cpHulk & Firewall not blocking IP

Dan70

• March 20, 2019 14:07

HI, am very frustrated... have a bot scavenging my site, always same IP...I several times input the IP and then it is blocked for a few hours, only to get back on my site shortly after, still blacklisted... seems cpHulk is not working grrr.... Thx Dan

• 

  Infopro

  • March 20, 2019 19:16

  Are you adding the IP address to CSF? (Assuming you are using CSF that is.)

  0
• 

  Dan70

  • March 20, 2019 19:18

  HI info, am blacklisting it in cpHulk and had 2 or 3 times added it to deny access in csf ... same thing...works foir a few hours... the bot does not even change its IP thx

  0
• 

  Infopro

  • March 20, 2019 19:23

  Adding the IP to CSF should stop it from accessing anything on the server. Silly question time I guess, are you sure CSF is enabled and operating as expected?

  0
• 

  Dan70

  • March 20, 2019 19:25

  Hi info, thx... guess question is not so silly I guess :) but it says: " Firewall Status: Enabled and Running" and shouldnT at least cpHulk stop it ... for longer than a few hours? Thx

  0
• 

  Dan70

  • March 20, 2019 19:31

  find this in my csf Edit /etc/csf/csf.deny 180.250.162.9 # lfd: (sshd) Failed SSH login from 180.250.162.9 (23.100.232.233ID/Indonesia/-): 5 in the last 3600 secs - Tue Mar 19 04:05:26 2019 the 23.100.232.233 is the IP I desperately try to block and cpanel has a love affair with it I had also added this IP in this table 2 days ago...to no avail thx Dan

  0
• 

  Dan70

  • March 20, 2019 19:32

  so it also seems to try to login to root? what does this notation 180.250.162.9 (23.100.232.233ID/Indonesia/-) mean? rerouted IP? thx Dan

  0
• 

  Infopro

  • March 20, 2019 19:48

  what does this notation - snipped - mean?

  
  I'm not sure. Surely you're getting emails from the server to let you know about the block, right? Do those emails say temp block or Permanent Block?

  0
• 

  Dan70

  • March 20, 2019 19:56

  Hi info, thx...no, dont get these blocked emails, would drown sorry for the deviation... still I wonder why cphulk cannot keep one IP off my server? thx Dan

  0
• 

  Infopro

  • March 20, 2019 20:08

  I can't answer that. I'm assuming you have sshd on the default port. Changing that to another port is always good idea. This tutorial is a bit longwinded for my taste but you shoud find it of some use: If you suspect an issue with cPhulk working as expected, please feel free to open a ticket directly to cPanel Technical Support.

  0
• 

  Dan70

  • March 20, 2019 20:35

  HI info, thx a million! D

  0

Please sign in to leave a comment.