csf Firewall temporary IP entries issue

crazyaboutlinux

Well-Known Member
Nov 3, 2007
939
1
66
Hi,

One our client is facing the problem that his mail id is frequently went in temporary deny list as well as their local ISP, after that csf permanently deny.

Code:
IP address	A/D	Port	Dir	Time To Live	Comment
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	*	in	13m 30s	lfd - *Port Scan* detected from 202.131.xxx.xx (IN/India/-). 11 hits in the last 20 seconds
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	*	in	16m 31s	lfd - *Port Scan* detected from 202.131.xxx.xx (IN/India/-). 11 hits in the last 201 seconds
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	*	in	21m 38s	lfd - *Port Scan* detected from 202.131.xxx.xx (IN/India/-). 11 hits in the last 206 seconds
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	110,995	in	12m 50s	lfd - pop3d - 61 logins in 1258 secs from 202.131.xxx.xx (IN/India/-) for [email][email protected][/email] exceeds 60/hour
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	110,995	in	12m 50s	lfd - pop3d - 61 logins in 1977 secs from 202.131.xxx.xx (IN/India/-) for [email][email protected][/email] exceeds 60/hour
Unblock 202.131.xxx.xx? 	DENY	202.131.xxx.xx	110,995	in	12m 50s	lfd - pop3d - 61 logins in 2791 secs from 202.131.xxx.xx (IN/India/-) for [email][email protected][/email] exceeds 60/hour
We are using
cPanel/WHM : WHM 11.26.20
CENTOS 4.8 i686


Please guys help to fix this problem once for all
 
Last edited:

Infopro

Well-Known Member
May 20, 2003
17,090
518
613
Pennsylvania
cPanel Access Level
Root Administrator
Twitter
This is a question for the CSF forums. Meantime, find this setting in your firewall and change it to what suits your customers needs.



# Block POP3 logins if greater than LT_POP3D times per hour per account per IP
# address (0=disabled)
#
# This is a temporary block for the rest of the hour, afterwhich the IP is
# unblocked

LT_POP3D = Default: 60
lfd - pop3d - 61 logins in 1258 secs from 202.131
 

GoWilkes

Well-Known Member
Sep 26, 2006
613
25
168
cPanel Access Level
Root Administrator
Just a thought, this forum might be a logical place for a CSF discussion. It integrates well into cPanel, and this is generally the first place that I look for help with it.

Just a thought...