I am using ConfigServer Security & Firewall (CSF) to limit port access to whitelist IP addresses. However I have heard that IP addresses can be spoofed. How wide-spread is this problem, and is it ...
1
vote
1answer
344 views

CSF / LFD picking up suspicious users in OpenVZ containers

I have OpenVZ running on a box with CSF / LFD installed. I like the way LFD can alert me of suspicious processes running on the HardwareNode itself. However, LFD is emailing me about every ...
1
vote
1answer
128 views

CSF Firewall - priority

If a whitelisted IP (csf.allow) uses the wrong password more than 5 times, are they then automatically added to csf.deny? If so, does csf.deny OVERULE csf.allow so that they would be denied access?
0
votes
1answer
467 views

CSF on CentOS not removing tempban/tempdeny

I have CSF v5.12 (generic) installed on my CentOS 4.4 server, and am trying to use the tempban/tempdeny feature to temporary add a firewall block to a specific IP. (I am building a PHP script which ...
1
vote
1answer
135 views

Will running CSF & Bastille cause any conflicts?

I'm taking my first steps into the world of un-managed servers, and have confused myself whilst reading through the 101 tutorials on server hardening that Google spews out! The most recent advice I ...