Page 2 of 2
Re: How can I block this kind of exim spam attck?
Posted: 31 Oct 2022, 04:44
by pepsi
Sergio wrote: ↑11 Oct 2022, 20:06
To know if the rule is good, I need at least 2 log lines to check the rule.
But as far as I have checked with what you gave, that rule is not good. It takes a lot of time to check, I will never use this rule in my servers.
You have to remember that the server will be checking hundred of log lines in a few minutes and then your rules should be less than 1 or 2 milliseconds to run.
Your rule takes 1,060 steps that uses 5ms to run.
On my servers I have a rule just for ModSecurity that runs faster 712 steps and 1ms:
Code: Select all
^\[\S+\s+\S+\s+\S+\s+\S+\.\d+\s+\S+\] \[:error\] \[pid \d+.*\] \[client \S+\] \[client (\S+)\] ModSecurity.*\[id "(77704)"\]
on the ID you can OR different rules like this:
Code: Select all
^\[\S+\s+\S+\s+\S+\s+\S+\.\d+\s+\S+\] \[:error\] \[pid \d+.*\] \[client \S+\] \[client (\S+)\] ModSecurity.*\[id "(77704|999999|1010101)"\]
May I ask you one more additional question?
Code: Select all
return ("Multi 406 Error",$1,"HTACCESS406","2","80,443","604800");
in this rule, normaly it will ban for 604800sec = 7 days, but I find csf add that IP in to csf.deny, so is that mean something wrong?
or this is normal, csf will delete that ip after 7 days?
Thank you
Re: How can I block this kind of exim spam attck?
Posted: 31 Oct 2022, 05:16
by Sergio
Kind of old, but will answer your question:
viewtopic.php?t=676
Re: How can I block this kind of exim spam attck?
Posted: 31 Oct 2022, 05:48
by pepsi
Thank you so much, so that mean my rule added to csf.deny and not csf.tempban is not normal...
Re: How can I block this kind of exim spam attck?
Posted: 31 Oct 2022, 13:49
by Sergio
For me, as it is a temporary block, it is not saved in any file.
I think that the IP is just added directly to the server iptables, that makes a lot of sense.
Re: How can I block this kind of exim spam attck?
Posted: 31 Oct 2022, 13:55
by pepsi
Sergio wrote: ↑31 Oct 2022, 13:49
For me, as it is a temporary block, it is not saved in any file.
I think that the IP is just added directly to the server iptables, that makes a lot of sense.
So, in CSF you can use the "Temporary IP Entries" to see if there are any and it will show you the IP.
Thanks, I was confirm my rules all go to csf.deny and not in "Temporary IP Entries" page.
I think I need to check my csf configuration
Can you tell me in your csf's configuration LF_CXS_PERM value?
I was set to 1, I think this is the reason
Thank you so much
Re: How can I block this kind of exim spam attck?
Posted: 31 Oct 2022, 14:20
by Sergio
* ERRATA:
You will only see in "Temporary IP Entries" the ones that you saved in there.
The ones that are created automatically by CSF rules will not be shown in there, sorry my mistake on that statement.
Re: How can I block this kind of exim spam attck?
Posted: 31 Oct 2022, 23:17
by pepsi
Sergio wrote: ↑31 Oct 2022, 14:20
* ERRATA:
You will only see in "Temporary IP Entries" the ones that you saved in there.
The ones that are created automatically by CSF rules will not be shown in there, sorry my mistake on that statement.
Thank you, then I can rest assured
Re: How can I block this kind of exim spam attck?
Posted: 14 Dec 2022, 16:57
by Sergio
You can do a test of the rule and your log line in regex101.com