cpHulk & Firewall not blocking IP

[Dan70]

HI, am very frustrated... have a bot scavenging my site, always same IP...I several times input the IP and then it is blocked for a few hours, only to get back on my site shortly after, still blacklisted... seems cpHulk is not working
grrr....
Thx
Dan

 

[Infopro]

Are you adding the IP address to CSF? (Assuming you are using CSF that is.)

 

[Dan70]

HI info, am blacklisting it in cpHulk and had 2 or 3 times added it to deny access in csf ... same thing...works foir a few hours... the bot does not even change its IP
thx

 

[Infopro]

Adding the IP to CSF should stop it from accessing anything on the server.

Silly question time I guess, are you sure CSF is enabled and operating as expected?

 

[Dan70]

Hi info, thx... guess question is not so silly I guess
but it says: "
Firewall Status: Enabled and Running"
and shouldnT at least cpHulk stop it ... for longer than a few hours?
Thx

 

[Dan70]

find this in my csf
Edit /etc/csf/csf.deny

180.250.162.9 # lfd: (sshd) Failed SSH login from 180.250.162.9 (23.100.232.233ID/Indonesia/-): 5 in the last 3600 secs - Tue Mar 19 04:05:26 2019
the 23.100.232.233 is the IP I desperately try to block and cpanel has a love affair with it
I had also added this IP in this table 2 days ago...to no avail
thx
Dan

 

[Dan70]

so it also seems to try to login to root?
what does this notation 180.250.162.9 (23.100.232.233ID/Indonesia/-) mean?

rerouted IP?
thx
Dan

 

[Infopro]

what does this notation - snipped - mean?

I'm not sure. Surely you're getting emails from the server to let you know about the block, right? Do those emails say temp block or Permanent Block?

 

[Dan70]

Hi info, thx...no, dont get these blocked emails, would drown
sorry for the deviation...
still I wonder why cphulk cannot keep one IP off my server?
thx
Dan

 

[Infopro]

I can't answer that.

I'm assuming you have sshd on the default port. Changing that to another port is always good idea.

This tutorial is a bit longwinded for my taste but you shoud find it of some use:
Tutorial - Interested in increasing the security of your server? Read this. (sshd hardening)

If you suspect an issue with cPhulk working as expected, please feel free to open a ticket directly to cPanel Technical Support.

 

[Dan70]

HI info, thx a million!
D