Questions tagged [csf]
ConfigServer Security & Firewall
128
questions
0
votes
0
answers
49
views
"Exim syntax errors" in CSF block IP list
I am using ConfigServer Security & Firewall - csf v14.19.
In the block IP list, I find the following line:
What does this mean?
- 163
0
votes
0
answers
23
views
Newbie: How to add mod_sec rule exception for specific use-case
maybe someone with experience or basic knowledge that knows what they're doing (unlike me :)) can help....
Currently, I have Ubuntu 20.04 installation with OpenLitespeed and Cyberpanel.
I've installed ...
0
votes
0
answers
34
views
Limiting the number of url address characters on the site and blocking it
hackers are slowing down my server
They send repeated requests with different IPs
They are constantly sending long url addresses like below:
mysite.com/asm-nfm555sd5-nfm.mp3asm-dnfm555sd5-nfm....
- 1
0
votes
0
answers
50
views
CSF : Block Port but ignore
Is it possible to block a port (port 585) and not have it trigger an IP block ?
Customers using Apple Mail are constantly hitting port 585 (I think Mac Mail attempts to go into 'troubleshooting mode' ...
- 113
0
votes
1
answer
66
views
CSF has port 22 listed for TCP_IN, what is blocking certain IPs?
I went through my whole csf config, and unless I'm missing something it's not treated or listed any differently than port 80, although it blocks all IPs that are not white listed. Port 80 will allow ...
- 89
0
votes
0
answers
167
views
CSF Deny an IP Range Exclude specific IP on specific port
I've bunch of ips / networks added to csf.deny
csf.deny
1.1.0.0/19 # do not delete
However i want to allow 1.1.1.1 on port 80 and 443 with csf.allow
csf.allow
tcp|in|d=80|s=1.1.1.1
tcp|in|d=443|s=1.1....
- 1
0
votes
1
answer
451
views
Whitelisting Gmail SMTP in CSF
In my csf.deny, I have 0.0.0.0/0 blocked to prevent requests being sent to the raw server IP. This creates issues with sending e-mails. I utilize Google SMTP to send e-mail. I can't seem to figure out ...
- 3
0
votes
0
answers
179
views
docker cannot reach external urls
i have a server and it has installed CSF (firewall). I run docker in the server and the docker-CSF config is enabled, I can reach the containters via nginx reverse proxy.
But i have a problem, the ...
- 111
0
votes
1
answer
313
views
How can I stop this kind of exim attack?
I has been search here, BUT no topic about my question (they just ask for their email was rejcted, but this time, not my email was been reject), it seem someone try to send spam out via my server, ...
- 1
0
votes
2
answers
399
views
How to block IPs making requests to specific domain?
I have a server with CSF and ModSecurity enabled.
I'd like to set up a rule or configuration that will automatically block (for a specified amount of time) any IP that makes incoming requests to a ...
- 173
0
votes
1
answer
151
views
Getting random 404 requests from unknown IPs in Apache + Ubuntu server
This is strange.
I just installed a new Ubuntu + Apache in my Digitalocean droplet and installed a Laravel APP there.
Now suddenly I see these kind of strange POST, GET and CONNECT requests from ...
1
vote
0
answers
2k
views
Failed to start IPv4 firewall with iptables
I'm running CentOS 8 Webserver and recently I had some issues with the CSF Firewall, the CSF Service is running but the LFD is failed.
I did some research and I was able to fix it by doing iptables --...
- 119
0
votes
1
answer
684
views
CSF firewall - Only allow FTP access to users connecting via specific hostname
I'd like to only allow FTP access to users who connect via a specific hostname like: portal4321.vps22.hostingserver.com.
And block every request which tries to connect to the FTP in a different manner,...
- 23
0
votes
1
answer
395
views
CSF not blocking traffic to docker
CSF is installed at host and following is applied
https://github.com/juli3nk/csf-post-docker
When IP is blocked in CSF, ICMP and request to all other ports gets blocked (except the ones which are ...
- 1
0
votes
1
answer
1k
views
How to automatically block with MODSEC or CSF an IP Address when it tries to access a URL
We have in our server logs every day continuos bot trying to access the below for example:
Requests with error response codes
404 Not Found
/favicon.ico: 3 Time(s)
/3ckkB-ZOp30: 2 Time(s)
/adminer-3....
2
votes
1
answer
491
views
csf: how to override TCP_IN?
I'm using csf v14.05 on my Debian-8-based server.
In csf.conf, I have the following:
TCP_IN = "53,80,110,119,143,443,465,587,953,993,995"
I want to selectively override this in csf.deny, ...
- 220
-1
votes
1
answer
152
views
How to connect to our distant server using a local hostname from dyn or -noip on local computer client instead of computer ip?
We using CSF as firewall on CPANEL. We blacklisted all countries except few.
Within the CSF there is a dyddns function allowing a FQDN to connect through...
We then set up a no-ip.com account with IP/...
- 1
0
votes
1
answer
1k
views
CSF failed to Start after Ubuntu 20.04 upgrade from 18.04
Today I have upgraded my Ubuntu 18.04.04 VPS server to Ubuntu 20.04. Now CSF not starting and shows the following error and not start the CSF service.
*Error* The path to iptables is either not set or ...
- 107
6
votes
1
answer
3k
views
Running docker containers only local behind csf firewall
I want to access docker containers only locally behind the csf firewall on a remote Ubuntu server. I changed the DOCKER settings options in /etc/csf/csf.conf to 1 to allow docker to change iptable ...
- 161
1
vote
0
answers
257
views
CSF/LFD: Firewall automatically disabling again and again
I have setup a droplet on Digital Ocean, and installed CentOS Web Panel. After the initial configuration, I've enabled CSF/LFD firewall. But it is automatically disabling, again and again. I have ...
- 97
1
vote
2
answers
1k
views
Brute Force attack in DirectAdmin
I have problem with brute force monitor in direct admin.
Every minute i get info like this:
15705610210001 52.187.17.107 123 1 sshd4 Oct 8 20:56:24 server sshd[10817]: Failed password for ...
- 11
1
vote
1
answer
777
views
Cloudflare behind site iptables not blocking HTTP and HTTPS ports
When the Fail2ban trigger an IP ban action, I want to block all the ports on my Ubuntu Server. Right now, I use banaction = iptables-allports and CSF. At this moment it only blocked SSH port, even if ...
- 107
1
vote
3
answers
2k
views
How to config CSF to allow postrouting in iptables for installing OpenVPN?
I am installing OpenVPN on my server and according to the tutorial I'm following I have to add the following line to iptables:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
I add it and save ...
- 111
1
vote
1
answer
841
views
Docker, csf and mariadb connection
I have a host with csf firewall allowing some external ports like ssh, http, https.
I have now installed docker and mariadb through docker. I use docker run command with -p 6000:3306, so that means ...
- 123
2
votes
1
answer
2k
views
Block direct port 80 access on default IP using iptables?
I am using nginx with cloudflare in front of my sites to protect them from layer 7 attacks but now some attackers found this new way and they are daily attacking my default IP directly with layer 7 ...
- 21
0
votes
1
answer
1k
views
iptables shows a warning message but I am unable to solve it
When I typed this command in SSH to see rules, it returns the following warning message in iptables. I am wondering what is it and how to solve it.
iptables -L
LOG tcp -- anywhere ...
- 242
1
vote
1
answer
2k
views
FTP command line: Could not open data connection to port 48412: Connection timed out
I'm trying to send a file using ftp command line. It's working in my laptop by not in my vps server.
ftp -v -n <<EOF
open ftp.myserver.com
user username password
cd /folder/
put file.csv
EOF
I'...
- 77
1
vote
1
answer
707
views
CSF firewall in EC2
I am a developer who has very limited knowledge of server administration; I learn as I go and mainly deal with web servers.
Is a firewall like CSF needed on something like EC2 given that AWS already ...
- 329
0
votes
2
answers
694
views
Defending from random GET requests
I am getting attacked, and my site is constantly receiving thousands of requests like this
GET /?HMPCL=INQUVOBHZ HTTP/1.1
I have mod-security installed, waf comodo and csf.
Even mod-security blocks ...
- 375
1
vote
1
answer
2k
views
How to block a small IP range in csf
I'm looking for a way to block a small ip range in csf, e.g. 151.80.31.103 to 151.80.31.115
I know how to block each ip by issuing a cmmand csf -d IP, but it is a lot more effective to have a way to ...
- 229
5
votes
1
answer
4k
views
IP addresses denied in /etc/hosts.allow appear in /etc/csf/csf.deny?
I modify my /etc/hosts.allow file as
sshd : 192.168.0.0/255.255.255.0 : allow
sshd : xxx.xxx.xxx.* : allow
sshd : ALL : deny
(where the xxx represent my actual IP address numbers and the wildcard * ...
- 176
1
vote
0
answers
239
views
CSF integrated UI stops working after few minutes
I have a Centos web server without any control panel like cPanel
I've installed CSF/LFD and I've configured it to enable the integrated UI
It was working fine using port 6666, but after few minutes ...
- 131
2
votes
1
answer
416
views
Is it possible to open a CSF-LFD closed port without attaching an IP to it?
CSF-LFD blocks nearly all open ports. It also blocks port 10000 which I need.
I can open the port via a similar code:
cat << EOF >> /etc/csf/csf.conf
tcp|in|d=10000|s=aa.bb.cc.dd
EOF
...
user329119
1
vote
2
answers
448
views
/usr/sbin/amavisd-new - why is pcmd/regex not working for this command in csf.pignore?
For some reason I cannot get CSF's LFD (/etc/csf/csf.pignore) to ignore amavisd-new running via perl. The daemon runs via /usr/bin/perl /usr/sbin/amavisd-new (some mode) however it seems that when I ...
- 123
1
vote
0
answers
846
views
LFD is unable to download blocklist RBN, cannot remove it from config
I set up CSF on my cPanel installation to help manage the firewall and provide brute-force protection. One of the features of CSF (Actually LFD, which comes included) is the ability to block IP ...
- 191
0
votes
1
answer
536
views
pptp gre in csf firewall
i have a senior problem. when i want to connecting a pptp over a tap adaptor or a pptp connection have get disconnected and get this errors on messages logs:
linux pptpd[20275]: GRE: read(fd=7,buffer=...
- 13
1
vote
1
answer
489
views
limiting ip range on openvpn server
We're trying to setup a openvpn server on centos 6.
We have blocked all IP adresses except a couple in a whitelist via /etc/hosts.deny, also we did the same with csf.deny (except for the whitelist).
...
- 113
0
votes
1
answer
281
views
CSF Firewall unblock countries
I've a VPS Server running CENTOS 6.7 x86_64 with CSF Firewall activated. Sometimes I see in "Firewall Deny IPs" that blocks suddenly connections from my country (Spain) to some of my clients.
Not ...
0
votes
1
answer
355
views
Why is lfd prematurely removing blocks?
As you can see in the excerpted log file below (from /var/log/lfd.log), lfd is prematurely removing temporary blocks that it imposes on IPs:
Apr 7 13:07:59 host lfd[32117]: (wordpressxmlrpc) Request ...
- 339
0
votes
1
answer
2k
views
How does CT_LIMIT (the csf firewall setting) work?
I've been wondering if the csf firewall counts the connections for the last CT_INTERVAL seconds and then compares them to the CT_LIMIT value, or it just counts the current (at the moment) connections ...
- 101
0
votes
2
answers
1k
views
Haproxy logging doesn't work. Does that have anything to do with csf?
Does Haproxy log every time a connection is made? I have followed instructions from other threads to set up logging via rsyslogd. Even though the files are created (haproxy.log,haproxy-info.log and ...
- 211
1
vote
0
answers
1k
views
CSF+LFD not blocking brute force on xmlrpc.php on Wordpress site
I have just installed csf+lfd on my rackspace cloud server (a vanilla LAMP stack running centos 6.7). I only tweaked a couple of settings in the default csf.conf file: the ports allowed in TCP_IN and ...
- 111
3
votes
1
answer
4k
views
How to block all IPs in CSF except few static IPs?
The title is telling I guess.
I'm wondering how to block ALL IPs in csf.deny except few trusted IPs?
I've googled but could not find the answer.
- 213
0
votes
0
answers
71
views
CSF ignore list skips some ignore exclusions
I have try to prevent sending Suspicious File Alert emails which contain:
File: /tmp/netatop-0.5/netatop.init
Reason: Script, starts with #!
File: /tmp/netatop-0.5/mkversion
Reason: Script, ...
- 371
0
votes
1
answer
790
views
How to block all traffic which is headed to a particular domain
I have recently added an IP address to my VPS. The problem is that the previous owner has abandoned the domain name with its nameservers set on this IP. Although any access to this domain is denied by ...
- 555
0
votes
0
answers
642
views
exim queue notification if a domain is sending more than x number of emails
I am running Exim as an MTA. I have also implemented a Per hour Per domain email Limit. Still I see that my IP reputation goes bad if a spammer sends more than x amount of emails in 24 hours or so.
I ...
- 181
-5
votes
1
answer
253
views
I cannot block an IP [closed]
I have a redirect rule on my CSF like the below;
17.1.1.13|80|27.5.5.22|80|tcp
17.1.1.13 is my firewall(csf) and 27.5.5.22 is my web server address. So everybody access my web site through the ...
- 203
0
votes
1
answer
894
views
Can't connect to Ubuntu VPS via SSH,SFTP
When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...
- 107
0
votes
1
answer
1k
views
How do I use CSF to redirect domain requests to a port?
I have a server setup that uses two different webservers with different subdomains. Right now the servers listen on different ports (80 & 4000)
So users don't have to put in :4000 I'd like to ...
0
votes
1
answer
655
views
CSF not adding IPs to deny file as a cron during high loads
I'm running a cron every minute to thwart brute-force attacks.
awk '{print $2}' < ipkill.txt | while read ip; do
#query geographical info IP address
curl -o country.txt ipinfo.io/$ip
...
- 13