ConfigServer Community Forum

One thing I am noticing on my server is that almost all the blocks for certain administrative services that end up being blocked are outside of the country where those that manage my server are located. SSH, SMTP, POP, FTP, and accessing CPanel URLS for example should never be done except by people who have authority to log in and use those servers, and those people are coming from either known IPs or known countries.

For example, if my server is being maintained for a customer in Mexico, it is not appropriate for any user to be able to connect to an administrative function of the server (even if their credentials are valid) from Italy.

I would love to be able to specify a list of countries for which server access to management functions is permissible, and if an attempt is made to access management functions outside of the list of permitted countries, I'd like to have the IP blocked.

This way, even if the login credentials are valid, the IP would be blocked merely on account of the fact that someone not in a permitted country is trying to access that service.

This would be especially helpful in blocking immediately any ssh, smtp, or ftp logins from hacker-heavy countries such as China and Russia.

What would be even especially cool is if the csf could be aware of whatever web service URL is used for login. It would be cool to be able to immediately block any IP from a non permitted country that tries to access wp-login.php on a wordpress site, for example.

Just a suggestion - I hope it's a cool idea to you too!

Mike

Assume then that you are contributing financially so that CS has the resources to implement the requested additional functionality?

What an odd reply... >.>

I love CSF! I *just* started using it a week ago, and am still configuring it.

I plan to use it for other clients as well ....

I would implement it myself and contribute it if I were a perl expert, but no, I'm more of a PHP guy.

And yes, I plan to contribute and support it because it is offering some very solid, very much needed capability that I haven't found better anywhere else.

But that's all off topic.

I still think it would be awesome to block an IP if any attempt in the logs shows up to authenticate over ssh, smtp, ftp, etc .... if they are not from a predefined set of allowed countries.

Actually I found in the CSF interface a way to disable certain ports except from certain countries, which is a preferred option than blocking them after attempt to access.

And there are other options to prevent repeated logins to Wordpress - Wordfence is a good choice for an application-level protection plugin.

Great job CSF!