ConfigServer Security & Firewall

learn more… | top users | synonyms

5
votes
1answer
4k views

PPTP VPN iptables firewall issues csf [closed]

I am having a problem with iptables and a PPTP VPN, I have read related topics both on hear and online but still can't get it to work! I am trying to set up PPTP on an ubuntu server on our local ...
3
votes
2answers
4k views

How to make permanent changes to iptables of CentOS 5.5

I want to make an iptable rule permanent so if the server is rebooted I won't have to add the rule again. Specifically a rule I have related to nginx being reverse proxy of apache. iptables -t nat ...
3
votes
1answer
1k views

CSF blocks my IP trying to access Webmin

I'm in no way a sysadmin, so bear with me a little. I have a cloud server running Centos 5. I have Virtualmin/Webmin with a handful of sites running without issue. I also have CSF installed to stop ...
2
votes
1answer
4k views

DHCP request error. Send_packet now permitted, How to debug, What does it mean

I recently installed CSF firewall and have made live a new server which is accepting around 600req/second. Its basically a reverse proxy and I found in pingdom and munin that for a particular time, ...
2
votes
1answer
2k views

CSF/LFD - Suspicious processes when running nginx+php5-fpm+ Mysql

I am running LFD/CSF on three servers and on all servers I have the same problem since the first day when I set-up the server and installed LFD/CSF. I have nginx + php5-fpm + MySQL installed and ...
2
votes
1answer
236 views

Best way for automated ban / throttle of aggressive clients on a Linux / Apache webserver for a period of time?

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best ...
2
votes
1answer
2k views

MySQL port 3306 blocked in csf yet can still telnet to port 3306 from external host

We have a Centos 6 VPS that was recently migrated to a new machine within the same web hosting company. It's running WHM/cPanel and has csf/lfd installed. csf is set up with mostly vanilla config. ...
2
votes
1answer
310 views

What is the purpose of filtering egressing traffic (CSF)?

For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF). I tested it for small DoS attacks such a slowloris variants ...
2
votes
1answer
837 views

csf dovecot and IP blocking

I'm using csf and noticed a lot of brute force password attempts into a particular pop3 account. csf does not appear to be blocking the IP addresses as it does with other processes. Is there a switch ...
2
votes
1answer
2k views

Allowing specific ports on specific interfaces/ip with CSF

I just learned about CSF, and like the logging/blocking possibilities it gives me. However it does not do the desired blocking. The situation is following, I have a server with multiple ip-addresses. ...
1
vote
2answers
963 views

Automatic 777 file permissions when uploading files [closed]

When I upload new files to my CentOS server, with cPanel and CSF the files are all given 0777 permissions automatically. How do I change this? I don't want all my files to have 0777 permissions by ...
1
vote
2answers
665 views

How much of a linux security problem is “IP spoofing”?

I am using ConfigServer Security & Firewall (CSF) to limit port access to whitelist IP addresses. However I have heard that IP addresses can be spoofed. How wide-spread is this problem, and is it ...
1
vote
1answer
87 views

How to block all IPs in CSF except few static IPs?

The title is telling I guess. I'm wondering how to block ALL IPs in csf.deny except few trusted IPs? I've googled but could not find the answer.
1
vote
1answer
414 views

Suspicious Linux binary file in /tmp/ - Munin?

I have a CENTOS 6.6 x86_64 server running ConfigServer Firewall (installed by us) and Munin (installed by the datacentre). CSF has recently (and for no apparent reason) started sending us warnings, ...
1
vote
2answers
63 views

Can't block spammy IP

I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan. I've added the iptables Chain num pkts bytes target prot opt in out ...
1
vote
3answers
900 views

csf stop emails related to Process Tracking

I have enabled LSF with CSF since I would like to receive some informations but I am being bombed by the CSF with similar emails: Subject: lfd on [Hostname]: Excessive resource usage: www-data ...
1
vote
3answers
2k views

How do I secure my OpenVZ host node?

I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure ...
1
vote
1answer
797 views

CSF log files Interpretation

I just installed CSF firewall on my server and I have started seeing the following entries in my log file. Can some one help me understanding as to what is happening Thanks Feb 25 10:45:19 li235-57 ...
1
vote
1answer
738 views

csf Integrated User Interface not working

I've installed CSF on ubuntu 14.04 using their official install guide. After disabling UFW with the following command: sudo ufw disable then I have modified csf.conf with the following values: ...
1
vote
1answer
318 views

CSF Blocking IP on Fail POP3 and cPanel [closed]

I have a VPS with cPanel and i am running around 400+ email accounts under a Office Network, I don't have STATIC IP but i am facing issue when any 1 of employee forget the password and try to access ...
1
vote
1answer
445 views

Proxmox 31 + KVM routing + IP subnet + csf

We have proxmox 3.1 server in netzner with routuing network and IP subnet block. We want to implement csf firewall without interfering the traffic of the KVM VMs, what would be the easiest way? We ...
1
vote
1answer
326 views

LFD always stops working after ~30 days, until I give /etc/csf/csf.pl -r

When I give /etc/csf/csf.pl -r , I see lots of lines flushing, then I begin to get the notification emails again, (several emails per day), for example: Time: Wed Sep 12 08:39:47 2012 +0800 IP: ...
1
vote
1answer
1k views

Config Server Firewall: Spamming my email | lfd on localhost: Suspicious process running under user www-data

I have just installed and configured CSF and I am getting 100s of spam emails containing this message. lfd on localhost: Suspicious process running under user www-data Time: Wed May 23 01:05:52 ...
1
vote
1answer
108 views

csf firewall deny

How can I pass a comment to the command csf -d so I do not have to edit csf.deny, find the line and add a comment as to why it was manually denied?
1
vote
1answer
148 views

CSF Firewall - priority

If a whitelisted IP (csf.allow) uses the wrong password more than 5 times, are they then automatically added to csf.deny? If so, does csf.deny OVERULE csf.allow so that they would be denied access?
1
vote
1answer
143 views

Will running CSF & Bastille cause any conflicts?

I'm taking my first steps into the world of un-managed servers, and have confused myself whilst reading through the 101 tutorials on server hardening that Google spews out! The most recent advice I ...
1
vote
0answers
23 views

CSF+LFD not blocking brute force on xmlrpc.php on Wordpress site

I have just installed csf+lfd on my rackspace cloud server (a vanilla LAMP stack running centos 6.7). I only tweaked a couple of settings in the default csf.conf file: the ports allowed in TCP_IN and ...
1
vote
0answers
56 views

VPS Unknown Read/Write [closed]

I had an lfd email alert - I have installed CSF - today revealing that my server (Centos 6.6) has been using a lot of server resources for 5 minutes. I checked my VPS graphs and noticed that my ...
1
vote
0answers
33 views

CSF Configuration Ignore NodeJS for Excessive Time

I am getting a lot of these: Excessive resource usage: *account* (9580 (Parent PID:9574)) Time: Sat Oct 18 15:20:00 2014 -0400 Account: *account* Resource: Process Time Exceeded: ...
1
vote
1answer
184 views

SSH connection gets dropped when attempting to deploy site using rocketeer

I'm trying to deploy a Laravel site to a development server (cPanel based) using Rocketeer. I am having a problem maintaining the SSH connection, and the server is dropping the connection after ...
1
vote
0answers
1k views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...
1
vote
1answer
479 views

CSF cc_deny is not working

I tried to block a country in CSF Firewall I followed this post http://www.2daygeek.com/how-to-block-a-country-using-csf-firewall/ to block ip from China cc_deny ="CN" While I execute csf -r I ...
1
vote
1answer
1k views

How to white-list specific PHP script process in CSF?

I repeatedly receive a "Suspicious Process" notice from lfd. I'm 100% positive that the PHP script triggering this warning is safe. I wrote it myself and it makes some cross server calls that must ...
1
vote
1answer
515 views

csf/lfd parameter that prevent smtp attacks?

I have a 4~5MB logwatch like this every day! someone like to hack my smtp: .... --------------------- sasl auth daemon Begin ------------------------ SASL Authentications failed 3965 Time(s) ...
1
vote
0answers
188 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
139 views

CSF/LFD configuration settings

/bin/gtar -c -f - -X /home/{USER}/cpbackup-exclude.conf -X /etc/cpbackup-exclude.conf . How can I white list these strings? I've tried stuff like: pcmd: /bin/gtar -c -f - -X /home/* and still ...
1
vote
1answer
393 views

CSF / LFD picking up suspicious users in OpenVZ containers

I have OpenVZ running on a box with CSF / LFD installed. I like the way LFD can alert me of suspicious processes running on the HardwareNode itself. However, LFD is emailing me about every ...
0
votes
3answers
5k views

How does iptables execute rules?

I've been having some trouble with a firewall blocking traffic between two servers recently and want to check how iptables handles multiple rules applying to the same IP. If I run iptables -L -n | ...
0
votes
1answer
104 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
0
votes
1answer
1k views

Hacking attempt detected, Can we block user by PC-Name

Recently we notied that hackers are trying to hack our server, we have IP blocking softwares installed on our server but the thing is that, hacker is using dynamic ip addresses to try again and ...
0
votes
1answer
61 views

cannot send emails to other Web servers

I'm trying to limit my server's open ports in CSF. The IPv4 port settings include: # Allow incoming TCP ports TCP_IN = "22,25,53,80,110,143,443,587,3654,53343” # Allow outgoing TCP ports TCP_OUT = ...
0
votes
1answer
51 views

How to block all traffic which is headed to a particular domain

I have recently added an IP address to my VPS. The problem is that the previous owner has abandoned the domain name with its nameservers set on this IP. Although any access to this domain is denied by ...
0
votes
1answer
265 views

Cannot close Port 25 after installing postfix

Before installing logwatch (which installs postfix) on Ubuntu 12.04, the port 25 is blocked by iptables/csf PORT STATE SERVICE 25/tcp filtered smtp After installing logwatch (which installs ...
0
votes
1answer
477 views

ConfigServer CSF and iptables config

I'm aware there is a /etc/sysconfig/iptables file, with rules for iptables (and what's the effective difference with /etc/sysconfig/iptables-config?). I installed CSF & LFD. You can configure ...
0
votes
2answers
671 views

ConfigServer Security and Firewall — after setup, how much daily management required?

I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
0
votes
1answer
5k views

Config Server Firewall: You need to install the missing perl modules and then install cxs

I am trying to install config server firewall however when i follow the tutorial and run install.sh i get the following error. Can anyone help? root@localhost:~/csf# sh install.sh Configuring for OS ...
0
votes
1answer
320 views

Help - DDOS Attack [duplicate]

I am under a DDOS attack. I'm trying to locate the IP address that is making 1100+ connections, however, when running the following command, it shows a 1100+ connection, but the ip address column is ...
0
votes
1answer
150 views

Can you load more files (instead of csf.allow) in CSF? like *.conf in Apache?

Currently I keep all of the blocked IPs for my CSF firewall in a single "csf.deny" file which is getting difficult to maintain. In an attempt to organize things a bit more (since not ALL of the IP ...
0
votes
3answers
2k views

How to check if CSF firewall is running

My ex-system admin installed CSF on a server witout Admin panel. I can see CSF installed but I am not sure if its currently running or not. I dont want to try to start / stop it. I realized there is ...
0
votes
1answer
130 views

Can't connect to Ubuntu VPS via SSH,SFTP

When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...