ConfigServer Community Forum

As this forum is not for Mod_Security, I will send you a PM with the details.

Sergio

If you are using the payed rules, you have to be aware that some rules only work with ASL HARDENING, and the set of 70_asl_csrf_experimental.conf is one of them and is not needed with CSF, you can delete that set of rules. You can contact ASL support and they will confirm this.

Sergio

You can do this easily with mod_security, so, when someone writes anything that you don't like as a part of the URL mod_security can block the IP, then the IP will be block by CSF.

Sergio

add the process to csf.pignore

Sergio

I will suggest the other one:
http://configserver.com/cp/mailscanner.html
It is payed but, believe me, it is worth it.

Sergio

@screege,
then, DSHIELD is working on your firewall as well as SPAMDROP and SPAMEDROP.

Enter into ConfigServer Security&Firewall then to VIEW IPTABLE RULES then search for DSHIELD, that will show the iptable rules for dshield.

On the other hand, search in your /etc/csf if there is not the old configuration file.

Commenting the lines out mean enable them.

Check that DSHIELD line is as follows:
DSHIELD|86400|0|http://feeds.dshield.org/block.txt

That is what is working for me.

Have you turned the lists on, at the LFD BLOCKLIST button?

This is very common, that IP is trying to get access to the account, some times hackers are just fishing, they don't know if the account or user exist. You can safely block any IP that is doing this on your server.

Sergio