Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csf]

ConfigServer Security & Firewall

0
votes
0answers
23 views

Whitelist outgoing SMTP server using CSF

Am trying to setup Mandrill for transactional emails for one of my web application. I decided to use the SMTP method(credentials from Mandrill) than using API as it would be easy for me. In my VPS ...
0
votes
0answers
68 views

Docker and csf when running outline server

I've installed Outline (uses Docker) on my server while I have csf firewall enabled. the problem is I don't know what incoming and outgoing ports should I add to csf whitelist.
0
votes
0answers
26 views

Csf error if=/dev/zero of=/var/lib/csf/dd_test bs=1MB count=64

I can not restart csf and I get this error code Error: Error Invalid configuration line [ST_DISKW_DD = "if=/dev/zero of=/var/lib/csf/dd_test bs=1MB count=64] in /etc/csf/csf.conf, at line 143 in /usr/...
0
votes
0answers
74 views

Enable only IP Block and ssh notification email alerts in CSF firewall

I have edit a email id for getting a email alerts from csf in csf.conf file here LF_ALERT_TO= after that i am getting so many mails i want to eanble only ssh and IP blocking alerts from here?
1
vote
1answer
260 views

How to config CSF to allow postrouting in iptables for installing OpenVPN?

I am installing OpenVPN on my server and according to the tutorial I'm following I have to add the following line to iptables: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE I add it and save ...
1
vote
0answers
196 views

Docker, csf and mariadb connection

I have a host with csf firewall allowing some external ports like ssh, http, https. I have now installed docker and mariadb through docker. I use docker run command with -p 6000:3306, so that means ...
0
votes
1answer
605 views

Block direct port 80 access on default IP using iptables?

I am using nginx with cloudflare in front of my sites to protect them from layer 7 attacks but now some attackers found this new way and they are daily attacking my default IP directly with layer 7 ...
0
votes
1answer
184 views

iptables shows a warning message but I am unable to solve it

When I typed this command in SSH to see rules, it returns the following warning message in iptables. I am wondering what is it and how to solve it. iptables -L LOG tcp -- anywhere ...
0
votes
1answer
740 views

FTP command line: Could not open data connection to port 48412: Connection timed out

I'm trying to send a file using ftp command line. It's working in my laptop by not in my vps server. ftp -v -n <<EOF open ftp.myserver.com user username password cd /folder/ put file.csv EOF I'...
1
vote
1answer
265 views

CSF firewall in EC2

I am a developer who has very limited knowledge of server administration; I learn as I go and mainly deal with web servers. Is a firewall like CSF needed on something like EC2 given that AWS already ...
0
votes
2answers
216 views

Defending from random GET requests

I am getting attacked, and my site is constantly receiving thousands of requests like this GET /?HMPCL=INQUVOBHZ HTTP/1.1 I have mod-security installed, waf comodo and csf. Even mod-security blocks ...
1
vote
1answer
974 views

How to block a small IP range in csf

I'm looking for a way to block a small ip range in csf, e.g. 151.80.31.103 to 151.80.31.115 I know how to block each ip by issuing a cmmand csf -d IP, but it is a lot more effective to have a way to ...
3
votes
1answer
703 views

IP addresses denied in /etc/hosts.allow appear in /etc/csf/csf.deny?

I modify my /etc/hosts.allow file as sshd : 192.168.0.0/255.255.255.0 : allow sshd : xxx.xxx.xxx.* : allow sshd : ALL : deny (where the xxx represent my actual IP address numbers and the wildcard * ...
1
vote
0answers
97 views

CSF integrated UI stops working after few minutes

I have a Centos web server without any control panel like cPanel I've installed CSF/LFD and I've configured it to enable the integrated UI It was working fine using port 6666, but after few minutes ...
3
votes
1answer
165 views

Is it possible to open a CSF-LFD closed port without attaching an IP to it?

CSF-LFD blocks nearly all open ports. It also blocks port 10000 which I need. I can open the port via a similar code: cat << EOF >> /etc/csf/csf.conf tcp|in|d=10000|s=aa.bb.cc.dd EOF ...
0
votes
1answer
197 views

/usr/sbin/amavisd-new - why is pcmd/regex not working for this command in csf.pignore?

For some reason I cannot get CSF's LFD (/etc/csf/csf.pignore) to ignore amavisd-new running via perl. The daemon runs via /usr/bin/perl /usr/sbin/amavisd-new (some mode) however it seems that when I ...
1
vote
0answers
363 views

LFD is unable to download blocklist RBN, cannot remove it from config

I set up CSF on my cPanel installation to help manage the firewall and provide brute-force protection. One of the features of CSF (Actually LFD, which comes included) is the ability to block IP ...
0
votes
1answer
254 views

pptp gre in csf firewall

i have a senior problem. when i want to connecting a pptp over a tap adaptor or a pptp connection have get disconnected and get this errors on messages logs: linux pptpd[20275]: GRE: read(fd=7,buffer=...
1
vote
1answer
368 views

limiting ip range on openvpn server

We're trying to setup a openvpn server on centos 6. We have blocked all IP adresses except a couple in a whitelist via /etc/hosts.deny, also we did the same with csf.deny (except for the whitelist). ...
0
votes
0answers
197 views

Config Server LFD sends reports on /usr/bin/php but does not list a process

So I am running a cPanel VPS (Virtuozzo based), I have nginx as a proxy to apache, and am running php 5.6 with FCGI as the handler. I am getting loads of email alerts each day such as the 2 below: ...
0
votes
1answer
96 views

CSF Firewall unblock countries

I've a VPS Server running CENTOS 6.7 x86_64 with CSF Firewall activated. Sometimes I see in "Firewall Deny IPs" that blocks suddenly connections from my country (Spain) to some of my clients. Not ...
0
votes
1answer
148 views

Why is lfd prematurely removing blocks?

As you can see in the excerpted log file below (from /var/log/lfd.log), lfd is prematurely removing temporary blocks that it imposes on IPs: Apr 7 13:07:59 host lfd[32117]: (wordpressxmlrpc) Request ...
0
votes
1answer
646 views

How does CT_LIMIT (the csf firewall setting) work?

I've been wondering if the csf firewall counts the connections for the last CT_INTERVAL seconds and then compares them to the CT_LIMIT value, or it just counts the current (at the moment) connections ...
0
votes
2answers
549 views

Haproxy logging doesn't work. Does that have anything to do with csf?

Does Haproxy log every time a connection is made? I have followed instructions from other threads to set up logging via rsyslogd. Even though the files are created (haproxy.log,haproxy-info.log and ...
1
vote
0answers
1k views

CSF+LFD not blocking brute force on xmlrpc.php on Wordpress site

I have just installed csf+lfd on my rackspace cloud server (a vanilla LAMP stack running centos 6.7). I only tweaked a couple of settings in the default csf.conf file: the ports allowed in TCP_IN and ...
3
votes
1answer
2k views

How to block all IPs in CSF except few static IPs?

The title is telling I guess. I'm wondering how to block ALL IPs in csf.deny except few trusted IPs? I've googled but could not find the answer.
0
votes
0answers
52 views

CSF ignore list skips some ignore exclusions

I have try to prevent sending Suspicious File Alert emails which contain: File: /tmp/netatop-0.5/netatop.init Reason: Script, starts with #! File: /tmp/netatop-0.5/mkversion Reason: Script, ...
0
votes
1answer
380 views

How to block all traffic which is headed to a particular domain

I have recently added an IP address to my VPS. The problem is that the previous owner has abandoned the domain name with its nameservers set on this IP. Although any access to this domain is denied by ...
0
votes
0answers
495 views

exim queue notification if a domain is sending more than x number of emails

I am running Exim as an MTA. I have also implemented a Per hour Per domain email Limit. Still I see that my IP reputation goes bad if a spammer sends more than x amount of emails in 24 hours or so. I ...
-5
votes
1answer
171 views

I cannot block an IP [closed]

I have a redirect rule on my CSF like the below; 17.1.1.13|80|27.5.5.22|80|tcp 17.1.1.13 is my firewall(csf) and 27.5.5.22 is my web server address. So everybody access my web site through the ...
0
votes
1answer
624 views

Can't connect to Ubuntu VPS via SSH,SFTP

When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...
0
votes
1answer
766 views

How do I use CSF to redirect domain requests to a port?

I have a server setup that uses two different webservers with different subdomains. Right now the servers listen on different ports (80 & 4000) So users don't have to put in :4000 I'd like to ...
0
votes
1answer
516 views

CSF not adding IPs to deny file as a cron during high loads

I'm running a cron every minute to thwart brute-force attacks. awk '{print $2}' < ipkill.txt | while read ip; do #query geographical info IP address curl -o country.txt ipinfo.io/$ip ...
0
votes
1answer
247 views

IPTables Rules Being Loaded From Somewhere

I'm having troubles connecting (meaning I can't connect to any IP or port) to my server and it appears that the problem was to do with CSF. I uninstalled CSF (by running /etc/csf/uninstall.sh) and ...
0
votes
1answer
484 views

CSF Update resets IPTables rules

This is with CentOS 6. On one of my servers, periodically all IPTables rules are simply dropped and all connections start being blocked. It happens fairly randomly once every few days. I have a script ...
0
votes
0answers
884 views

CSF does not open port

I'm having a Ubuntu 14.04 server which has a TomCat installation listening on port 8080. I installed CSF today. Following is netstat -tulpn tcp6 0 0 :::8080 :::* ...
-3
votes
1answer
4k views

CSF *Port Scan* detected - shared hosting [closed]

We modified a few options in ConfigServer Firewall configuraion. Ever since the CSF blocking a lot of IP address. Following print sreen: http://oi60.tinypic.com/kdlnh3.jpg What can I modify thereto ...
0
votes
1answer
1k views

Filezilla can not connect my new ftp port on centos 6.6

I have a webserver running on Centos 6.6. Recently Config Server Security Firewall send me over 150 email about some malicious bots trying to guess my clients ftp users and passwords. I hate ...
0
votes
1answer
3k views

Unblock All Ports in CSF? [closed]

I have CSF installed on a cPanel server and know that I believe that I can unblock ports specifically for outgoing connections in the /etc/csf/csf.conf file. It looks like this line can just be ...
1
vote
1answer
787 views

Suspicious Linux binary file in /tmp/ - Munin?

I have a CENTOS 6.6 x86_64 server running ConfigServer Firewall (installed by us) and Munin (installed by the datacentre). CSF has recently (and for no apparent reason) started sending us warnings, ...
-1
votes
1answer
227 views

CentOS - how to tell what conf file CSF (firewall) is using? csf.conf then restart not updating [closed]

in /etc/csf/csf.conf the following is setup LF_CPANEL = "5" LF_CPANEL_PERM = "3600" restarting csf by doing the following csf -r does not seem to have an impact on the above attributes. According ...
1
vote
2answers
102 views

Can't block spammy IP

I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan. I've added the iptables Chain num pkts bytes target prot opt in out ...
1
vote
0answers
134 views

CSF Configuration Ignore NodeJS for Excessive Time

I am getting a lot of these: Excessive resource usage: *account* (9580 (Parent PID:9574)) Time: Sat Oct 18 15:20:00 2014 -0400 Account: *account* Resource: Process Time Exceeded: ...
0
votes
1answer
2k views

NUMIPTENT is too low to add 5333 rules (CSF firewall error)

The VPS iptables rule limit (numiptent) is too low to add 5333 rules (19469/24000) CSF stopped working spontaneously today. Saying it can't start because it can't add 5333 rules to an apparent total ...
1
vote
1answer
3k views

csf Integrated User Interface not working

I've installed CSF on ubuntu 14.04 using their official install guide. After disabling UFW with the following command: sudo ufw disable then I have modified csf.conf with the following values: (...
0
votes
1answer
96 views

cannot send emails to other Web servers

I'm trying to limit my server's open ports in CSF. The IPv4 port settings include: # Allow incoming TCP ports TCP_IN = "22,25,53,80,110,143,443,587,3654,53343” # Allow outgoing TCP ports TCP_OUT = "...
0
votes
2answers
6k views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
1
vote
1answer
543 views

SSH connection gets dropped when attempting to deploy site using rocketeer

I'm trying to deploy a Laravel site to a development server (cPanel based) using Rocketeer. I am having a problem maintaining the SSH connection, and the server is dropping the connection after ...
0
votes
2answers
449 views

Openning a port in my CentOS server [closed]

I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
1
vote
0answers
3k views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...