Hi all,
this thread is to add working REGEX that we can share with the community. To add them to this sticky, you should have the regex working in your server, this thread is not intended to solve any issues related with no working regex, the intention is to give users of CSF REGEXs that could make CSF with more security options.
If you want to collaborate, please add your rule to this thread...
If you have one particular IP address that is either dropped or accepted through the firewall that you think should not be, then you can use the new WATCH_MODE in csf.
Before enabling this option and using the CLI command to watch an IP address, check whether it is explicitly listed first using:
csf --grep 11.22.33.44
Where 11.22.33.44 is the IP address you're tracking. If that comes back...
If you get iptables errors when trying to start csf on a VPS then you most likely have missing iptables modules for your VPS.
If your hosting provider wants to know how to configure iptables correctly on a VPS server, then you should point them to this Parallels FAQ and have them follow it (plus to add ip_conntrack_ftp to the list of required modules):
I just installed CSF on an Asterisk box.
Is there any setup I could use in order to block IP addresses that failed to login on SIP / port 5060 with the help of CSF ?
I'm running Postfix on a generic Centos 8 server and I'm trying to lock it down with CSF. I've done a fresh install, reviewed the conf, set testing = 0 and restarted the service.
The postfix maillog (/var/log/maillog) is showing a lot of SASL authentication failures like this:
May 5 09:21:38 myserver postfix/smtps/smtpd : connect from unknown
May 5 09:21:39 myserver...
I got all of the settings double checked to setup the CSF Cluster, I have all nodes sharing both send and receive and the firewalls are open on each, so when I cping test it comes back with pong, so communications is happening.
My test was to add an ip on a deny list and then check if that IP is on the deny list on all the servers in the cluster.
I added a comment as well, so I was...
I tried first installing CSF from the guideline provided on your website: but this created a huge problem for us. Our server was filled up with 60k+ processes like this:
I have the LF_PERMBLOCK_ALERT set to OFF and have saved and reloaded CSF. Still, even after turning it off I am getting dozens of PERMBLOCK alerts in my inbox every day like the one pasted below. Am I missing some other setting that I have to change to stop CSF from sending me all of these?
I was wondering if it would be possible to send lfd notifications like: login notification, suspicious process,... to an REST API endpoint/server, instead of sending them by email? In case of an email system failure, emails are not sent, but sending them to another (monitoring) system over eg. Https (to an API) would be a good alternative.
There seems to be an option to execute a script,...
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum