One easy question about block_ip.sh

[glio]

I am Setting up a new server with Directadmin

Hi, Everyone I would like to know block_ip.sh(Brute Force Monitor) in Directadmin

It is only protect directadmin or all services in Directadmin?

Thank you so much

 

[glio]

could anyone just tell me? please

 

[Arieh]

http://help.directadmin.com/item.php?id=380 it's just a script you can use at own risk.

Personally I use it with CSF:

/usr/local/directadmin/scripts/custom/brute_force_notice_ip.sh

#!/bin/sh
/etc/csf/csf.pl -td $value 24h BFM IP Block
exit $?;

 

[glio]

http://help.directadmin.com/item.php?id=380 it's just a script you can use at own risk.

Personally I use it with CSF:

/usr/local/directadmin/scripts/custom/brute_force_notice_ip.sh

#!/bin/sh
/etc/csf/csf.pl -td $value 24h BFM IP Block
exit $?;

Thank you, but if I using script without csf, It just protect directadmin and directadmin with other sevices in drectamdin ?)

 

[Greenhost]

This script just work on csf. You can't use without csf. And if you use it, it will protect all directadmin and services.

 

[glio]

This script just work on csf. You can't use without csf. And if you use it, it will protect all directadmin and services.

thank you so much.

I just follow that to do:
http://forum.directadmin.com/showthread.php?t=44839

and block a ip from da thought csf, but i still see that ip's logs from BRUTE FORCE MONITOR
how can i confirm that ip is blocked or not? many thanks

 

[zEitEr]

Hello,

Run this in shell as root

iptables-save | grep DROP

and compare the IPs with the list of those in Directadmin on BFM page.

 

[Arieh]

In CSF you can also search for an IP address, it will look through iptables.

Also after it's blocked with CSF, DA might still send a notification I experienced.

 

[glio]

In CSF you can also search for an IP address, it will look through iptables.

Also after it's blocked with CSF, DA might still send a notification I experienced.

thank you zEitEr & Arieh
Thank mean the firewall is working but DA will still log that action. right?
one more think: I was enable csf and than BFM page's "IP Info" can't view any information, I think it just block by csf, how can i enable it again?
many thanks

 

[zEitEr]

You might want to check this http://forum.directadmin.com/showthread.php?t=44839