How can I block this kind of exim spam attck?

[pepsi]

To know if the rule is good, I need at least 2 log lines to check the rule.

But as far as I have checked with what you gave, that rule is not good. It takes a lot of time to check, I will never use this rule in my servers.
You have to remember that the server will be checking hundred of log lines in a few minutes and then your rules should be less than 1 or 2 milliseconds to run.

Your rule takes 1,060 steps that uses 5ms to run.

On my servers I have a rule just for ModSecurity that runs faster 712 steps and 1ms:

Code: Select all

^\[\S+\s+\S+\s+\S+\s+\S+\.\d+\s+\S+\] \[:error\] \[pid \d+.*\] \[client \S+\] \[client (\S+)\] ModSecurity.*\[id "(77704)"\]

on the ID you can OR different rules like this:

Code: Select all

^\[\S+\s+\S+\s+\S+\s+\S+\.\d+\s+\S+\] \[:error\] \[pid \d+.*\] \[client \S+\] \[client (\S+)\] ModSecurity.*\[id "(77704|999999|1010101)"\]

May I ask you one more additional question?

Code: Select all

 return ("Multi 406 Error",$1,"HTACCESS406","2","80,443","604800");

in this rule, normaly it will ban for 604800sec = 7 days, but I find csf add that IP in to csf.deny, so is that mean something wrong?
or this is normal, csf will delete that ip after 7 days?

Thank you

[Sergio]

Kind of old, but will answer your question:
viewtopic.php?t=676

[pepsi]

Kind of old, but will answer your question:
viewtopic.php?t=676

Thank you so much, so that mean my rule added to csf.deny and not csf.tempban is not normal...

[Sergio]

For me, as it is a temporary block, it is not saved in any file.
I think that the IP is just added directly to the server iptables, that makes a lot of sense.

[pepsi]

For me, as it is a temporary block, it is not saved in any file.
I think that the IP is just added directly to the server iptables, that makes a lot of sense.
So, in CSF you can use the "Temporary IP Entries" to see if there are any and it will show you the IP.

Thanks, I was confirm my rules all go to csf.deny and not in "Temporary IP Entries" page.
I think I need to check my csf configuration

Can you tell me in your csf's configuration LF_CXS_PERM value?
I was set to 1, I think this is the reason

Thank you so much

[Sergio]

* ERRATA:
You will only see in "Temporary IP Entries" the ones that you saved in there.
The ones that are created automatically by CSF rules will not be shown in there, sorry my mistake on that statement.

[pepsi]

* ERRATA:
You will only see in "Temporary IP Entries" the ones that you saved in there.
The ones that are created automatically by CSF rules will not be shown in there, sorry my mistake on that statement.

Thank you, then I can rest assured

[Sergio]

You can do a test of the rule and your log line in regex101.com