Re-installing CSF using Zeiters' script or not?

W

webunity

Verified User
Joined
Sep 23, 2014
Messages
49
I have issues with clients connecting to my websites. I think i might have tracked it down to ipads with safari causing that they are not able to connect to my server;
Does anybody see anything strange in the config below which could cause a 'temporary' ban on IPs (within 5 minutes the site access is restored btw)?

I optionally would like to re-install CSF and Firewall to make sure it is on its' defaults; but i am not sure if i would need to use the script from Zeiter (https://help.poralix.com/articles/how-to-block-ips-with-csf-directadmin-bfm) or the 'install.directadmin.sh' script which is now part of the CSF package..

If i compare the install from 2018 with the current config this is the difference:
SETTING1542219055_pre_v12_08_upgradecurrent
DIRECTADMIN_LOG_R/var/www/html/roundcube/logs/errors/var/www/html/roundcube/logs/errors.log
IGNORE_ALLOW01
IPV601
LF_DIRECTADMIN510
LF_DIRECTADMIN_PERM13600
LF_EMAIL_ALERT10
LF_FTPD1020
LF_FTPD_PERM13600
LF_HTACCESS510
LF_HTACCESS_PERM13600
LF_IMAPD1020
LF_IMAPD_PERM13600
LF_MODSEC525
LF_PERMBLOCK_ALERT10
LF_POP3D1020
LF_POP3D_PERM13600
LF_SMTPAUTH520
LF_SMTPAUTH_PERM13600
LF_SSHD510
LF_SSHD_PERM186400
LT_EMAIL_ALERT10
RESTRICT_SYSLOG03
SYSLOG_CHECK0300
TCP6_IN20,21,22,25,53,80,110,143,443,465,587,993,995,222220,21,22,25,53,80,110,143,443,465,587,993,995,2222,35000:35999
TCP6_OUT20,21,22,25,53,80,110,113,443,587,993,995,222220,21,22,25,53,80,110,113,443,587,993,995,2222,35000:65535
TCP_IN20,21,22,25,53,80,110,143,443,465,587,993,995,222220,21,22,25,53,80,110,143,443,465,587,993,995,3306,2222,35000:35999
TCP_OUT20,21,22,25,53,80,110,113,443,587,993,995,222220,21,22,25,53,80,110,113,443,587,993,995,3306,2222,35000:65535
TESTING10
UDP_IN20,21,5320,21,53,33434:33523
WAITLOCK01

Any thoughts where i might look at?
 
webunity said:
I optionally would like to re-install CSF and Firewall to make sure it is on its' defaults; but i am not sure if i would need to use the script from Zeiter (https://help.poralix.com/articles/how-to-block-ips-with-csf-directadmin-bfm) or the 'install.directadmin.sh' script which is now part of the CSF package..
Click to expand...

Based on the title of your original question, you can use the following script by Poralix (might be part of da script):


When you install directadmin with auto argument, it will install CSF together and I think the auto mode uses the above script to install CSF. CSF installation script is very portable, if it detects your server has directadmin installed it will automatically execute its own install.directadmin.sh. You can inspect csf.tar.gz file that has the following content:



csf_portable.JPG

In brief, when you execute this script http://files.directadmin.com/services/all/csf/csf_install.sh, it also run another script call install.directadmin.sh if your server has directadmin installed and CSF will install in directadmin-way (like automatically add da port 2222 etc..)
 
Last edited:
@Richard G if i can't find my IP in the brute force manager, and all access to my server is sometimes not possible (for about 1-2 minutes) from my IP; where can i look at next? After this time all is resolved but it sucks that i get these intermitted connection problems.
 
There are 3 places to look for an ip which is blocked.
/usr/local/directadmin/data/admin/ip_blacklist
and
/etc/csf/csf.deny
and
/var/lib/csf/csf.tempban

But if it really are connection issues and not blocks I wouldn't know where to look. I would start with looking in apache logfiles.

Also I would make sure to have your ip in both the csf.allow and csf.ignore files (and restart csf and lf afterwards) to prevent blacklist.
Next to that, add your ip in:
/usr/local/directadmin/data/admin/ip_whitelist
and see if that helps.

If your ip will appear in the csf.tempban option, there must be a log entry in /var/log/lfd.log on why that happened normally.
 
webunity said:
@Richard G if i can't find my IP in the brute force manager, and all access to my server is sometimes not possible (for about 1-2 minutes) from my IP; where can i look at next? After this time all is resolved but it sucks that i get these intermitted connection problems.
Click to expand...
IS da Updated to version 1.62.6 while there is / where problems, but check and read changelogs, and take care of backups.

If not solved with that versions try to reach DA support / ticket , if solved please mention this here in your thread, but also mention this in >

DirectAdmin 1.62.6 has been released

Hello, DirectAdmin 1.62.6 has been released. This is a hotfix release to address the "Brotoli BestSpeed" SSL compressor issue. This compressor has been removed for now, and we'll re-add it with the new version once we have time to test it out. To get the update, go to: Admin Level »...
forum.directadmin.com forum.directadmin.com
 
Well turns out it is not (only) my IP but also customers are facing issues as it seems. So it is definately something that is temporarily blocking sites. Therefore i was wondering if there are any other places to look for besides the above pasted config.

Btw, I have updated DirectAdmin to the latest version and will report what i find.
 
You must log in or register to reply here.
Back
Top