Questions tagged [csf]
ConfigServer Security & Firewall
128
questions
0
votes
1
answer
406
views
IPTables Rules Being Loaded From Somewhere
I'm having troubles connecting (meaning I can't connect to any IP or port) to my server and it appears that the problem was to do with CSF. I uninstalled CSF (by running /etc/csf/uninstall.sh) and ...
- 586
0
votes
1
answer
1k
views
CSF Update resets IPTables rules
This is with CentOS 6. On one of my servers, periodically all IPTables rules are simply dropped and all connections start being blocked. It happens fairly randomly once every few days. I have a script ...
- 11
0
votes
0
answers
2k
views
CSF does not open port
I'm having a Ubuntu 14.04 server which has a TomCat installation listening on port 8080. I installed CSF today.
Following is netstat -tulpn
tcp6 0 0 :::8080 :::* ...
- 11
-2
votes
1
answer
7k
views
CSF *Port Scan* detected - shared hosting [closed]
We modified a few options in ConfigServer Firewall configuraion. Ever since the CSF blocking a lot of IP address. Following print sreen:
http://oi60.tinypic.com/kdlnh3.jpg
What can I modify thereto ...
- 42
0
votes
1
answer
2k
views
Filezilla can not connect my new ftp port on centos 6.6
I have a webserver running on Centos 6.6. Recently Config Server Security Firewall send me over 150 email about some malicious bots trying to guess my clients ftp users and passwords. I hate ...
- 113
1
vote
1
answer
5k
views
Unblock All Ports in CSF? [closed]
I have CSF installed on a cPanel server and know that I believe that I can unblock ports specifically for outgoing connections in the /etc/csf/csf.conf file.
It looks like this line can just be ...
- 23
1
vote
1
answer
963
views
Suspicious Linux binary file in /tmp/ - Munin?
I have a CENTOS 6.6 x86_64 server running ConfigServer Firewall (installed by us) and Munin (installed by the datacentre).
CSF has recently (and for no apparent reason) started sending us warnings, ...
- 115
-1
votes
1
answer
308
views
CentOS - how to tell what conf file CSF (firewall) is using? csf.conf then restart not updating [closed]
in /etc/csf/csf.conf the following is setup
LF_CPANEL = "5"
LF_CPANEL_PERM = "3600"
restarting csf by doing the following
csf -r
does not seem to have an impact on the above attributes.
According ...
- 147
1
vote
2
answers
129
views
Can't block spammy IP
I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan.
I've added the iptables
Chain num pkts bytes target prot opt in out ...
- 193
1
vote
0
answers
237
views
CSF Configuration Ignore NodeJS for Excessive Time
I am getting a lot of these:
Excessive resource usage: *account* (9580 (Parent PID:9574))
Time: Sat Oct 18 15:20:00 2014 -0400
Account: *account*
Resource: Process Time
Exceeded: ...
- 111
1
vote
2
answers
3k
views
NUMIPTENT is too low to add 5333 rules (CSF firewall error)
The VPS iptables rule limit (numiptent) is too low to add 5333 rules (19469/24000)
CSF stopped working spontaneously today.
Saying it can't start because it can't add 5333 rules to an apparent total ...
- 13
4
votes
2
answers
6k
views
csf Integrated User Interface not working
I've installed CSF on ubuntu 14.04 using their official install guide. After disabling UFW with the following command:
sudo ufw disable
then I have modified csf.conf with the following values: (...
- 243
0
votes
1
answer
113
views
cannot send emails to other Web servers
I'm trying to limit my server's open ports in CSF. The IPv4 port settings include:
# Allow incoming TCP ports
TCP_IN = "22,25,53,80,110,143,443,587,3654,53343”
# Allow outgoing TCP ports
TCP_OUT = "...
- 555
0
votes
2
answers
10k
views
lots of UDP_IN Blocked errors
Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error.
Aug 8 ...
- 555
1
vote
1
answer
1k
views
SSH connection gets dropped when attempting to deploy site using rocketeer
I'm trying to deploy a Laravel site to a development server (cPanel based) using Rocketeer. I am having a problem maintaining the SSH connection, and the server is dropping the connection after ...
- 121
0
votes
2
answers
537
views
Openning a port in my CentOS server [closed]
I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
1
vote
0
answers
3k
views
CSF LFD suspicious process under user apache
I think my server got DOS'ed via HTTP(port 80).
When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute.
And I've been trying to limit ...
- 11
1
vote
1
answer
2k
views
CSF cc_deny is not working [closed]
I tried to block a country in CSF Firewall
I followed this post http://www.2daygeek.com/how-to-block-a-country-using-csf-firewall/
to block ip from China
cc_deny ="CN"
While I execute csf -r
I ...
- 43
1
vote
1
answer
730
views
CSF Blocking IP on Fail POP3 and cPanel [closed]
I have a VPS with cPanel and i am running around 400+ email accounts under a Office Network, I don't have STATIC IP but i am facing issue when any 1 of employee forget the password and try to access ...
0
votes
1
answer
649
views
Cannot close Port 25 after installing postfix
Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf
PORT STATE SERVICE
25/tcp filtered smtp
After installing logwatch (which installs ...
- 1,479
1
vote
3
answers
2k
views
csf stop emails related to Process Tracking
I have enabled LSF with CSF since I would like to receive some informations but I am being bombed by the CSF with similar emails:
Subject: lfd on [Hostname]: Excessive resource usage: www-data
Time:...
- 115
0
votes
1
answer
276
views
How to block/ban clients that try to access some paths / urls?
Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas
How could I block any access to /user/pass?=* ?
Is there a better tool than iptables or csf for catching such crap?
- 1,877
0
votes
1
answer
8k
views
Port forwarding through OpenVPN server
Here's my scenario:
Remote OpenVPN server v2.3.2, 1 public IP, CentOS 6.4, 2.6.32-042stab079.6
Tunnelblick (OpenVPN client)
What I want to do is route all the client traffic through the VPN - and I ...
- 43
1
vote
1
answer
937
views
Proxmox 31 + KVM routing + IP subnet + csf
We have proxmox 3.1 server in netzner with routuing network and IP subnet block. We want to implement csf firewall without interfering the traffic of the KVM VMs, what would be the easiest way?
We ...
- 11
0
votes
1
answer
2k
views
ConfigServer CSF and iptables config
I'm aware there is a /etc/sysconfig/iptables file, with rules for iptables (and what's the effective difference with /etc/sysconfig/iptables-config?).
I installed CSF & LFD. You can configure ...
- 413
0
votes
1
answer
1k
views
Memcached ports and CSF
I've got a small / medium sized VPS powered by WHM and running a few personal websites alongside a Magento powered web-store. Not being a real expert when it comes to server configuration details I've ...
- 1
0
votes
1
answer
2k
views
Hacking attempt detected, Can we block user by PC-Name
Recently we notied that hackers are trying to hack our server, we have IP blocking softwares installed on our server but the thing is that, hacker is using dynamic ip addresses to try again and again.....
- 119
0
votes
1
answer
2k
views
Ubuntu Server DDoS protection [duplicate]
I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
0
votes
1
answer
1k
views
Open torrent ports in csf
I use aria2 on my office with debian linux and aria2web to download some torrents on that. in brief it's a torrent client. but if i turn on csf, aria2c can't do that.
which config should i do for csf ...
- 115
0
votes
1
answer
103
views
How to block access from all hosting services? (like gutenberg.org) [closed]
gutenberg.org blocks access to all hosting services as per
http://www.gutenberg.org/error403.php
How to achieve this? Is there a list of hosting ips? Also, would these be added to CSF?
- 1,877
1
vote
2
answers
4k
views
IPTABLES nat maintaining source IP address with CSF
We have been using CSF on a virtualized (OpenVZ) environment successfully for a while combining venet and bridged interfaces so we can use public IPs + local addressed virtual systems.
Kernel IP ...
- 282
4
votes
1
answer
5k
views
How to white-list specific PHP script process in CSF?
I repeatedly receive a "Suspicious Process" notice from lfd. I'm 100% positive that the PHP script triggering this warning is safe. I wrote it myself and it makes some cross server calls that must ...
- 151
0
votes
1
answer
780
views
Does LFD check for failed HTTP Digest login attempts?
I am sure that LFD (Login Failure Daemon) checks Apache's error log for failed HTTP authentication attempts ie. log entries like:
[Mon Feb 25 10:12:45 2013] [error] [client 10.0.0.1] user FAKEUSER ...
- 107
-1
votes
1
answer
10k
views
cPanel server - Dovecot logins failing on specific IP address [closed]
I'm having a strange issue with one of our cPanel/WHM servers where it appears to be failing dovecot (IMAP/POP3) logins only from a specific IP address. The client was setting up a new workstation and ...
- 1
-5
votes
3
answers
2k
views
Not using SSH Pubkey Authentication is really serious security flaw compare to regular Password Authentication
How would using PubkeyAuthentication would be more secure than using PasswordAuthentication, considering the following facts:
Default SSH port is moved from its default
Firewall blacklists an IP ...
- 1,106
1
vote
1
answer
1k
views
csf/lfd parameter that prevent smtp attacks?
I have a 4~5MB logwatch like this every day! someone like to hack my smtp:
....
--------------------- sasl auth daemon Begin ------------------------
SASL Authentications failed 3965 Time(s)
...
- 127
2
votes
2
answers
6k
views
CSF/LFD - Suspicious processes when running nginx+php5-fpm+ Mysql
I am running LFD/CSF on three servers and on all servers I have the same problem since the first day when I set-up the server and installed LFD/CSF.
I have nginx + php5-fpm + MySQL installed and lfd....
- 1,189
0
votes
1
answer
710
views
Interpreting CSF emails
I get emails from CSF every time it blocks someone. Here's one I got this morning:
Time: Sat Jan 19 10:17:24 2013 -0800
IP: <REDACTED> (US/United States/-)
Hits: 21
Blocked: ...
- 325
3
votes
1
answer
3k
views
CSF blocks my IP trying to access Webmin
I'm in no way a sysadmin, so bear with me a little.
I have a cloud server running Centos 5. I have Virtualmin/Webmin with a handful of sites running without issue. I also have CSF installed to stop ...
- 135
1
vote
0
answers
263
views
CSF: Changing portflood settings to deny IP longer than second interval?
I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
0
votes
2
answers
797
views
Error when restarting csf on DirectAdmin server running centos
I just installed csf on a DirectAdmin server running CentOS. When i restart csf it however says:
Restarting bandmin acctboth chains for cPanel
open3: exec of /usr/local/bandmin/bandminstart ...
- 103
2
votes
1
answer
4k
views
MySQL port 3306 blocked in csf yet can still telnet to port 3306 from external host [closed]
We have a Centos 6 VPS that was recently migrated to a new machine within the same web hosting company. It's running WHM/cPanel and has csf/lfd installed. csf is set up with mostly vanilla config. ...
- 133
1
vote
1
answer
513
views
LFD always stops working after ~30 days, until I give /etc/csf/csf.pl -r
When I give /etc/csf/csf.pl -r , I see lots of lines flushing, then I begin to get the notification emails again, (several emails per day), for example:
Time: Wed Sep 12 08:39:47 2012 +0800
IP: ...
- 141
2
votes
1
answer
485
views
Best way for automated ban / throttle of aggressive clients on a Linux / Apache webserver for a period of time?
I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best ...
- 1,877
0
votes
1
answer
659
views
Exclude minify from CSF/LFD
I have currently installed minify on on of my websites however I am currently getting hammered with email from CSF/LFD.
Example:
Time: Fri Aug 10 13:10:03 2012 +0700
File: /tmp/...
1
vote
0
answers
224
views
CSF/LFD configuration settings
/bin/gtar -c -f - -X /home/{USER}/cpbackup-exclude.conf -X /etc/cpbackup-exclude.conf .
How can I white list these strings?
I've tried stuff like:
pcmd: /bin/gtar -c -f - -X /home/*
and still ...
- 6,691
1
vote
2
answers
2k
views
Automatic 777 file permissions when uploading files [closed]
When I upload new files to my CentOS server, with cPanel and CSF the files are all given 0777 permissions automatically.
How do I change this? I don't want all my files to have 0777 permissions by ...
- 207
2
votes
1
answer
529
views
What is the purpose of filtering egressing traffic (CSF)?
For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF).
I tested it for small DoS attacks such a slowloris variants ...
- 23
0
votes
1
answer
155
views
Is CSF overkill? [closed]
My server runs just my own sites (vBulletin forums - which are always patched with security fixes) and Rails sites using the latest version) so do I really need CSF? (http://configserver.com/cp/csf....
- 277
0
votes
2
answers
932
views
ConfigServer Security and Firewall -- after setup, how much daily management required?
I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
- 175