pci scan blocked by IPS?

vpswing

• January 08, 2022 04:08

Hi, May I know what is causing this on our cPanel server? Is it the cPhulkd daemon? How to resolve this, disable cPhulkd when running the scan?

Vulnerability Details:	Service: 22:TCP port(s) became closed during scan: 22,25,53,80,110,143,443,465,587,2082-2083,2086-2087,2095-2096
IP Address:	redacted
Host:	redacted
Path:
Threat Reference:	See pages 14-15 of the [

• 

  quietFinn

  • January 08, 2022 11:58

  If you are using CSF it's rather that. Then add the scanner's IP to /etc/csf/csf.ignore and restart CSF.

  0
• 

  ffeingol

  • January 08, 2022 12:48

  @quietFinn is totally correct. If you are using CSF, you'll need to add the PCI's company's IP's to your ignore file. Lots of what a PCI scan does will trip any intrusion detection system.

  0
• 

  vpswing

  • January 08, 2022 23:28

  Thanks for the tips, but CSF is not installed, nor LFD. But when I check with 'iptables -L' - there are a bunch of firewall rules listed. Does cPanel v100.0.5 comes with some built-in firewall rules?

  0
• 

  cPanelAnthony

  • January 10, 2022 17:59

  Thanks for the tips, but CSF is not installed, nor LFD. But when I check with 'iptables -L' - there are a bunch of firewall rules listed. Does cPanel v100.0.5 comes with some built-in firewall rules?

  
  This wouldn't be an issue of cPanel v100.0.5 in this case. Would it be possible to reach out to your systems administrator or web hosting provider to inquire about any firewall blocks?

  0

Please sign in to leave a comment.