ConfigServer Community Forum

Just wanted to give you a heads up in case you haven't seen this yet:

Previously when I last looked at the new databases they didn't support ASN lookups but it looks like they have added GeoLite2 ASN support now (in a separate database):

Hello,
The option for block distributed SMTP Logins is very usefull, but is necessary some advanced option to permit the automatic block of one email account involved in more than X continous distributed smtp logins.

For example, I have configured the distributed smtp logins detection to 3 diferent IP. Recently i recived from my server over 15 continuous mails alerting for distributed smtp...

I know that this has been bounced around in the forums for a while so I thought it should go in the suggestions area. We are seeing more and more servers with docker installed and it would be nice if CSF played nice with it out of the box. Basically all that needs to be done is detect if docker0 interface is present then add rules like the ones below. These are the rules that we normally add to...

Now with the recent added cluster actions the only action that we are missing is cluster ignore . Would it be possible to add? (I'm thinking the reason that it wasn't added was because the login failure daemon would have to be restarted after )

See

Dear ConfigServer team,

We're using CSF + LFD on many servers, with great effect ;)

One thing that could be improved in my opinion, is the detection and blocking of slow brute-force attackers, i.e. logins with long intermittent pauses, but continuing over long periods of time.

We know the effectiveness of detection of burst attacks, when more than LF_ login failures occur within LF_INTERVAL....

Would it be possible to somehow put GeoIP in regex.custom.pm?
Something to filter IP by countries and work differently by countries?

Thank you.

One class of malicious user/uncooperative person is the prober. This is the source of most traffic on my websites, and consists of trying to find weaknesses to exploit.

Typical accesss are to files and directories with names like these:

wp-login.php, wordpress, wp-includes, PMA2017, admin, mysql, db, database, phpmyadmin, program, myadmin...

Why can't csf add an option to look for sequences...

I'm not sure exactly how to call it.
I have the same problem on multiple server, we are giving email services to a company which has 10+ person working in an office . The office connects to the internet via a NATing router, so everybody is seen coming from a single IP.
Now if a single person fails his password a couple time from , that IP will be banned, and everybody will loose access .
So...

The following is a list of features that I think are necessary to improve CSF and LFD integration; most of them are related to CSF blocking IPs:

- CSF should add the same information on manual blocks (csf -d) to the csf.deny files as LFD does (date, geolocation and hostname)

I'm requesting this, since when spammers strike our servers from many IPs a little bit at a time (instead of just a...

Hello,

Currently we are using CSF on our servers and we are testing with the recaptcha ability to unblock the IP address.

Now our customers are possible to unblock their IP it could be handy if they know why they are being blocked.
Is there any way to make this work?

Example, I am blocked and try to visit the server it shows me the message that I am blocked.
There is an option to unblock by...

Right now, the page is served out with status 200, which means that if for example a search engine crawler gets blocked, it will update its index with the blocked page content. I've added the following to the top of index.php in ~csf/public_html/index.php for now: but an .htaccess rule could also be set up to do the same thing.

We have using this useful tools, we found totally helpfull,

we suggest to add a option to maintain a ip blocked even if we flush the all the blocks, like adding a new file called (ex : csf.unignore) any ip in this file will not deleted from the ip_tables and will be permanently in the block unless we remove it from the file,

i hope the suggestion has a meaning for you.

Hello,

A few weeks ago I upgraded my system from Debian Jessie 8 to Debian Stretch 9 but till yesterday I didn't notice this issue. I tried to connect to an external ftp and I connect but it is not possible to list the directory contents, strange because before the upgrade with the same CSF conf I was able to connect to this ftp. I double check CSF conf and the port 21 is in TCP_OUT, SPI...

I want to redirect the blocked page to the new address

Example :

When the user was blocked Go site2.com

First, thanks for all of your incredible software, especially CSF and Mailscanner, which are amazing! Regarding CSF, I have a usability suggestion - have you ever considered moving the Quick buttons to the top of the page in their own section? Quick Allow, Quick Deny, Quick Ignore, and Quick Unblock. It's just not very quick the way it is right now having to scroll down the page to get to them. I...

Starting yesterday, all of our cPanel servers are getting hit with a massive amount of SMTP Authentication failures, from distributed IP addresses. Yesterday alone, we are seeing over 8000 different unique IPs involved in these distributed attacks.

The flood of LFD emails caused us some email issues. I tried to disable SMTP AUTH failure emails, or at least route them to a different email...

Hello there,

Nearly all of my servers that run Exim are constantly being attacked by remote nodes trying to brute through an AUTH command before advertised. Every day I get a big list of AUTH command used when not advertised in logwatch.

On a daily basis I'm blacklisting these remote nodes, because I know for certain they are scanning for open relays. Quite a big giveaway is also the HELO being...

can CSF be updated to use the new Cpanel mod-evasive Apache module

CSF is absolutely fantastic, we use it on many of our servers, but on our cPanel servers in a cpanel DNS cluster we are constantly bombarded by emails about WHM/Cpanel root access alert due to each of the 5 servers in the cluster remotely pulling various DNS data as part of cPanel's built in DNS cluster management. Every time a domain is edited by a customer or by management, every server reports...