ConfigServer Community Forum

Not sure if the title describes what I mean, so I'll explain.

Lately we are receiving brute force attacks (SMTP) from different spoofed IP addresses, but they all have in common host IP, for example:

2012-12-02 09:10:27 login authenticator failed for host100-107-static. 224-95-b. business. telecomitalia. it ([ 192.168.2.33 ]) : 535 Incorrect authentication data (set_id=scan)
2012-12-02 10:52:33...

dear all,

We really like csf, but in my humble opinion i do miss the definition of interfaces in csf.

as a hoster we also use internal network link with a 10.0.0.0/8 range for internal backups so we need to disable bogon network completely enabling this on the public facing interfaces is preferred. (i also read iod's question here for the same issue)

also i really miss the definition of the...

Hello,

I'm using on OSPF/Quagga tunnel interface for allocation pool of IPs to my server. When I'm enabling CSF firewall IPs doesn't work anymore. I'm trying to whitelist OSPF router IP and tunnel network, but this is doesn't help me. How I can whitelist raw proto into CSF?

raw 0 0 0.0.0.0:89 0.0.0.0:* 7 238321/ospfd
raw 0 0 :::58 :::* 7 238136/zebra

HI, I'd like to suggest that while using a single LF_INTERVAL is ok for most login failure checking, it might be neccesary for the distributed SMTP checking to have a shorter interval.

In order to tighten things up recently we've had to increase LF_INTERVAL to block IP's over a longer period of time, as the trend from spammers seems to be to re-use the same IP's less frequently, to avoid these...

Hello all,

In order to block distributed SMTP attacks using hacked passwords, I have set the following parameters:

LF_INTERVAL = 600
LF_DISTATTACK = 1
LF_DISTSMTP = 3
LF_DISTSMTP_UNIQ = 3
LF_DISTSMTP_PERM = 1

I also have some IPs listed in csf.allow and lfd.ignore. It seems that everytime someone sends ONE email from any of the ignored IP, an entry is added to the lfd.log file (below).

Oct 29...

Not sure if this has been posted, but are you thinking about doing some graphics/statistics on temp/perm blocks taking place? like time of day, day of month, protocals, countries, etc?

Not sure if this is the best way to solve this but it's impossible to see changes in slow queries on the graphs when the scale for the regular queries is so high.

Slow queries appears as a flat red line next to zero on all our graphs because it's an average per minute, which is almost always 1 per minute when calculated that way.

Instead I'd like to be able to have slow queries as cumulative...

Hello,

Would it be possible to add a disk latency/response graph to the statistics pages? A metric and history of latency would be useful for people running cPanel on VPS where disk contention is more of a performance issue than many other things.

Average and perhaps peak disk latency would be most useful.

Thanks,

Chris

When I run the security check, it gives a warning that I need to disable LOAD DATA LOCAL. I have local-infile=0 in my.cnf under the msyqld section, and Virtualmin's MySQL webmin module reports under system variables that local-infile is off. I've restarted the server a number of times but CSF still reports that I need to disable it.

Any ideas?

Thanks!
Alan

I'd like to tempban or permban an ip after they cause a certain number of 404s in a certain amount of time.

Since CSF/LFD already tails the error log, would this be easily possible?

Maybe it would be possible to do a selection/regex of error types.

Basically this is for bots that do exploring to see if the can find a registration page to start to spam.

I love the script actions for various alerts, ie load alert for example. Would it be possible to add these in for script alerts and relay alerts as well ? I could add it easily myself, but it would be overwritten on updates. We would like to do a little bit of automation after these alerts occur and that would be a great feature to have.

Hi, I have found a bug with the regex used to monitor apache error logs for modsecurity events.

As you have it now, it can only detect DENY events. It cannot however detect DROP events.

currently:
\ \ mod_security: Access denied with code/))
\ \ ModSecurity:(( \[ ]+\])*)? Access denied with code/))

Except DROP events use the log line:
ModSecurity: Access denied with connection close...

Hi,

I use CSF Firewall on multiple generic boxes/networks (without cPanel) and I think it's great! It saves so much time and hassle. I even use it on the router for my home LAN. Many thanks to the Dev's.

Unfortunately some of the networks I'm on do not yet have native IPv6, so instead I use a tunnel service like Hurricane Electric tunnelbroker. Using a tunnel adds an additional interface to the...

In the check security page it warns you about the lack of register_globals = Off line but in php 5.4 there is no such setting anymore. So the warning is not right in php 5.4

Our server has been grinding to a halt because of brute force login attempts on POP3 and CSF isn't detecting it.

Example of mail log:

May 1 03:49:17 vendsmart dovecot: auth(default): pam(alex,::ffff:205.217.244.10): PAM child process 7194 timed out, killing it
May 1 03:49:17 vendsmart dovecot: auth(default): pam(customer,::ffff:205.217.244.10): PAM child process 7205 timed out, killing it
May 1...

Please add support for domain name support access/deny list with wildcard
for example:
allow *.com

We use csf+lfd and the Directadmin Bruteforce detector. when the da bruteforce detector detects it runs this command

c s f -d $ip Added by DA BruteForce monitor

we noticed that with this method the c s f . p l does not check the csf.ignore but only the csf.allow as the bruteforce detector is a bit like lfd, then i would assume in this case it should also check the csf.allow and the csf.ignore...

Hi,

On June 12, 2012, Spamhaus added an extended DROP (EDROP) list to be used along with the DROP list. The EDROP list is located here - . Information about the list is here - .

Currently the list has 12 entries.

Thanks for your consideration.

Terry

Hello!

If Cpanel's webmail and cpanel proxy subdomains are enabled, an attacker is able to try unlimited attempts through those subdomains, since CSF does not block port 80 (it only blocks 208X, 209X ports).

Fix: Add port 80, 443 for port blocking.

Regards,

Hi to everyone,
First I come to thank the developers of the CSF by the efficiency of this system and I'm here to provide an improvements in their codes.
Well.. On my webhost company I created the modification for my csf to send a netstat table report when load average is too high.

I believe that this information is useful, especially in case of DDoS attack if you can know which IPs are...