ConfigServer Security & Firewall

learn more… | top users | synonyms

0
votes
2answers
3k views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
1
vote
1answer
285 views

SSH connection gets dropped when attempting to deploy site using rocketeer

I'm trying to deploy a Laravel site to a development server (cPanel based) using Rocketeer. I am having a problem maintaining the SSH connection, and the server is dropping the connection after ...
1
vote
1answer
700 views

CSF cc_deny is not working

I tried to block a country in CSF Firewall I followed this post http://www.2daygeek.com/how-to-block-a-country-using-csf-firewall/ to block ip from China cc_deny ="CN" While I execute csf -r I ...
1
vote
1answer
601 views

csf/lfd parameter that prevent smtp attacks?

I have a 4~5MB logwatch like this every day! someone like to hack my smtp: .... --------------------- sasl auth daemon Begin ------------------------ SASL Authentications failed 3965 Time(s) ...
1
vote
1answer
419 views

CSF / LFD picking up suspicious users in OpenVZ containers

I have OpenVZ running on a box with CSF / LFD installed. I like the way LFD can alert me of suspicious processes running on the HardwareNode itself. However, LFD is emailing me about every ...
0
votes
1answer
81 views

How does CT_LIMIT (the csf firewall setting) work?

I've been wondering if the csf firewall counts the connections for the last CT_INTERVAL seconds and then compares them to the CT_LIMIT value, or it just counts the current (at the moment) connections ...
0
votes
1answer
237 views

How do I use CSF to redirect domain requests to a port?

I have a server setup that uses two different webservers with different subdomains. Right now the servers listen on different ports (80 & 4000) So users don't have to put in :4000 I'd like to ...
0
votes
1answer
116 views

IPTables Rules Being Loaded From Somewhere

I'm having troubles connecting (meaning I can't connect to any IP or port) to my server and it appears that the problem was to do with CSF. I uninstalled CSF (by running /etc/csf/uninstall.sh) and ...
0
votes
1answer
615 views

NUMIPTENT is too low to add 5333 rules (CSF firewall error)

The VPS iptables rule limit (numiptent) is too low to add 5333 rules (19469/24000) CSF stopped working spontaneously today. Saying it can't start because it can't add 5333 rules to an apparent ...
0
votes
1answer
442 views

Interpreting CSF emails

I get emails from CSF every time it blocks someone. Here's one I got this morning: Time: Sat Jan 19 10:17:24 2013 -0800 IP: <REDACTED> (US/United States/-) Hits: 21 Blocked: ...
0
votes
1answer
380 views

Munin FW_Conntrack Timing Out

I recently installed CSF firewall. Immediately after this, my Munin has stopped showing me graphs for Connections through firewall and ipconntrack. I looked into log files and found this 2011/02/27-...
1
vote
0answers
427 views

CSF+LFD not blocking brute force on xmlrpc.php on Wordpress site

I have just installed csf+lfd on my rackspace cloud server (a vanilla LAMP stack running centos 6.7). I only tweaked a couple of settings in the default csf.conf file: the ports allowed in TCP_IN and ...
1
vote
0answers
62 views

CSF Configuration Ignore NodeJS for Excessive Time

I am getting a lot of these: Excessive resource usage: *account* (9580 (Parent PID:9574)) Time: Sat Oct 18 15:20:00 2014 -0400 Account: *account* Resource: Process Time Exceeded: ...
1
vote
0answers
2k views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...
1
vote
0answers
202 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
154 views

CSF/LFD configuration settings

/bin/gtar -c -f - -X /home/{USER}/cpbackup-exclude.conf -X /etc/cpbackup-exclude.conf . How can I white list these strings? I've tried stuff like: pcmd: /bin/gtar -c -f - -X /home/* and still ...
0
votes
0answers
30 views

Config Server LFD sends reports on /usr/bin/php but does not list a process

So I am running a cPanel VPS (Virtuozzo based), I have nginx as a proxy to apache, and am running php 5.6 with FCGI as the handler. I am getting loads of email alerts each day such as the 2 below: ...
0
votes
0answers
13 views

CSF Firewall unblock countries

I've a VPS Server running CENTOS 6.7 x86_64 with CSF Firewall activated. Sometimes I see in "Firewall Deny IPs" that blocks suddenly connections from my country (Spain) to some of my clients. Not ...
0
votes
0answers
53 views

How to stop specific LFD emails

I am running CSF and LFD on a number of Centos servers - whilst it is a great product, I am getting frustrated with controlling the flow of (unnecessary) emails. For example, I use rsync to replicate ...
0
votes
0answers
68 views

Apache mod-security - Deny access from IP addresses listed in a blacklist file

I want to deny access from IP addresses listed in a blacklist file (not realy matters, but the file is /etc/csf/csf.deny). This is my custom rule (at the moment..): SecRule REQUEST_URI "wp-login.php"...
0
votes
0answers
49 views

Can not block countries in CSF firewall

I have CSF firewall installed + LFD. I have blocked several countries in csf.conf file. Restarted CSF/LFD. CC_DENY = "CN,BR,CA,HK,TW,RO,RU,UA,MD,KZ,TH" I just checked Nginx logfile and found the ...
0
votes
0answers
108 views

lfd login alert except one user/IP

I am using csf/lfd. I whould like to receive ssh login alert except for one user/or IP. I used LF_SSH_EMAIL_ALERT but can not find any parameter to exclude user. the goal is disabling lfd login alter ...
0
votes
0answers
26 views

CSF ignore list skips some ignore exclusions

I have try to prevent sending Suspicious File Alert emails which contain: File: /tmp/netatop-0.5/netatop.init Reason: Script, starts with #! File: /tmp/netatop-0.5/mkversion Reason: Script, ...
0
votes
0answers
242 views

exim queue notification if a domain is sending more than x number of emails

I am running Exim as an MTA. I have also implemented a Per hour Per domain email Limit. Still I see that my IP reputation goes bad if a spammer sends more than x amount of emails in 24 hours or so. I ...
0
votes
0answers
344 views

CSF does not open port

I'm having a Ubuntu 14.04 server which has a TomCat installation listening on port 8080. I installed CSF today. Following is netstat -tulpn tcp6 0 0 :::8080 :::* ...