Indeed, I

Hello everyone. I just installed the first CSF Firewall DirectAdmin. After some difficulties (xen vps) is successful (server security 66). It has advised me to install intercoastal waterway fail2ban to secure root ssh. However, I feel that there is some overlap between the csf functionality and fail2ban. Does it really useful to install fail2ban next CSF or is this unnecessary? This works well together? Thanks in advance for any possible information.
CSF has LFD incorrect logins that you can measure and may impose a blockade. Fail2ban could also scan logs activities similar to scanning exploits and LFD has not. But the answer to your question is yes, there is an overlap in and you should be set to use fail2ban CSF (search intercoastal waterway http://www.digitalfaq.com/forum/web-...-blocking.html to csf) . Otherwise a blockade with fail2ban will still function but CSF blockade not know. Consequence: to restart iptables and incitement of CSF's IP address can regain access to the server. By integrating CSF CSF know the blockage is and the blockade after a reboot will be set again.
Ok clear. Suffice in your experience CSF or the additional integration with fail2ban to be needed? (The topic linked intercoastal waterway above talks about the problems of this implementation so that does not speak for this solution).
If the conflict shows I only recommend using CSF. This is a very powerful tool that can not be missed. I do not own a combination of fail2ban turning combination csf so I do not know if it will make a big difference but LFD (part of CSF) does not scan for exploits.
CSF can indeed block failed logins from many services. intercoastal waterway But is not it just easier to close SSH carpentry and leave this port open only for a few IP addresses? For website related expoits the way you can use some CXS can automatically scan all uploads from customers. Additionally, you can scan through all additional example, weekly via cron. If CXS often accused uploads detected from an IP that you can send it to CSF which allows you to automatically block an IP address.
I must concur with joriz. We use only SCF and leave only a few IP addresses to use for SSH. Until now, this works very well. We did CXS run with it on one server and that works well together. CXS is unlike CSF not free.
It has advised me to install fail2ban to secure root ssh. If it only goes so you do not need fail2ban. CSF also detects SSH logins and can block it. Incidentally, we move default port 22 to another port, which again saves a lot of brute force log lines of script kiddies. In addition, intercoastal waterway only we switch plaintext logins and use SSH keys with passwords.
SSH port changes. Are now mainly intercoastal waterway DirectAdmin / ftp logins. intercoastal waterway I have it run for a while but I currently have some doubts about the functioning of LFD. When brute force monitor DA I come at this example: 12.133.41.130 174 Sep 4 18:14 Sep 12 04:38 Yes IP Info This while DA with settings set to "Blacklist IPs for excessive DA Login Attempts" 20. Strange that he then eight days later attempt number 174 can do or not? LFD did not have to banish him long? I can find nowhere berhaupt the LFD banlist.
Config Server Security & Firewall - csf v7.15 Searching for 12.133.41.130 ... Chain num pkts bytes target prot opt in out source destination No matches found for 12.133.41.130 in ip6tables iptables: Chain num pkts bytes target prot opt in out source destination No matches found for 12.133.41.130 in ip6tables ... Done. Anyone have a suggestion? Would be very nice if this obvious offender just hard boulder automatically comes permanently on the banlist.
Have you made the adjustments necessary for cooperation with the brute force? / Usr / local / direct admin / scripts / custom even make some scripts, I got there the next two to capture that: 1.) block_ip.sh
Code: #! / Bin / sh ip /etc/csf/csf.pl -td $ 14400 BFM IP Block exit 0;! The 14400 can you change to another more suitable value, you can also change the -td to put a permanent ban. 2.) brute_force_notice_ip.sh
Code: #! / Bin / sh SCRIPT = / usr / local / direct admin / scripts / custom / block_ip.sh ip = $ value $ SCRIPT intercoastal waterway exit $ ?;! And forget about it because that ensures that it is handled automatically. Perhaps it also works when you combine them but I've never looked at.
Indeed, I've read on the site of DA that he gives only standard warnings intercoastal waterway and does not communicate with the firewall. However, I was assuming that LFD own this attack should be identified and eliminated. How can I file a list of current bans from CSF ask?
The far