ConfigServer Community Forum

Posted: **29 Dec 2013, 22:24**

We are currently undergoing a brute-force attempt by various IP addresses(looks like a botnet to me). CSF has blocked all IPs whenever the no. of authentication failures due to wrong password exceeds 3. However, since recently, we are getting a different type of error, and despite of lots of attempts from the same IP, it is not getting blocked by CSF.

Code: Select all

Dec 29 15:22:44 ud01 sshd[8459]: Received disconnect from 114.80.246.194: 11: Normal Shutdown, Thank you for playing
Dec 29 15:22:46 ud01 sshd[8465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.80.246.194  user=root

P.S.I have, recently, added a custom lfd rule to regex.custom.pm. Is that causing the problem(of CSF not blocking those IPs)?

Posted: **30 Dec 2013, 17:11**

I just tested the second line that you posted and it is detected by lfd, so do not know where your problem is so long as you are pointing SSHD_LOG to the correct log file in /etc/csf/csf.conf unless it's being ignored in which case see /var/log/lfd.log

Posted: **30 Dec 2013, 20:52**

Checked csf.conf. SSHD_LOG is correct pointed to /var/log/secure. /var/log/lfd.log is completely empty. Is this strange?

EDIT: Just decided to check whether lfd was running. IT WAS NOT. BIG MISTAKE. Turns out that the custom rule had a compilation error and lfd did not restart because of that. Thanks anyway.

ConfigServer Community Forum

CSF not blocking brute-force attempt.

CSF not blocking brute-force attempt.

Re: CSF not blocking brute-force attempt.

Re: CSF not blocking brute-force attempt.