ConfigServer Community Forum

I would like to suggest CSF to automatic report to users/admins of Internet abuse associated network/email activity. So you can automatic send email to WHOIS ABUSE emails about the security incident.

Not sure if this is possible with CSF, but is there a way to watch log files that get out of control? I had a small problem today messing about with modsecurity and set this bit:
SecDebugLogLevel 5
along with some very tight rules, apparently blocking blackberry access to one account with lots of traffic. Anyway, I got sidetracked and forgot to go back and dial it back down. Needless to say the...

Hi Jonathan,

Back in the APF/BFD days, I had added an SSH block rule for /var/log/secure matching:-

eg:-
Nov 1 09:36:27 mail sshd : Did not receive identification string from 61.185.130.226

That was always followed by invalid login attempts.

More recently, I have noticed that the following short term repeated disconnects also appear to warn of impending attack:-

Nov 1 11:18:11 mail sshd :...

possible to port forward ports say from linux to windows?

source : port / dest : port

0.0.0.0:6112 192.168.x.xxx:6112 (TCP/UPD/BOTH) ?

I would like to block full urls so that I can block rapidshare.com etc because people like to run rapid leech on my server.

Chirpy,
I would love to see an option for global support of dyndns like the global allow/deny/ignore:

GLOBAL_DYNDNS = htp://server/csf.dyndns
(had to obfuscate the URL to get past the only post URL's if you have 5 posts rule)

Currently I will have to use a cron to download and overwrite the /etc/csf/csf.dyndns file and perform a restart which is far from optimal.

While on the subject of...

Hi,

On FTP login failures or any of the services really, is it possible to block the IP connecting to the FTP ports instead of blocking the IP address from accessing anything on the server after x (as configured) unsuccessful login attempts?

Something in the line of;

iptables -I INPUT -m tcp -p tcp --dport 21 -s 111.222.333.444 -j DROP

instead of

iptables -I INPUT -s 111.222.333.444 -j DROP...

Hi folks,
CSF is simply the most useful application available for cpanel. That said, the ConfigServer Security&Firewall could be extended to end World Hunger, Purify water and end Hacker Crime.

Well, at least one of the three -- Here's my concept:

Using ConfigServer Security&Firewall, set up a central hacker IP activity database.

Include an option in CSF to allow for daily sending of the...

Well.

Many times, customers are very big heads, and blocked again and again.

At the end acabn put a support ticket or in some cases a call like What happens! Server does not work ...

I'm not good with scripts (something in bash) but a little.

In cpanel the email address this in the file / var / cpanel / users / in contactemail.

It would be nice to configure CFS to wish you that if you...

i would like to see this option:
Generate and email this report if score is below: and a dropdown of scores like:
116,117,118, etc.

i think this is more useful/convenient than receiving an email every night and scrolling down to its bottom to see the score... i find it pretty annoying sometimes.

Since bots and zombie computer are getting harder for the average bot kiddy to come by now a days they are resorting to GET attacks on dynamic sites with the inetention to exhaust resources which in most cases it does no matter if you have network ddos protection, connection tracking, etc. The requests are legit requests for like index.php or GET / over and over but it does it slow enough and...

Since upgrading a cPanel account to 11.24 and switching from Courier to Dovecot, I'm noticing a variety of entries in /var/log/exim_mainlog that in the past I think would have triggered LFD and caused an IP block. These involve Incorrect authentication or Unable to authenticate responses.

Attached is a text file with a snippet of entries from our log file.

Jonathon - should (or is there a way...

Can this be made possible wiithout giving them complete access? This would be a great feature as I have some resellers who have been asking for this quite some time yet II have not been able to come up with anything for them. Any ideas?

I'm just wondering if I can get a 'vmstat 1 10' or such with a high load alert, because on most of the systems I administrate the vmstat commands first line of output is a cache.

illustrated..:

# date && vmstat 1 1
Fri Jun 26 11:51:56 NZST 2009
procs -----------memory---------- ---swap-- -----io---- --system-- ----cpu----
r b swpd free buff cache si so bi bo in cs us sy id wa
0 0 398580...

Hi there,

I really love the relay alert notifications, and it has been invaluable for catching spammers in the past, but how about adding the ability to prevent notifications/alerts from a particular user account? Note that I don't want to ignore all events from that user, just the relay alerts.

As an example, some users have legitimate needs to send large amounts of e-mail, and we're flooded...

I have always noticed when I set my email to get all lfd alerts and dont filter any to spam that it constantly fires on spamd child.

I have tried adding this to process ignore:
exe:/usr/bin/spamd
cmd:spamd

To no avail.

At the time of this post, I just added:

pcmd:/usr/bin/spamd*

So I will see if it fires on that. Spamd is pretty common thing so I think it should be added to the default...

I'll see if this can be done.

Hi - I think a neat feature that could be added to CSF while it's scanning log files would be a User-Defined String Alerts that could be emailed to the Admin...

For example: if I entered the string philidelphia or badhost.com CSF would alert me anytime CSF encounters the word in the Logs... :)

AND, THANK YOU FOR CSF!!! :D

Please consider adjusting the proftpd regex to account for the proftpd.conf option:
UseReverseDNS on

which will use domain names in the log, i.e.:

Jun 21 19:40:47 slate proftpd : slate.XXX.net (XYZ.XXX.net ) - USER dsfsdfsd: no such user found from XYZ.XXX.net to 5.6.7.8:21

Thanks.

Rob

We have a few servers that should only get local traffic. CC_ALLOW states that entering countries in the CC_ALLOW field opens all ports to all clients from that country.

That's not what we want to do, instead we only want to permit US & CA clients to access these servers, but we want other restrictions and safeguards to remain in place.

Is there a was to do this in ConfigServer?