ConfigServer Community Forum

OpenVZ kernels now have the module ipt_owner virtualized so using the SMTP_BLOCK should be possible for VPSes.

I did use a vps to connect to SMTP server of a shared hosting I have and sent mail successfully by cleancode.org email tool, after this I issued:

iptables -I OUTPUT -p tcp --dport 25 -m owner --uid-owner root -j REJECT

and the same command of the last test brought:

email: FATAL:...

Any new instructions for vps new account with lxadmin would be greatly appreciated.

Hello,
Seems the csf is adding/blocking only port 25 and we have port 26 too which is causing the abuser to continiue sending:

Time: Fri Nov 21 18:34:32 2008 -0500
Type: AUTHRELAY, Remote IP - 66.201.176.126 (US/United States/-)
Count: 101 emails relayed
Blocked: Yes

Sample of the first 10 emails:

2008-11-21 18:28:22 1L3fQ3-0002O5-GH <= user@domain.com H=(66.201.177.132) P=esmtpa...

Would it be possible to add disable blocking yahoo crawler like the google one was added please

I keep getting these :

Time: Sat Dec 13 06:02:41 2008 +0000
IP: 72.30.142.91 (US/United States/llf531125.crawl.yahoo.net)
Hits: 1
Blocked: temporarily for 3600 seconds

Sample of block hits:
Dec 13 06:02:36 ns1 kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT=...

hi .
i`m have server linux and use Csf firewall . but my are problem . distance, that install & config . coustomer and me can not connect too ftp server . if disable csf . can connect too ftp . mind problem is configtion that is csf. what are doing ? who connect too ftp server is time enable csf ????

Hi,

Is it possible to show the release dates in the changelog located @ ?

If you've set the automatic upgrade feature it's not always clear to what version the script was updated. It's maybe an idea to add a few lines to the upgrade log e-mail so you know, e.g. :

installed version : 4.26
updating to version : 4.28

Cheers.

I would like to see the ability to control how long logs are kept for LFD in /var/log/lfd_log and /var/log/lfd_log.*.gz . Currently it appears that LFD will only use 1 archived log file (lfd_log.1.gz) and this does not store enough log data for my purposes. I would love to be able to configure CSF to use multiple archived files or to be able to specify the number of days (or maybe weeks) that log...

Any chance to give a solution for this problem with exim logs? Spammers can do their job when this is happening. I'm using the LF_SCRIPT_ feature.

Id love to see a built in applet that would make it easy for us newbies to select and block regions of the world by IP range

My servers serve mostly a US based auto enthusiast audience.

While CSF does a nice job of of blocking repeated attacks, after getting repeated attacks from China, Tiawan and some of the stans it would be easier to simply block them entirely.

I used to use an applet...

as the function of csf.allow is to let traffic be sent to or come from a whitelisted IP, it should be able to bypass the UID/GID limit for port 25,

For example in a case we had to use a remote smtp of an off server bought mail account for the whmcs script, the off server mail account is used for redundancy, we were however unable to let anyone other than cpanel, mailman, root, mail, ... use the...

It would be fantastic if you could find the time to tweak csf/lfd to be cPanel DNS ONLY compatible?

I'd be more than happy to set up a cPanel DNS ONLY VPS for you to test on. It mostly seems to work, but throws a few errors on restarting, like Couldn't load target `acctboth' , Could not create /etc/cron.d/csf_update and exec of /usr/local/bandmin/bandminstart failed - seemingly not too...

In settings, TCP_OUT
port 2087 is missed in default configuration so cPanel feature WebDisk won't work.

Need to add:
exe:/var/cpanel/3rdparty/bin/php

cPanel moved where they have the internal PHP now :)

Would it be possible to do either of the following:

1. Log all csf/lfd blocks and removes to a database of some nature, to enable this to be queried for use elsewhere by non-privelidged accounts

or 2. Add some form of hook script to be run after an IP is blocked or removed from the blocklist (much like cpanels postupcp method)

My reason for asking is I am trying to create some form of...

Hi:

May I suggest further documentation on the different debug levels? On that regard, the verbose level could be configured manually (ie. list of all possible items/categories of alerts with 0/1 option). This could help sysadmin to track/monitor/manage some issues more closely.

see this post for further reference:

What do you think?

Cheers!

S.

First I'd like to thank Chirpy and crew for all the great work they've done for us hosts. I've paid for their services, and have recommended it to my friends because of how professional they are, and of course how great their product is. Thanks :-)

Now onto my suggestion for csf...

It would be really nice to be able to use bluetack formated ip blocklists in CSF. From my understanding this...

Hi,
It is possible to change CSF in such a way that users from banned IP can see info page?
I mean lastly I had few clients complaining about server non working, but it turn out they IP was blocked because of their fault (wrong cpanel/ftp/pop3 password) :rolleyes: .
In this case customers are pointless and dont know what to do. I would like to give them some option/ info about it.

Its possible?...

On the Messenger protion I know we can edit the messenger files. I was wonder if there was a way to dynamically put text into the messenger to say why it was bloked.

For example in the csf.deny we put

196.168.0.0/10 #Trying to inject hacking scripts

Could messenger pull the text past the # and in the code we could have something like:

Our firewall blocked your IP because etc...

And possibly...

I would like to get opinions and ideas about automatically sending an email to the network abuse (or other) email address of the owner of every IP number that attempts to hack into my system. I get a lot of SSH login failures, a fair number of rejected TCP SYN messages, and some port scanning activity. The hacking activity comes from all over the world. After looking up the network information on...

Is there possibility to block domain name not IP like in csf.deny, or add string if this string will be in domain, the domain will be blocked like:

example: *rapidshare*

If it's possible by iptables maybe it's good to add like new option?