ConfigServer Security & Firewall

learn more… | top users | synonyms

4
votes
1answer
3k views

PPTP VPN iptables firewall issues csf

I am having a problem with iptables and a PPTP VPN, I have read related topics both on hear and online but still can't get it to work! I am trying to set up PPTP on an ubuntu server on our local ...
3
votes
2answers
3k views

How to make permanent changes to iptables of CentOS 5.5

I want to make an iptable rule permanent so if the server is rebooted I won't have to add the rule again. Specifically a rule I have related to nginx being reverse proxy of apache. iptables -t nat ...
3
votes
1answer
521 views

CSF blocks my IP trying to access Webmin

I'm in no way a sysadmin, so bear with me a little. I have a cloud server running Centos 5. I have Virtualmin/Webmin with a handful of sites running without issue. I also have CSF installed to stop ...
2
votes
1answer
174 views

Best way for automated ban / throttle of aggressive clients on a Linux / Apache webserver for a period of time?

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best ...
2
votes
1answer
206 views

What is the purpose of filtering egressing traffic (CSF)?

For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF). I tested it for small DoS attacks such a slowloris variants ...
2
votes
1answer
1k views

Allowing specific ports on specific interfaces/ip with CSF

I just learned about CSF, and like the logging/blocking possibilities it gives me. However it does not do the desired blocking. The situation is following, I have a server with multiple ip-addresses. ...
1
vote
2answers
497 views

How much of a linux security problem is “IP spoofing”?

I am using ConfigServer Security & Firewall (CSF) to limit port access to whitelist IP addresses. However I have heard that IP addresses can be spoofed. How wide-spread is this problem, and is it ...
1
vote
2answers
592 views

Automatic 777 file permissions when uploading files

When I upload new files to my CentOS server, with cPanel and CSF the files are all given 0777 permissions automatically. How do I change this? I don't want all my files to have 0777 permissions by ...
1
vote
3answers
1k views

How do I secure my OpenVZ host node?

I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure ...
1
vote
1answer
2k views

DHCP request error. Send_packet now permitted, How to debug, What does it mean

I recently installed CSF firewall and have made live a new server which is accepting around 600req/second. Its basically a reverse proxy and I found in pingdom and munin that for a particular time, ...
1
vote
1answer
609 views

CSF log files Interpretation

I just installed CSF firewall on my server and I have started seeing the following entries in my log file. Can some one help me understanding as to what is happening Thanks Feb 25 10:45:19 li235-57 ...
1
vote
1answer
896 views

CSF/LFD - Suspicious processes when running nginx+php5-fpm+ Mysql

I am running LFD/CSF on three servers and on all servers I have the same problem since the first day when I set-up the server and installed LFD/CSF. I have nginx + php5-fpm + MySQL installed and ...
1
vote
1answer
816 views

MySQL port 3306 blocked in csf yet can still telnet to port 3306 from external host

We have a Centos 6 VPS that was recently migrated to a new machine within the same web hosting company. It's running WHM/cPanel and has csf/lfd installed. csf is set up with mostly vanilla config. ...
1
vote
1answer
186 views

LFD always stops working after ~30 days, until I give /etc/csf/csf.pl -r

When I give /etc/csf/csf.pl -r , I see lots of lines flushing, then I begin to get the notification emails again, (several emails per day), for example: Time: Wed Sep 12 08:39:47 2012 +0800 IP: ...
1
vote
1answer
826 views

Config Server Firewall: Spamming my email | lfd on localhost: Suspicious process running under user www-data

I have just installed and configured CSF and I am getting 100s of spam emails containing this message. lfd on localhost: Suspicious process running under user www-data Time: Wed May 23 01:05:52 ...
1
vote
1answer
85 views

csf firewall deny

How can I pass a comment to the command csf -d so I do not have to edit csf.deny, find the line and add a comment as to why it was manually denied?
1
vote
1answer
118 views

CSF Firewall - priority

If a whitelisted IP (csf.allow) uses the wrong password more than 5 times, are they then automatically added to csf.deny? If so, does csf.deny OVERULE csf.allow so that they would be denied access?
1
vote
1answer
119 views

Will running CSF & Bastille cause any conflicts?

I'm taking my first steps into the world of un-managed servers, and have confused myself whilst reading through the 101 tutorials on server hardening that Google spews out! The most recent advice I ...
1
vote
1answer
81 views

How to prevent brute force attacks on exim service through csf?

It's 3rd days that my VPS has too many brute force attacks on exim. Server features: CentOS 6 64-bit, CSF 7.03, DirectAdmin 1.43.3 I would like to stop these attacks. But I don't know what is the best ...
1
vote
1answer
58 views

CSF Blocking IP on Fail POP3 and cPanel

I have a VPS with cPanel and i am running around 400+ email accounts under a Office Network, I don't have STATIC IP but i am facing issue when any 1 of employee forget the password and try to access ...
1
vote
1answer
64 views

WHM/CSF disregard failed logins to cpanel/webmail etc from certain country ?

Anyone knows if it's possible to disregard failed logins to certain services in WHM/CSF by country ? e.g. I would like that users that are accessing server from my country, don't get banned if they ...
1
vote
1answer
377 views

How to white-list specific PHP script process in CSF?

I repeatedly receive a "Suspicious Process" notice from lfd. I'm 100% positive that the PHP script triggering this warning is safe. I wrote it myself and it makes some cross server calls that must ...
1
vote
1answer
344 views

csf/lfd parameter that prevent smtp attacks?

I have a 4~5MB logwatch like this every day! someone like to hack my smtp: .... --------------------- sasl auth daemon Begin ------------------------ SASL Authentications failed 3965 Time(s) ...
1
vote
0answers
115 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
116 views

CSF/LFD configuration settings

/bin/gtar -c -f - -X /home/{USER}/cpbackup-exclude.conf -X /etc/cpbackup-exclude.conf . How can I white list these strings? I've tried stuff like: pcmd: /bin/gtar -c -f - -X /home/* and still ...
1
vote
1answer
607 views

csf dovecot and IP blocking

I'm using csf and noticed a lot of brute force password attempts into a particular pop3 account. csf does not appear to be blocking the IP addresses as it does with other processes. Is there a switch ...
1
vote
1answer
268 views

CSF / LFD picking up suspicious users in OpenVZ containers

I have OpenVZ running on a box with CSF / LFD installed. I like the way LFD can alert me of suspicious processes running on the HardwareNode itself. However, LFD is emailing me about every ...
0
votes
3answers
3k views

How does iptables execute rules?

I've been having some trouble with a firewall blocking traffic between two servers recently and want to check how iptables handles multiple rules applying to the same IP. If I run iptables -L -n | ...
0
votes
1answer
67 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
0
votes
1answer
763 views

Hacking attempt detected, Can we block user by PC-Name

Recently we notied that hackers are trying to hack our server, we have IP blocking softwares installed on our server but the thing is that, hacker is using dynamic ip addresses to try again and ...
0
votes
1answer
186 views

ConfigServer CSF and iptables config

I'm aware there is a /etc/sysconfig/iptables file, with rules for iptables (and what's the effective difference with /etc/sysconfig/iptables-config?). I installed CSF & LFD. You can configure ...
0
votes
1answer
4k views

Config Server Firewall: You need to install the missing perl modules and then install cxs

I am trying to install config server firewall however when i follow the tutorial and run install.sh i get the following error. Can anyone help? root@localhost:~/csf# sh install.sh Configuring for OS ...
0
votes
1answer
295 views

Help - DDOS Attack [duplicate]

I am under a DDOS attack. I'm trying to locate the IP address that is making 1100+ connections, however, when running the following command, it shows a 1100+ connection, but the ip address column is ...
0
votes
1answer
117 views

Can you load more files (instead of csf.allow) in CSF? like *.conf in Apache?

Currently I keep all of the blocked IPs for my CSF firewall in a single "csf.deny" file which is getting difficult to maintain. In an attempt to organize things a bit more (since not ALL of the IP ...
0
votes
3answers
988 views

How to check if CSF firewall is running

My ex-system admin installed CSF on a server witout Admin panel. I can see CSF installed but I am not sure if its currently running or not. I dont want to try to start / stop it. I realized there is ...
0
votes
1answer
88 views

Cannot close Port 25 after installing postfix

Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf PORT STATE SERVICE 25/tcp filtered smtp After installing logwatch (which installs ...
0
votes
1answer
99 views

csf stop emails related to Process Tracking

I have enabled LSF with CSF since I would like to receive some informations but I am being bombed by the CSF with similar emails: Subject: lfd on [Hostname]: Excessive resource usage: www-data ...
0
votes
1answer
108 views

Memcached ports and CSF

I've got a small / medium sized VPS powered by WHM and running a few personal websites alongside a Magento powered web-store. Not being a real expert when it comes to server configuration details I've ...
0
votes
1answer
67 views

How to block access from all hosting services? (like gutenberg.org) [closed]

gutenberg.org blocks access to all hosting services as per http://www.gutenberg.org/error403.php How to achieve this? Is there a list of hosting ips? Also, would these be added to CSF?
0
votes
2answers
297 views

Error when restarting csf on DirectAdmin server running centos

I just installed csf on a DirectAdmin server running CentOS. When i restart csf it however says: Restarting bandmin acctboth chains for cPanel open3: exec of /usr/local/bandmin/bandminstart ...
0
votes
1answer
120 views

Is CSF overkill? [closed]

My server runs just my own sites (vBulletin forums - which are always patched with security fixes) and Rails sites using the latest version) so do I really need CSF? ...
0
votes
1answer
613 views

ConfigServer Security and Firewall — after setup, how much daily management required?

I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
0
votes
2answers
788 views

Should I disable iptables when I'm using csf?

Should I disable iptables when I'm using csf ? any help appreciated.
0
votes
1answer
802 views

How do to white list a specific IP with CSF?

I am using csf & lfd, I am trying to allow all traffic to a specific IP (my backup storage) which I'm using lftp to access. I have tried using csf.allow, but you have to specify a port or a ...
0
votes
1answer
1k views

Block large number of IP addresses

I am running a centos server with WHM and Cpanel and using CSF as the firewall. I would like to block a whole range of IP addresses. I wanted to start off with China, and got a list of IP's from ...
0
votes
2answers
1k views

flushed and removed iptables rules, but CSF restores them

Intending to clear my iptables rules (i have like a thousand rules which block many customer IPs, and I can't find which is doing it), I removed all csf.deny entries, then : service iptables stop ...
0
votes
2answers
34 views

Openning a port in my CentOS server [closed]

I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
0
votes
1answer
79 views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
0
votes
0answers
86 views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...
0
votes
1answer
62 views

CSF cc_deny is not working

I tried to block a country in CSF Firewall I followed this post http://www.2daygeek.com/how-to-block-a-country-using-csf-firewall/ to block ip from China cc_deny ="CN" While I execute csf -r I ...