ConfigServer Community Forum

Thank you for the work around but are you sure that this is really the intended functionality instead of a byproduct of the way the logs are searched? Seems like the "Port Flood" log entries were a good idea so we could tell if someone was getting throttled but the "Port Scan" fu...

I have found that it a users IP gets throttled by the PORTFLOOD limit, it is logged as *Port Flood* but LFD seeing 11 of them (one more than the defined PS_LIMIT of 10) will result in LFD adding a temporary deny against the IP for "*Port Scan* detected".

Thanks for the quick resolution Chirpy.

Thanks that should help as a quick and dirty improvement.
Hope you can get a more refined way of handling into a future release.

Hello Chirpy, I have recently been seeing frequent high CPU usage reported for LFD processes that appears to occur during the retrieval of the global ignore list we use which contains around 100 specific IP addresses and 15 class C blocks like 123.123.123.0/24 . Is there any reason that you know of ...

Wonderful Chirpy, thanks!

In the dyndns file (/etc/csf/csf.dyndns) it states: # Only list fully qualified domain names (FQDN's) in this file, either on their # own to allow full access, or using Advanced Allow/Deny Filters (see # readme.txt) I have tried using the following advanced filter rule: tcp|in|d=22|s=something.dyndn...

I think the "add your own rules" part is what throws people off on this.
I would love to see a list of optional rule sets with check boxes so we could just check those we want and they are auto downloaded and installed.

Wow Chirpy, nice seeing the following added in the changelog already:

chirpy wrote:I've added the idea to the dev list for the future. Great idea

Wonderful Chirpy, I love global options personally.
Ever considered Global conf option like:

"GLOBAL_CONF = "htp://server/csf.conf"
(or maybe sections such as the lfd portion?)