I have setup a new dedicated server with Debian 7.2 stable ( Wheezy ) and installed apache, Webmin and CSF with the webmin modules.
During testing, I'm getting expected results. SSH access is fine. and when I disable testing mode on every thing is fine
but when I reboot the server I'm locked out, I have to use the server rescue mode to revert back into testing mode.
I'm looking for a way to block FTP access from every country but mine, the Netherlands. Also in some cases I should be a able to whitelist a country per account. Is this possible using CSF?
I have a developer working on a project on my server. He only connected to port 22 and 80 and it would block him. I have also seen this happen to http traffic. I have turned it off for now, as it blocks legitimate traffic. Is this normal?
Block:
Temporary Blocks: IP:112.110.51.230 Port: Dir:in TTL:3600 (lfd - *Port Scan* detected from 112.110.51.230 (IN/India/-). 11 hits in the last 285...
I am very thankful to this message board for some great information. I am running CSF v6.39 on a Centos 5.1 server using WHM 11.4.31 web interface. This is a quad dual xeon server w/32GB ram.
I am successfully using CC_DENY to block several countries. I have been able to add up to about 15,000 IP blocks in a few minutes, however, adding any more country codes seems to cause the...
Hi, my name is Maxi and I'm new to this product. Ever since I've installed and configured csf I've been receiving several spamd notifications a day, with subjects like:
lfd on xxxxxx: Excessive resource usage: xxxx (1557 (Parent PID:193))
almost always followed by:
lfd on xxxxxx: Suspicious process running under user xxx
My csf.pignore file includes the following line
cmd:spamd child
we use CSF on most if not all of our servers on the internet, except when behind hardware firewalls
what i'd love to do is also setup csf/lfd on these devices as well, not for the firewall port blocking/acl as we manage this at the hardware firewall level, but for all the brute force blocking goodness
is it possible to configure CSF in such a way that it only blocks IP's when...
Hi
Trying to use the CT_LIMIT to block 2 different type of floods:
1) a simple DOS attack towards a client where someone keeps flooding them with calls to different images and pages in order to consume their bandwidth
This block has worked fine for quite some time and it blocks the way it should.
2) simple brutes on wp-login.php from one IP each time (they change IP, but do loads of attempts on...
I've set the following parameters:
LF_APACHE_403 = 60
LF_APACHE_403_PERM = 3600
LF_INTERVAL = 300.
The reason I needed to turn that on is because I'm being bombarded by attempts to access a blocked resource. The file /etc/httpd/logs/error_log is generating about 10 lines per second (about 1 or 2 from the same IP each second) with the following (truncated):
I'm seeing quite a few entries in my logs that look like the below, only changing the username. Looks like someone is trying to guess user/pass combinations. It appears like CSF isn't blocking these failed login attempts, any idea why? Im using the latest CSF version.
Dec 29 13:39:15 server3 authdaemond: Failed to getpwnam for user dell
Dec 29 14:00:16 server3 authdaemond: Failed to...
We are currently undergoing a brute-force attempt by various IP addresses(looks like a botnet to me). CSF has blocked all IPs whenever the no. of authentication failures due to wrong password exceeds 3. However, since recently, we are getting a different type of error, and despite of lots of attempts from the same IP, it is not getting blocked by CSF.
We've got a set up where we handle a number of rules through csfpost. Earlier today we noticed that the rules that are in that file were suddenly removed on one server. Just a minute ago, we noticed the same on another server. When I restart CSF the issues are resolved straight away and the content from csfpost is in the active ruleset.
I'm using CSF on router with 2 external and 1 internal nic
currently csf filtering all traffic to router but packets that FORWARDING to internal network (real addresses) do not filtering
how to do filtering for packets that going to internal network ?
Hello! I think this limit it's very high and will do the work for most of the users. Also, can help identify possible abuses, but what do you think? It's 60/hour enough? What do you have setup in your servers?
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum