CF has a 403 / 404 block can we consider a 401 block as well please.
too many 401 attempts is a sign of server attack

see

Hello,

In the csf.blocklists file, there's an entry:

OPENBL|86400|0|

I believe this entry should be considered for removal. The base_30days.txt file no longer exists, and by visiting and searching the internet (ie, openbl.org's twitter page), it appears the company has gone under, for financial reasons.

When the openbl.org blocklist is enabled, in the /var/log/lfd.log file, every 30...

Greetings, CSF Team.

In its current form, CSF (when configured to also block outgoing connections) will add IP blocks as a DROP rule for outgoing conncetions. Outgoing connections should never be dropped. This can lead to a myriad of issues in the right environment, and at least a few issues in most environments.

A DROP rule in iptables does not send an error/rejection packet back to the...

Hello.

We suggest to add to the csf.blacklist.

Thank you!

How about a feature to permanently block IP by putting them in something like csf.pdeny
Right now if the deny_ip_limit is set at 100 and then if all the 100 IPs are filled up and CSF starts removing from the oldest IP blocked order the ones at the top get removed. But there are certain IPs which I would like to keep permanently blocked even if the limit has been reached and csf removes the...

Here is the snippet from /var/log/secure

Sep 16 10:57:47 s3 proftpd : 10.10.10.10 (119.18.153.66 ) - USER admin (Login failed): Incorrect password
Sep 16 10:57:54 s3 proftpd : 10.10.10.10 (119.18.153.66 ) - USER admin (Login failed): Incorrect password
Sep 16 10:57:58 s3 proftpd : 10.10.10.10 (119.18.153.66 ) - USER admin (Login failed): Incorrect password
Sep 16 10:58:01 s3 proftpd :...

Create a temporary ignore list just as temporary block/allow.

Allow could set the server wide open, but in an ideal situation, we just want a temporary ignore, so an IP of an developer is not blocked for x days, but have the other restrictions in place.

Now we need to specify the ports for a developer and create an temp allow. (or make an option as template you can select for an temporary...

Hello,

each time a new/changed blocklist has to be edited, it's needed to do it on all cluster members.
Any plan to have the cluster master in charge of download all blocklist and to distribute them (as single unduped file) to all cluster members? It would greatly speed up the cluster blocklist update.

Best
Luca

For IP alerts blocked by failed access attempts, it would be nice to be able to indicate that it only alerts when the country of the blocked IP is of interest. For example, in my case I expect to receive alert when a Chile IP (CL) is blocked, but not when blocking IP from China, Thailand, India, etc.

(I take this opportunity to thank you for the development of this firewall. I use it on all my...

Hello,
The 99% of my distributed smtpauth attack alerts are for 535 Incorrect authentication . It would be nice if the alert is sent only when successful access to the email account is detected.

Always after patching Dovecot CSF gives:

Cipher list []. Due to weaknesses in the SSLv2 cipher you should /etc/dovecot.conf and set ssl_cipher_list to explicitly exclude it. For example:
ssl_cipher_list = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP

This ssl_cipher_list parameter is set in /usr/local/directadmin/custombuild/custom/dovecot/conf/ssl.conf
And via build dovecot finally...

Please add option Bad Bot and User-Agent Blocker, Spam Referrer Blocker, Anti DDOS, Bad IP Blocker.

Create a field in CSF UI where you can input custom ip rules.
Ideal would be to click some options as connection limit, rate limit, inbound, outbound, ports, etc.

I came to this idea after searching for a way to limit 1 ip address which is hammering my server. But I don't want to block this IP nor do I want to limit all ip addresses in general.

Hello,

Watch system logs feature is very useful, though i am missing option to filter out the output displayed.

Example there is text field where i can add operators to exclude log entries containing certain phrases and showing only ones that contains my phrase.

-excludephrassehere -excludephrasse2 +onlyshowthis

As a suggestion, mention WordPress in the description of:
Check Server Security > PHP Check > Check php for ini_set disabled

The description currently says:
You should consider adding ini_set to the disable_functions in the PHP configuration as this setting allows PHP scripts to override global security and performance settings for PHP scripts. Adding ini_set can break PHP scripts and...

Right now, it looks like the CC_IGNORE check in lfd sets the cconly parameter on its iplookup call, which only returns and checks the country code, not the full iplookup result. This is obviously a good idea so there aren't any false matches with reverse DNS or the like, but also excludes listing ASNs in CC_IGNORE. It seems like it should be safe enough to return CC and ASN in an OR regex when...

I swear some of CSF is based on the Postfix log scanning real-time firewall scripts I've been running for years. Posted them in a Postfix forum years ago when I first developed them (2010). Of course CSF is a much broader scope than just preventing bots from spamming and flooding the Postfix logs with useless failed connections of miss-configured systems.

But enough of my ego. The real purpose...

It would be nice if we could white list countries so that they don't get blocked by the failed logins, most of the times our customers setup Outlook or similar clients and after an email password changed IMAP / SMTP blocks them.

Since most of the time hackers use compromised servers or anonymous proxies on USA, China, Germany... it should be easy if we could avoid LFD to act on IPs based on...

Hello,

At this moment you can turn off the firewall (LFD/CSF) in DirectAdmin. LFD and CSF stopping then. But you may then no turn on the firewall. The message is:

Due to restrictions in DirectAdmin you must login to the root shell to enable csf using:
csf -e

We have customers with a private server that can login with 'admin'. They can disable the firewall. That's not very useful :) you...

I'm fairly aggressive on my login failures, which get users (Mostly spammers and hackers) put on the permanent and temp blocklists. Because of this, I get hundreds of notifications a day, which truly gets OLD sifting through or even just selecting and deleting them. As an example, I woke up to nearly 100 emails just for permanent blocks this morning + all the other emails and legit sales emails....