CSF Advanced Filtering
greetings...
Recently CFS's Advanced Port Filtering stopped working. I have blocked all dovecot auth ports on an IP range but login attacks are getting through.
d=465,587,993,995,110,143|s=2.0.0.0/8
Any insight would be appreciated
-
Hey there! I'm looking into this for you now, but I may not get the answer until Monday. I'll be sure to post an update as soon as I have something to share.
0 -
a little more info...
dovecot_login authenticator failed for H=([175.203.199.118]) [64.53.7.231]:33438: 535 Incorrect authentication data
CSF Entries:
tcp|in|d=465,587,993,995,110,143|s=64.0.0.0/8
175.0.0.0/8
with 64.53.7.231 being the IP that CSF blocked
0 -
Sorry about the delay on this - I'm not finding anything about this on our side so we may need to see this on a working system. Are you able to submit a ticket to our team so we can check this out?
0 -
Default cPanel Exim conf advertises authorization on port 25, so CSF won't help in this case.
You have to limit Exim auth_advertise_hosts to 127.0.0.1 (cPanel needs authorization on port 25).
You can configure that in 'Service Configuration' -> 'Exim Configuration Manager' -> Advanced Editor
Scroll down to "Add additional configuration setting" and add auth_advertise_hosts
${if eq{$received_port}{25} {${if match_ip{$sender_host_address}{127.0.0.1}{*}{none}}} {*} }
0 -
It worked flawlessly for 2 years. never saw the incorrect login error and it didn't add entries to the firewall. then about 3 weeks ago it started happening. advanced port filtering works fine for ports 80, 443. it looks like the originating IP is going through compromised devices in the US. I have a custom regex that blocks them at 1 failed login. I put that in place before I discovered the advanced port filtering feature. also... only one domain is the recipient of the attacks...
0 -
It's a good practice to stop advertising authorization on port 25. Client's email submission on that port is from ancient bygone era. cPanel should disable that by default and have a setting to turn it on for rare cases when needed.
It's just asking for trouble, these days only malicious bots are trying to authenticate on port 25.
0 -
OK. Your code worked
${if eq{$received_port}{25} {${if match_ip{$sender_host_address}{127.0.0.1}{*}{none}}} {*} }
CSF Read Me text file code did not work:
${if match_ip{$sender_host_address}{iplsearch;/etc/exim.smtpauth}{*}{}}0
Please sign in to leave a comment.
Comments
7 comments