ConfigServer Community Forum

Could it be a good idea to clean the /var/lib/csf/csf.tempip if there is no temp ips ?

Sergio

In our servers we block daily a lot of IPs from brazilian hackers that tries to take down the servers due to DDOS, 372 simultaneous connections will render your server down if they are not blocked and CSF is doing its job blocking the offending IP.

I am interested in know CSF answer.

Sergio

Server Details; OS: Ubuntu 12.04 LTS Virtualmin/Webmin I have a joomla site getting brute force attacks. Joomla brute force attack extensions can limit the login attempts, but the server is still loaded with calls to the blocked login. I'd rather block the IP via CSF. I have an extension using the ...

every time a connection is made to your server, the connection comes with some info that CSF gathers to show you, it could the name of the computer or terminal that connected to your server or in some cases the IP where the connection to your server originated. So, the IP 190.168.2.33 refers to a co...

Is Brazil a valid customer or country that connects to your server?

372 connections from the same IP is not common, why you need so much connections?

The only way for CSF is to block IPs not MAC addresses, in your error the IP to block is where it started the connection: 68.188.72.60 Now, you will have a lot of IPs that are generating that errors, to watch them go to SEARCH SYSTEM LOGS in your CSF and write the phrase: 535 Incorrect authenticatio...

This will block all the CIDR range for the IP 68.18.3.39:
68.18.0.0/14
according to:
https://www.countryipblocks.net/search_ ... 68.18.3.39

but be careful you will be blocking hundred of IPs, it is wise to only block /24 range, in your case 68.18.3.0/24

With Mod_Security the pages that you have to modify are 403.shtml, 404.shtml or 406.shtml depending on the rule triggered.

This is a very common issue, you can't do much with this. Any one can do a port scan on your server, even mail software do that to find the right ports to use like mac, iphone, ipad, thunderbird and outlook just to mention a few. If you have your CSF well configured and only have opened the ports ne...