csf Firewall temporary IP entries issue

[crazyaboutlinux]

Hi,

One our client is facing the problem that his mail id is frequently went in temporary deny list as well as their local ISP, after that csf permanently deny.

IP address	A/D	Port	Dir	Time To Live	Comment
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	*	in	13m 30s	lfd - *Port Scan* detected from 202.131.xxx.xx (IN/India/-). 11 hits in the last 20 seconds
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	*	in	16m 31s	lfd - *Port Scan* detected from 202.131.xxx.xx (IN/India/-). 11 hits in the last 201 seconds
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	*	in	21m 38s	lfd - *Port Scan* detected from 202.131.xxx.xx (IN/India/-). 11 hits in the last 206 seconds
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	110,995	in	12m 50s	lfd - pop3d - 61 logins in 1258 secs from 202.131.xxx.xx (IN/India/-) for [email][email protected][/email] exceeds 60/hour
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	110,995	in	12m 50s	lfd - pop3d - 61 logins in 1977 secs from 202.131.xxx.xx (IN/India/-) for [email][email protected][/email] exceeds 60/hour
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	110,995	in	12m 50s	lfd - pop3d - 61 logins in 2791 secs from 202.131.xxx.xx (IN/India/-) for [email][email protected][/email] exceeds 60/hour

We are using
cPanel/WHM : WHM 11.26.20
CENTOS 4.8 i686


Please guys help to fix this problem once for all

 

[Infopro]

This is a question for the CSF forums. Meantime, find this setting in your firewall and change it to what suits your customers needs.

# Block POP3 logins if greater than LT_POP3D times per hour per account per IP
# address (0=disabled)
#
# This is a temporary block for the rest of the hour, afterwhich the IP is
# unblocked

LT_POP3D = Default: 60

lfd - pop3d - 61 logins in 1258 secs from 202.131

 

[crazyaboutlinux]

This is a question for the CSF forums. Meantime, find this setting in your firewall and change it to what suits your customers needs.





lfd - pop3d - 61 logins in 1258 secs from 202.131

Hey Thanks BRO,

i was seeking for this option & got it here,Thank you so much

The same thread i posted on ConfigServer Scripts Forum

 

[GoWilkes]

Just a thought, this forum might be a logical place for a CSF discussion. It integrates well into cPanel, and this is generally the first place that I look for help with it.

Just a thought...