ConfigServer Community Forum

I see in my logs a small number of failed logins from an IP, which is blocked in CSF at 00:04am xxxx.xxx.xxx.xxx # lfd: (smtpauth) Failed SMTP AUTH login from xxx.xxx.xxx.xx. (AU/Australia/New South Wales/Sydney/xxx.xxx.xxx.xx.static.exetel.com.au): 1 in the last 3600 secs - Mon May 14 00:04:44 2018...

Using Host Access Control in WHM, its possible to restrict Cpanel login to specific IP or range of IP's. However, any unauthorised log in attempts will generate the following warning: "Dropping connection from xxx.xxx.xxx.xxx because of tcp_wrappers at cpsrvd.pl line ####" There are no restrictions ...

I've scoured the custom regex thread and it doesn't matter how many times i read it, it makes absolutely no logical sense to me.
I think writing my own regex is out of the question.

Returning to work today, I see multip[le attempts over a number of days of someone trying to log in to cpanel.

Dropping connection from xxx.xxx.xxx.xxx because of tcp_wrappers at cpsrvd.pl line 3622

Is anyone able to help me write a custom rule which will block the offending IP.

thanks

does anyone know where to change this message please. This is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "PO KCTCN1104863.jar" is on the list of unacceptable attachments for this...

Try clearing out the blocked IP's and stat with a fresh blocklist.
This may help identify google.

Whitelist your IP in CSF. Using host access control (cpanel) allow ssh access to your IP or IP's, then deny SSH to all. Then change the port number to something else. https://forums.cpanel.net/threads/change-ssh-port-via-whm.108197/ In csf, configure ssh logins to something really low like 3 strikes...

After a number of experiments and waiting for these emails to arrive, I may have figured it out.
Just in case anyone else needs this, this is what I came up with.

header FROM_YOURRULENAME ALL =~ /mydomain\.co\.uk@/i
score FROM_YOURRULENAME 0.1

Giving it a very low score for testing purposes.

I'm seeing this error when doing a MailScanner lint test. (mailscanner nor SA)
Is it important and if so, how do I fix it.

ERROR: The "envelope_sender_header" in your spamassassin.conf
ERROR: is not correct, it should match X-cPanel-MailScanner-From