ConfigServer Community Forum

Hi,

On FTP login failures or any of the services really, is it possible to block the IP connecting to the FTP ports instead of blocking the IP address from accessing anything on the server after x (as configured) unsuccessful login attempts?

Something in the line of;

iptables -I INPUT -m tcp -p tcp --dport 21 -s 111.222.333.444 -j DROP

instead of

iptables -I INPUT -s 111.222.333.444 -j DROP...

Hi folks,
CSF is simply the most useful application available for cpanel. That said, the ConfigServer Security&Firewall could be extended to end World Hunger, Purify water and end Hacker Crime.

Well, at least one of the three -- Here's my concept:

Using ConfigServer Security&Firewall, set up a central hacker IP activity database.

Include an option in CSF to allow for daily sending of the...

Well.

Many times, customers are very big heads, and blocked again and again.

At the end acabn put a support ticket or in some cases a call like What happens! Server does not work ...

I'm not good with scripts (something in bash) but a little.

In cpanel the email address this in the file / var / cpanel / users / in contactemail.

It would be nice to configure CFS to wish you that if you...

i would like to see this option:
Generate and email this report if score is below: and a dropdown of scores like:
116,117,118, etc.

i think this is more useful/convenient than receiving an email every night and scrolling down to its bottom to see the score... i find it pretty annoying sometimes.

Since bots and zombie computer are getting harder for the average bot kiddy to come by now a days they are resorting to GET attacks on dynamic sites with the inetention to exhaust resources which in most cases it does no matter if you have network ddos protection, connection tracking, etc. The requests are legit requests for like index.php or GET / over and over but it does it slow enough and...

Since upgrading a cPanel account to 11.24 and switching from Courier to Dovecot, I'm noticing a variety of entries in /var/log/exim_mainlog that in the past I think would have triggered LFD and caused an IP block. These involve Incorrect authentication or Unable to authenticate responses.

Attached is a text file with a snippet of entries from our log file.

Jonathon - should (or is there a way...

Can this be made possible wiithout giving them complete access? This would be a great feature as I have some resellers who have been asking for this quite some time yet II have not been able to come up with anything for them. Any ideas?

I'm just wondering if I can get a 'vmstat 1 10' or such with a high load alert, because on most of the systems I administrate the vmstat commands first line of output is a cache.

illustrated..:

# date && vmstat 1 1
Fri Jun 26 11:51:56 NZST 2009
procs -----------memory---------- ---swap-- -----io---- --system-- ----cpu----
r b swpd free buff cache si so bi bo in cs us sy id wa
0 0 398580...

Hi there,

I really love the relay alert notifications, and it has been invaluable for catching spammers in the past, but how about adding the ability to prevent notifications/alerts from a particular user account? Note that I don't want to ignore all events from that user, just the relay alerts.

As an example, some users have legitimate needs to send large amounts of e-mail, and we're flooded...

I have always noticed when I set my email to get all lfd alerts and dont filter any to spam that it constantly fires on spamd child.

I have tried adding this to process ignore:
exe:/usr/bin/spamd
cmd:spamd

To no avail.

At the time of this post, I just added:

pcmd:/usr/bin/spamd*

So I will see if it fires on that. Spamd is pretty common thing so I think it should be added to the default...

I'll see if this can be done.

Hi - I think a neat feature that could be added to CSF while it's scanning log files would be a User-Defined String Alerts that could be emailed to the Admin...

For example: if I entered the string philidelphia or badhost.com CSF would alert me anytime CSF encounters the word in the Logs... :)

AND, THANK YOU FOR CSF!!! :D

Please consider adjusting the proftpd regex to account for the proftpd.conf option:
UseReverseDNS on

which will use domain names in the log, i.e.:

Jun 21 19:40:47 slate proftpd : slate.XXX.net (XYZ.XXX.net ) - USER dsfsdfsd: no such user found from XYZ.XXX.net to 5.6.7.8:21

Thanks.

Rob

We have a few servers that should only get local traffic. CC_ALLOW states that entering countries in the CC_ALLOW field opens all ports to all clients from that country.

That's not what we want to do, instead we only want to permit US & CA clients to access these servers, but we want other restrictions and safeguards to remain in place.

Is there a was to do this in ConfigServer?

Hi there,

Just a small note to say that it's great you've added support for dynamic hostnames, thanks! However, would it be possible to have more control over the firewall entries so that they have specific port access? As it stands right now they are given blanket ACCEPT permissions on all ports and protocols which is a little too excessive, imo.

Something like the implementation you have for...

Hello, would it be possible to have support to csf. Thanks for this great piece of software!

Hello,

is there a way to insert custom filenames in LF_DIRWATCH ?
I have the following below and they`re gone by the time the notify email arrives.

/home/user/public_html/Admin/dse84abzw1abzw1abzw1abzw1abzw1abzw1abzw1abzw1abzw1ab (deleted)
/tmp/ZCUDF2ePoS (deleted)

regards,
Cosmin

Recently, a spammer guessed the email password of one of our users (he guessed it in 5 tries!) and then proceeded to use SMTP AUTH to send thousands of spams through my server.

I looked through my e-mail alerts, and did not find any alerts about this high volume of relayed mail. I only found out about the problem due to receiving an alert about the high queue size.

In CSF, I have the...

is this possible?
to access it through WHM also, but it should have limited options:
- Quick Allow
- Quick Deny
- Remove Deny

for when you're on the move and need to unblock someone's IP.

something you can access like domain.com:2087/cgi/mobile_addon_csf.cgi

would anyone use such a sript?

Later Edit:
or what files should I edit/copy and where, in order to get a minimal CSF UI when accessing...

hi,
In the Check Server Security, is there a way to get a weighted score rather that a simple addition of secured areas?

If not, I'd like to see WHICH are most important than others. Is there an ordered list anywhere?

thanks! :)