ConfigServer Community Forum

Hello. I am currently under a small DoS attack from one person. Whenever I check the logs I see New connection from x.x.x.x:0000 x 1000. I then block that IP address using csf -d x.x.x.x (of course, x.x.x.x is replace with the real IP). The attack then changes his IP to something else. I thought to enable the PORTFLOOD tool by adding the following:

4932;tcp;7;1

Assuming this means what I...

Hello Chirpy,

I have a special need on alerts. Right now I have set LF_alerts to two mail address. But I need some specifica alerts to another email address keeping these as such.

Is this possible ?

I need alerts such as Relay alerts, suspicious alerts etc to send to another email while All alerts must send to the existing accounts set in csf.conf

Some kind of cc setup in the templates...

Hi,

I can not update anything having to do with access to the Redhat network with CSF running. I have two switch off CSF just to update PHP, etc.

The following command at shell times out after several minutes with CSF running:

time yum list updates

The output eventually reads:

There was an error communicating with RHN.
RHN Satellite or RHN Classic support will be disabled.
Unable to connect...

Hi,

because iptables can be used for limit connection speed,

i want to know if i can also use csf to limit connection speed on my centos/cpanel server ?

it may be 1M/s for each visitor or
certain file is bigger than 10mb,the speed will be limit to 0.5M/s... etc.

thank you

When ever there is a connection problem with one of my servers and I ask for help from the data centre they switch off the csf firewall and say we have fixed it .

Of course I then login and switch it back on.

Is there any kind of monitor I can put on my server to tell me when csf is switched off?

Hello,

I have a dedicated cpanel server at a colo here in Virginia. We have 1 client who has employees who connect to virtual desktops on a Citrix VM. While working on their virtual desktops they cannot see any websites we host; traceroutes show them traffic stopping one hop before our server.

We switched to CSF from APF a few months ago. I have this clients Citrix ip range (an entire /24)...

This topic can be deleted now. Problem fixed.

Hi there -

My servers are setup to only allow ssh by root. These alerts work fine with actual root logins but I've also gotten a couple of alerts with no evidence of an actual ssh/root login -

lfd on server.servername.com​: SSH login alert for user root from 62.212.154​.143 (NL/Nether​lands/www.​digiinfo.n​l)

When I parse /var/log/secure for this IP, there are no log entries. When I parse...

Hello,
I have a specific requirement to adjust csf firewall.

I have script /home/user/script1.php, when comunicate with users api. So communicates with different IP on different ports.

Is there any way to allow a single script? Otherwise, I have to have all outbound connections allowed.

Is there any way to adjust this?

Thanks

I've configured Messenger on a couple of servers without any trouble, but there are a couple of them where I can't make it work, even after following the same steps at the others.

Any advice on how to debug what could be causing this?

Hi,

I have a customer who's IPs are continually being blocked (he appears to have extremely frequently changing dynamic IPs!)

Is there a way I can find out more about what is causing the block? When I go to csf.deny is just says too many temp blocks :(

Thanks!

Can anyone help please?

I have a domain on a VPS that can get a million smtp attacks or bounces per day. To mitigate this I have hosted the problematic domain's MX at a third party host but I still get mail quires on my VPS because the VPS hosts the DNS and a website. I am running Plesk 11. CentOS 5.8.

1. /etc/csf/csftest . pl
Testing ipt_owner/xt_owner...OK

So no issue there…all good to...

Hello,

I'm trying to configure LFD to send me an e-mail only when root logs in via SSH. I have LF_SSH_EMAIL_ALERT=1 and I get e-mails on every login to SSH, which I don't really need, especially since FTP is disabled and I require all users to use SFTP so I don't need an e-mail everytime they FTP in to upload files. So I just want alerts on root login, is there any way for me to configure this?...

This topic can be deleted now. Problem fixed.

Hello, I'm running a OpenVPN-AS server for few friends, and I'm looking for a way to be able to log connections made from users to the world. Each user gets a IP from 10.0.0.0/8 addresss and then is natted out to the internet.

Due to local laws I need to log to where those local IP's are connecting. Can someone help me out? :)

I upgraded from Ubuntu 10.04 to 12.04 and now LFD keeps sending me an email with the subject of SYSLOG Check Failed and a body of this:

Time: Tue Jan 1 22:50:03 2013 +0000
Error: Failed to detect code in SYSLOG_LOG

Any ideas on how to remedy this?

Thanks!
Alan

Dear All,

We have our site hosted at virtual private server.
When we disable the firewall then our site is at risk. But when we enable the configserver firewall then it blocks access to our website from other places. It can only be accessed from ips which are mentioned in firwall allow file.

please help.

thanks

Hello All.

I have a Plesk server and the error and access logs are located in /var/www/vhosts/*/statistics/logs/

Is it possible to just use CUSTOM1_LOG = /var/www/vhosts/*/statistics/logs/error_log or have I to list each and every one of the error log is subsequent CUSTOM2_LOG etc. If so can we have more than 9 customs?

Thanks

Hello, good afternoon all ;)

If possible change time temp ban in csf firewall ?

I did not find anything about it.

Someone can help me and tell me if you can and if you ... how to do?

Thanks for support and assistance.

Best Regards,
Maelstrom

Hello all,

I am seeing many failed entry attempts in my mainlog for exim. Here is a snippet from that log file:

2011-09-18 16:48:22 login authenticator failed for 200-161-109-106.dsl.xxx.xxx.xx (ieikedh dot com) : 535 Incorrect authentication data (set_id=1234)
2011-09-18 16:48:24 login authenticator failed for 200-161-109-106.dsl.xxx.xxx.xx (ieikedh dot com) : 535 Incorrect authentication...