ConfigServer Security & Firewall

learn more… | top users | synonyms

0
votes
0answers
7 views

CSF/LFD does not recognize mod_security-Log-entries

unfortunately my CSF/LFD login failure daemon and firewall does not recognize the entries which are added to /var/log/modsec_audit.log. I enabled the mod_security-feature in /etc/csf/csf.conf: # [*]...
1
vote
1answer
35 views

limiting ip range on openvpn server

We're trying to setup a openvpn server on centos 6. We have blocked all IP adresses except a couple in a whitelist via /etc/hosts.deny, also we did the same with csf.deny (except for the whitelist). ...
0
votes
2answers
3k views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
0
votes
0answers
38 views

Config Server LFD sends reports on /usr/bin/php but does not list a process

So I am running a cPanel VPS (Virtuozzo based), I have nginx as a proxy to apache, and am running php 5.6 with FCGI as the handler. I am getting loads of email alerts each day such as the 2 below: ...
0
votes
0answers
16 views

CSF Firewall unblock countries

I've a VPS Server running CENTOS 6.7 x86_64 with CSF Firewall activated. Sometimes I see in "Firewall Deny IPs" that blocks suddenly connections from my country (Spain) to some of my clients. Not ...
3
votes
1answer
2k views

How to white-list specific PHP script process in CSF?

I repeatedly receive a "Suspicious Process" notice from lfd. I'm 100% positive that the PHP script triggering this warning is safe. I wrote it myself and it makes some cross server calls that must ...
0
votes
1answer
34 views

Why is lfd prematurely removing blocks?

As you can see in the excerpted log file below (from /var/log/lfd.log), lfd is prematurely removing temporary blocks that it imposes on IPs: Apr 7 13:07:59 host lfd[32117]: (wordpressxmlrpc) Request ...
0
votes
0answers
57 views

How to stop specific LFD emails

I am running CSF and LFD on a number of Centos servers - whilst it is a great product, I am getting frustrated with controlling the flow of (unnecessary) emails. For example, I use rsync to replicate ...
0
votes
1answer
2k views

CSF Log Watching

I run suphp so the uid of scripts is for the user not the webserver. My log files are also in /home/$user/logs/error.log CSF only monitors /var/log/apache2/error.log However because of my setup i ...
0
votes
1answer
86 views

How does CT_LIMIT (the csf firewall setting) work?

I've been wondering if the csf firewall counts the connections for the last CT_INTERVAL seconds and then compares them to the CT_LIMIT value, or it just counts the current (at the moment) connections ...
0
votes
0answers
76 views

Apache mod-security - Deny access from IP addresses listed in a blacklist file

I want to deny access from IP addresses listed in a blacklist file (not realy matters, but the file is /etc/csf/csf.deny). This is my custom rule (at the moment..): SecRule REQUEST_URI "wp-login.php"...
1
vote
3answers
3k views

How to check if CSF firewall is running

My ex-system admin installed CSF on a server witout Admin panel. I can see CSF installed but I am not sure if its currently running or not. I dont want to try to start / stop it. I realized there is ...
2
votes
1answer
5k views

DHCP request error. Send_packet not permitted, How to debug, What does it mean

I recently installed CSF firewall and have made live a new server which is accepting around 600req/second. Its basically a reverse proxy and I found in pingdom and munin that for a particular time, ...
0
votes
2answers
176 views

Haproxy logging doesn't work. Does that have anything to do with csf?

Does Haproxy log every time a connection is made? I have followed instructions from other threads to set up logging via rsyslogd. Even though the files are created (haproxy.log,haproxy-info.log and ...
0
votes
0answers
51 views

Can not block countries in CSF firewall

I have CSF firewall installed + LFD. I have blocked several countries in csf.conf file. Restarted CSF/LFD. CC_DENY = "CN,BR,CA,HK,TW,RO,RU,UA,MD,KZ,TH" I just checked Nginx logfile and found the ...
0
votes
1answer
1k views

IPTABLES nat maintaining source IP address with CSF

We have been using CSF on a virtualized (OpenVZ) environment successfully for a while combining venet and bridged interfaces so we can use public IPs + local addressed virtual systems. Kernel IP ...
1
vote
0answers
465 views

CSF+LFD not blocking brute force on xmlrpc.php on Wordpress site

I have just installed csf+lfd on my rackspace cloud server (a vanilla LAMP stack running centos 6.7). I only tweaked a couple of settings in the default csf.conf file: the ports allowed in TCP_IN and ...
1
vote
1answer
2k views

csf Integrated User Interface not working

I've installed CSF on ubuntu 14.04 using their official install guide. After disabling UFW with the following command: sudo ufw disable then I have modified csf.conf with the following values: (...
2
votes
1answer
3k views

CSF/LFD - Suspicious processes when running nginx+php5-fpm+ Mysql

I am running LFD/CSF on three servers and on all servers I have the same problem since the first day when I set-up the server and installed LFD/CSF. I have nginx + php5-fpm + MySQL installed and lfd....
2
votes
1answer
508 views

How to block all IPs in CSF except few static IPs?

The title is telling I guess. I'm wondering how to block ALL IPs in csf.deny except few trusted IPs? I've googled but could not find the answer.
0
votes
0answers
28 views

CSF ignore list skips some ignore exclusions

I have try to prevent sending Suspicious File Alert emails which contain: File: /tmp/netatop-0.5/netatop.init Reason: Script, starts with #! File: /tmp/netatop-0.5/mkversion Reason: Script, ...
0
votes
1answer
116 views

How to block all traffic which is headed to a particular domain

I have recently added an IP address to my VPS. The problem is that the previous owner has abandoned the domain name with its nameservers set on this IP. Although any access to this domain is denied by ...
0
votes
0answers
249 views

exim queue notification if a domain is sending more than x number of emails

I am running Exim as an MTA. I have also implemented a Per hour Per domain email Limit. Still I see that my IP reputation goes bad if a spammer sends more than x amount of emails in 24 hours or so. I ...
-5
votes
1answer
102 views

I cannot block an IP [closed]

I have a redirect rule on my CSF like the below; 17.1.1.13|80|27.5.5.22|80|tcp 17.1.1.13 is my firewall(csf) and 27.5.5.22 is my web server address. So everybody access my web site through the ...
0
votes
1answer
252 views

How do I use CSF to redirect domain requests to a port?

I have a server setup that uses two different webservers with different subdomains. Right now the servers listen on different ports (80 & 4000) So users don't have to put in :4000 I'd like to ...
3
votes
2answers
4k views

How to make permanent changes to iptables of CentOS 5.5

I want to make an iptable rule permanent so if the server is rebooted I won't have to add the rule again. Specifically a rule I have related to nginx being reverse proxy of apache. iptables -t nat -...
0
votes
1answer
637 views

NUMIPTENT is too low to add 5333 rules (CSF firewall error)

The VPS iptables rule limit (numiptent) is too low to add 5333 rules (19469/24000) CSF stopped working spontaneously today. Saying it can't start because it can't add 5333 rules to an apparent ...
0
votes
1answer
292 views

Can't connect to Ubuntu VPS via SSH,SFTP

When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...
0
votes
1answer
730 views

Unblock All Ports in CSF? [closed]

I have CSF installed on a cPanel server and know that I believe that I can unblock ports specifically for outgoing connections in the /etc/csf/csf.conf file. It looks like this line can just be ...
0
votes
1answer
336 views

CSF not adding IPs to deny file as a cron during high loads

I'm running a cron every minute to thwart brute-force attacks. awk '{print $2}' < ipkill.txt | while read ip; do #query geographical info IP address curl -o country.txt ipinfo.io/$ip ...
1
vote
3answers
1k views

csf stop emails related to Process Tracking

I have enabled LSF with CSF since I would like to receive some informations but I am being bombed by the CSF with similar emails: Subject: lfd on [Hostname]: Excessive resource usage: www-data Time:...
0
votes
1answer
118 views

IPTables Rules Being Loaded From Somewhere

I'm having troubles connecting (meaning I can't connect to any IP or port) to my server and it appears that the problem was to do with CSF. I uninstalled CSF (by running /etc/csf/uninstall.sh) and ...
0
votes
1answer
241 views

CSF Update resets IPTables rules

This is with CentOS 6. On one of my servers, periodically all IPTables rules are simply dropped and all connections start being blocked. It happens fairly randomly once every few days. I have a script ...
0
votes
0answers
356 views

CSF does not open port

I'm having a Ubuntu 14.04 server which has a TomCat installation listening on port 8080. I installed CSF today. Following is netstat -tulpn tcp6 0 0 :::8080 :::* ...
0
votes
2answers
698 views

ConfigServer Security and Firewall — after setup, how much daily management required?

I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
-3
votes
1answer
1k views

CSF *Port Scan* detected - shared hosting [closed]

We modified a few options in ConfigServer Firewall configuraion. Ever since the CSF blocking a lot of IP address. Following print sreen: http://oi60.tinypic.com/kdlnh3.jpg What can I modify thereto ...
0
votes
1answer
744 views

Filezilla can not connect my new ftp port on centos 6.6

I have a webserver running on Centos 6.6. Recently Config Server Security Firewall send me over 150 email about some malicious bots trying to guess my clients ftp users and passwords. I hate ...
1
vote
1answer
526 views

Suspicious Linux binary file in /tmp/ - Munin?

I have a CENTOS 6.6 x86_64 server running ConfigServer Firewall (installed by us) and Munin (installed by the datacentre). CSF has recently (and for no apparent reason) started sending us warnings, ...
-1
votes
1answer
141 views

CentOS - how to tell what conf file CSF (firewall) is using? csf.conf then restart not updating [closed]

in /etc/csf/csf.conf the following is setup LF_CPANEL = "5" LF_CPANEL_PERM = "3600" restarting csf by doing the following csf -r does not seem to have an impact on the above attributes. ...
1
vote
0answers
80 views

VPS Unknown Read/Write [closed]

I had an lfd email alert - I have installed CSF - today revealing that my server (Centos 6.6) has been using a lot of server resources for 5 minutes. I checked my VPS graphs and noticed that my server'...
1
vote
2answers
78 views

Can't block spammy IP

I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan. I've added the iptables Chain num pkts bytes target prot opt in out ...
1
vote
0answers
63 views

CSF Configuration Ignore NodeJS for Excessive Time

I am getting a lot of these: Excessive resource usage: *account* (9580 (Parent PID:9574)) Time: Sat Oct 18 15:20:00 2014 -0400 Account: *account* Resource: Process Time Exceeded: ...
-5
votes
3answers
2k views

Not using SSH Pubkey Authentication is really serious security flaw compare to regular Password Authentication

How would using PubkeyAuthentication would be more secure than using PasswordAuthentication, considering the following facts: Default SSH port is moved from its default Firewall blacklists an IP ...
0
votes
1answer
74 views

cannot send emails to other Web servers

I'm trying to limit my server's open ports in CSF. The IPv4 port settings include: # Allow incoming TCP ports TCP_IN = "22,25,53,80,110,143,443,587,3654,53343” # Allow outgoing TCP ports TCP_OUT = "...
1
vote
1answer
298 views

SSH connection gets dropped when attempting to deploy site using rocketeer

I'm trying to deploy a Laravel site to a development server (cPanel based) using Rocketeer. I am having a problem maintaining the SSH connection, and the server is dropping the connection after ...
1
vote
1answer
722 views

CSF cc_deny is not working

I tried to block a country in CSF Firewall I followed this post http://www.2daygeek.com/how-to-block-a-country-using-csf-firewall/ to block ip from China cc_deny ="CN" While I execute csf -r I ...
0
votes
2answers
279 views

Openning a port in my CentOS server [closed]

I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
1
vote
0answers
2k views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...
1
vote
1answer
456 views

CSF Blocking IP on Fail POP3 and cPanel [closed]

I have a VPS with cPanel and i am running around 400+ email accounts under a Office Network, I don't have STATIC IP but i am facing issue when any 1 of employee forget the password and try to access ...
0
votes
1answer
356 views

Cannot close Port 25 after installing postfix

Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf PORT STATE SERVICE 25/tcp filtered smtp After installing logwatch (which installs ...