ConfigServer Community Forum

Hi all,

those regex's huh ;)

according to several regextesters this should work:

SSHD_LOG = /var/log/auth.log

The regex:
if (($globlogs{SSHD_LOG}{$lgfile}) and ($line =~ /^\S+\s+\d+\s+\S+ \S+ wordpress(\(.*)\).* Authentication failure for (.*) from (.*)/)) {
$ip = $3; $website = $1; $user = $2;
return ( Failed WordPress login from ,$ip, WP-BRUTEFORCE , 5 , 80,443 , 86400 );
}

The...

Hi,

I set the setting to 3 but found out some logs were not writing any more so wnted to do more research on which user needs the rights to write to LOG_AUTH (for example). So based on the docs reverting should be easy:

If you want to revert RESTRICT_SYSLOG to another option and disable this
feature, change the setting of RESTRICT_SYSLOG and then restart lfd and then
syslog/rsyslog and the...

Hello. We have a small server and every weekend or holiday, we see a spike of server intrusion tries. They know that most, mainly small and medium-sized companies probably leave their servers unassisted during those days. By blocking China, we cut tentative intrusions by 60%. But, there are those from Netherlands, France, Germany and other. We want them blocked permanently. No more temporary...

Hi,

You all know what cPanel just announced lately regarding unsane price increases, and reactions are extremely bad :

According to me, and the first reactions of web host community, the preffered choice for another panel is actually DirectAdmin (DA) because it is reliable, founded in 2004, has evolved strongly, inclusive new UI.

Indeed, not only the price is a signal, but the...

I am trying to implement SYNPROXY for the http/https ports with csfpre.sh

iptables -t raw -I PREROUTING -p tcp -m tcp --syn --dport 80 -j CT --notrack
iptables -t raw -I PREROUTING -p tcp -m tcp --syn --dport 443 -j CT --notrack
iptables -t filter -I INPUT -p tcp -m tcp --dport 80 -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -I...

Hi,

Im trying to block ssh login alerts for some of the cpanel users.

I have found this >

but it didnt help.

Did anyone manage to pull this trough maybe?

The latest version of configserver firewall.

This one is driving me a little bonkers. We are all aware of the increase in SSH attacks lately. We run SSH on a non-standard port pretty high up but we are still seeing a MASSIVE influx of distributed SSH blocks on ports not related to our SSH port which is defined in the csf.conf

Ex: invalid user firefart from 67.205.153.16 port 34980 ssh2

This is...

Hello

Currently csf/lfd doesn't detect attacks on wp-login.php

My Settings:

regex.custom.pm

if (($lgfile eq $config{CUSTOM2_LOG}) and ($line =~ /^\S+\s+\d+\s+\S+ \S+ postfix\/\S+\ : warning:.*\ : SASL *? authentication failed/)) {
return ( Failed SASL login from ,$1, mysaslmatch , 3 , 25 , 86400 );
}

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] POST \/wp-login\.php.*...

Hello,

Somebody use fredomedosvsd@gmail.com mail address and all other types like

fr.e.dom.ed.os.v.sd@gmail.com
fr.e.dom.e.do.sv.sd.@gmail.com
f.re.domedosvs.d@gmail.com
fr.edome.dos.v.s.d@gmail.com
f.r.e.d.o.m.edosv.s.d.@gmail.com

......

Tousend of types :( I'm already use LFD Blocklist database but not help :( How can I stop that spammer ? Because they are using some script and attack my...

Hello,

I'm already registered ID from MaxMind. But everytime I get these error from my log

CC: Retrieving MaxMind Country database
CC Error: GeoLite2-Country-Blocks-IPv4.csv empty or missing
CC: Retrieving MaxMind ASN database
CC Error: GeoLite2-ASN-Blocks-IPv4.csv empty or missing

Everytime I put these files manualy but not help.

Any idea for this problem ?

Regards,
Bulent

I have been using IPSET and the MaxMind database to block a handful of countries with CC_DENY. It was working flawlessly, and in January, with the change in MaxMind's licensing, I signed up for a license key and entered it in CSF. I can see that the MaxMind GeoLite database is successfully downloaded and processed in /var/log/lfd.log:

Jan 10 18:00:43 host lfd : CC: Retrieving MaxMind Country...

Hello,

does OSM work on openvz node to track outgoing connections from containers and how can it be configured to monitor spammers on open vz vps nodes.

regards.

hello guys

I have a cpanel server that uses CSF, which blocks IP by noting the country of origin of said IP

by example : (show country of IP)

However, I have a problem with another server, where the IP Country is not shown

view example: (not show country)

How to solve this problem? I would like the country names to be shown as in the first image

Hello,

I'm experiencing a bug using CSF on cpanel CENTOS 7.7 v86.0.18 that is banning cloudflare ips.
I have enabled mod_cloudflare and it's working because I can see the real ip address of requests on Apache Status, but CSF is always banning cloudflare ip.
I also have enabled for the website that is getting flood and ddos attack cloudflare ban ip but I can't see that any ip address was added...

Configserver appears to by in the UK.

We have country code blocking in place using CSF (and have for 18 years...)

When we place in CC_DENY. PL,NL,FR,CN,RU,DE,AN,TR,HK,CH,FI,SE,DK,IE,SG,AU,BG,LV

Even though UK is not listed, updates fail and will never work again unless all removed. Is this a bug? Or are updates coming from a country other than UK?

Hello is it possible to block an IP at CSF level if that IP tries to access a url pattern like anydomain.com/includes/folder/restricted.php

thank you in advance

The UI status shows stopped even when

systemctl status csf show the service as Active

Hi,

Im banning a reasonably amount of IP's adding the blacklist URL's to lfd's blacklist function. for example:

BLOCKLIST_DE_ALL|86400|0|
showing the amount of rows it tells me at this moment it has 33147 rows (of which only 6 ipv6 adresses)

yet an ipset list command is telling me it only has 28650 entries.

this happens with some other lists also. What can i do to import all ip's?

Hi i have many DNS recursive query and i want to ban the IPs doing this, i activate in the firewall the LF_BIND but doesn't ban the IP.
What iam missing?

var/log/messages

Apr 14 12:31:43 server named : client @0x2fb4d40c2340 207.148.30.165#11081 (test.baidu.com): query (cache) 'test.baidu.com/A/IN' denied
Apr 14 12:31:43 server named : client @0x2fb4d40c2340 207.148.30.165#1517 (baidu.com):...

I have a server where CSF has been installed for over 3 years but has suddenly started acting up. I have also had Webmin installed on the server for the same length of time and both have worked together very nicely.

In the last couple of weeks I am having major problems with starting, stopping and restarting the firewall through Webmin and the Webmin dashboard says that the firewall is not...