ConfigServer Community Forum

SPAMHAUS: Unable to retrieve spamhaus block list - Unable to download: Can't connect to www.spamhaus.org:80 (Connection timed out)

Is anyone able to reach Spamhaus? I noticed these entries in the hourly LFD reports. I'm not able to access the site even off server.

Is there a way (and if not, can it be added), to monitor the /var/log/messages file for denied/REFUSED dns queries
and block the IP addresses that hit a specific site more than so many times..?

Example:

Mar 14 11:09:47 HOSTNAME named : client 97.107.20.11#19420: query (cache) 'domainname.com/MX/IN' denied
Mar 14 11:09:47 HOSTNAME named : client 97.107.20.11#37657: query (cache)...

I use Pingdom to monitor my servers uptime across the globe. On occasion I see an IP from one of their locations get's banned for scanning the server. Normally one would just pop in the IP address that get's blocked in the ignore list and move on, but in this case they have hundreds of IPs across the world that ping the server. How can I automate this so the IPs they use get added to my ignore...

Hi,

I have setup csf on a number of servers with no issue. I have recently setup csf on a VPS and web access works fine along with email and cPanel/WHM access.

When i try to connect to an account via FTP an error message shows up after a few minutes. When i add my IP address to the allow list everything works fine.

I have probably done something wrong during setup but i have spent a few...

Seems that certain WordPress sites on our server are under some type of attack. Even password protecting the /wp-admin directory has no effect in their efforts. Here is a log snippet for just 3 seconds of activity:

74.50.26.15 - - GET /wp-admin/ HTTP/1.1 302 - - Mozilla/5.0 (compatible; bingbot/2.0; +
74.50.26.15 - - GET /wp-admin/ HTTP/1.1 302 - - Mozilla/5.0 (compatible; bingbot/2.0; +...

CSF report this error :

Can't use string ( _defheader.tmpl ) as a HASH ref while strict refs in use at /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/Template/Context.pm line 809.

i use linux centos 5.x + whm last version

what is the problem? how to solve it?

I am getting attacks via FTP but CFS doesn't seem to be blocking them or adding them to firewall block and I have to do it manually, when I see the hourly reports

they only seem to try 1 account at a time and ONLY 1 attempt at that account , but the same IP number tries numerous different accounts. I can't see any way in CFS settings to block IPs that attempt to log in to different accounts,...

Hi

I have been using CSF for several years on this server, but just today I an getting a lot of LFD failed errors, and this:
Software error:

Can't locate Net/LibIDN.pm in @INC (@INC contains: /usr/local/cpanel /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi...

Hi Guys, (and girls)

I am having this message emailed to me:
Suspicious process running under user sshd
/usr/sbin/sshd (deleted)

Command Line (often faked in exploits):

sshd: root

it also has a TCP connection to some ip address.

I am a bit concerned what this is or how to go about troubleshooting it further.
if i do netstat i can see some ssh connections saying established from unknown ip...

Hi i have a dedicated server CentOS 5,9 with WHM 11.36.0.11 and in the last update CSF v6.00 at 2 weeks agoo become a problem to me.

This server only have one site vbulletin forum , and after this upgrade my users say the site is extrem slow.

After a quick tests with a browser cleaned with no cache i can duplicate the problem, and the page sometimes takes 20 secounds to open and other times...

For the last 24 hours I have been getting pummeled from 1000's of ips all targeting the same uri attempting a sql injection exploit. I have atomic mod_ security rules in place which are working fine and successfully blocking all the attempts. Of course I want these ips blocked, but obviously useless. I have CSF installed and as a result of the number of max ips allowed in iptables, my table is...

Hi Everyone,

First of all thanks a lot for this wonderful product.

I am having issue on a server where I have memcached running for a VBulletin forum. I have put an entry for memcached process in csf.pignore file but I think it has nothing to do with the alerts I am getting relating to memcahced TCP connections

Executable:
/usr/bin/php

Command Line (often faked in exploits):
/usr/bin/php...

Hmmm

How do i add a photo ?

The log shows the standard logs and then some of the characters sown a ? in a black diamond

Like a char set problem ?

Hi

I am having a hard time figuring out what ports are being scanned. The below block is in fact from a hosting client and the temp blocks stop him from downloading mail.

Can someone please let me know what blocks are being scanned below so I can help the client to resolve this.

Thanks :)

Time: Thu Mar 7 04:20:06 2013 +0200
IP: 41.132.199.40 (ZA/South Africa/41-132-199-40.dsl.xxxx)
Hits: 11...

I think that csf/lfd should have stopped this brute force attempt at root access ... but it did not.

Today at 10:04:19, perpetrator at 59.108.92.24 started attempting ssh root logins. Log lines from /var/log/secure read:

Mar 7 10:04:19 osprey sshd : pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.108.92.25 user=root
Mar 7 10:04:21 osprey sshd :...

I would like to prevent DNS attacks by limiting number of connections to DNS servers:

IPTABLES -I INPUT -p udp --dport 53 -m recent --set --name DNSQF --rsource
IPTABLES -I INPUT -p udp --dport 53 -m recent --update --seconds 1 --hitcount 9 --name DNSQF --rsource -j DROP
IPTABLES -I INPUT -p udp --dport 53 -m recent --set --name DNSHF --rsource
IPTABLES -I INPUT -p udp --dport 53 -m recent...

Hi there,

I have just recently set up a linode VPS with cpanel and I installed CSF.

Ever since I installed it I am getting emails once every hour or so and its really annoying me.

Here are some of the alerts I have been getting:

Time: Wed Dec 19 04:19:22 2012 +0000
IP: 68.171.218.104 (US/United States/removeduetoforumrestriction)
Failures: 5 (sshd)
Interval: 300 seconds
Blocked: Permanent...

Hi

thanks for this good how-to

my box is centOS5+Apache2+directadmin

I did a manual install , no errors overall and start CSF from SSH

However, I could not see a CSF link on DA interface

I saw some people said manual install fixed, but not working here

how to fix this please?

thanks

I have a sugarcrm installation which uses the server tmp dir for a file.

/tmp/I16t0H/manifest.php

The sub dir changes, but the filename stays the same. I place a rule in signore:

/tmp/.*\.tpl\.php

But this does not work. Maybe the syntax is wrong?

Is there anything I need to change/modify in CSF when changing SSH from port 22 to another port (ex. 55000)?