exim + csf

[stomach]

Blocking in CSF, but still appears in the log.
2024-01-09 14:44:28 TLS error on connection from (DESKPC) [191.193.x.69] (SSL_accept): (TLSv1)
2024-01-09 14:44:28 TLS error on connection from (DESKPC) [191.193.x.69] (SSL_accept): (TLSv1)

 

[Richard G]

You don't need to mask abusing ip's. If abuses don't want their ip visible, they should not abuse systems.
Did you block with csf -d 191.193.x.69?

 

[stomach]

[root@server exim]# csf -d 191.193.xx.69
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 1544.
deny failed: 191.193.x.69 is in the allow file /etc/csf/csf.allow

I uninstalled cpguard!

 

[stomach]

/usr/local/directadmin/custombuild
./build csf

Correct procedure?

 

[stomach]

Adding 187.2.9.189 to csf.deny and iptables DROP...
csf: IPSET adding [187.2.9.189] to set [chain_DENY]

[root@server etc]# csf -d 187.2.9.189
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 1544.
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 1544.
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 1574.
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 1574.
deny failed: 187.2.9.189 is in already in the deny file /etc/csf/csf.deny 1 times

It didn't block, it's in the log

 

[Richard G]

deny failed: 191.193.x.69 is in the allow file /etc/csf/csf.allow

Is that your ip then? Because if it is an attackers ip it should really not be in the csf.allow file.

I don't know cpguard, I don't use that.

Correct procedure?

Almost.

cd /usr/local/directadmin/custombuild
./build set csf yes
./build csf

 

[stomach]

wow !

thank you ninja

 

[stomach]

[root@server custombuild]# ./build csf
Installing CSF...
#=#=- # # #=O=# # # -#O=- # # # ######################################################################################################################################################################################################################################################### 100.0%
mkdir: cannot create directory '/etc/csf': File exists
Using configuration defaults
mkdir: cannot create directory '/var/lib/csf': File exists
mkdir: cannot create directory '/var/lib/csf/backup': File exists
mkdir: cannot create directory '/var/lib/csf/Geo': File exists
mkdir: cannot create directory '/var/lib/csf/ui': File exists
mkdir: cannot create directory '/var/lib/csf/stats': File exists
mkdir: cannot create directory '/var/lib/csf/lock': File exists
mkdir: cannot create directory '/var/lib/csf/webmin': File exists
mkdir: cannot create directory '/var/lib/csf/zone': File exists
mkdir: cannot create directory '/usr/local/csf': File exists
mkdir: cannot create directory '/usr/local/csf/bin': File exists
mkdir: cannot create directory '/usr/local/csf/lib': File exists
mkdir: cannot create directory '/usr/local/csf/tpl': File exists
mkdir: cannot create directory 'webmin/csf/images': File exists
mkdir: cannot create directory 'ui/images': File exists
mkdir: cannot create directory 'da/images': File exists
mkdir: cannot create directory 'interworx/images': File exists
cp: cannot stat 'Geo': No such file or directory
chmod: cannot access '/etc/csf/*.cgi': No such file or directory
chmod: cannot access '/etc/csf/*.php': No such file or directory
chmod: cannot access '/etc/csf/*.py': No such file or directory
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 1480.
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 1480.
csf.c:11:1: warning: return type defaults to 'int' [-Wimplicit-int]
main ()
^~~~
csf.c: In function 'main':
csf.c:21:2: warning: implicit declaration of function 'setenv'; did you mean 'setpwent'? [-Wimplicit-function-declaration]
setenv("CSF_RESELLER", "", 1);
^~~~~~
setpwent
Unit /etc/systemd/system/firewalld.service is masked, ignoring.
Restarting CSF...
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 2299.
*Error* File does not exist: [/etc/cpguard/cpgips.txt] at /usr/sbin/csf line 2299.
CSF installation has finished.
[root@server custombuild]#

 

[Active8]

you did uninstall CPGUARD right way?

cd /usr/local/src && rm -f cpguard_uninstall.sh && curl -o cpguard_uninstall.sh -L https://downloads.opsshield.com/cpguard/cpguard_uninstall.sh && bash cpguard_uninstall.sh

 

[stomach]

you did uninstall CPGUARD right way?

yes !

already tried. did not work.

I also tried installing and uninstalling.

 

[stomach]

I have already opened a ticket with their support.