Results 1 to 9 of 9

Thread: CSF Log

  1. #1
    Join Date
    May 2009
    Location
    Bangladesh
    Posts
    133

    CSF Log

    We use CSF for our linux server. for last two days some of our users are having problem accessing our network. there IP is not banned by the firewall rules but when i make those IP white listed, it works for them.

    i want to find the cause why people are getting banned or why they are not able to access our network...also where can i find the csf log file to investigate such issues.
    TetraHost Bangladesh
    Shared Hosting | Reseller Hosting | Shoutcast Radio Hosting
    Biased for true hosting experience - www.tetrahostbd.com

  2. #2
    Join Date
    Jan 2005
    Location
    Darwin, Australia
    Posts
    1,333
    /etc/csf/csf.deny or the WHM interface if you're running cPanel
    Graham Craig

    "IT'S NOT HOW GOOD YOU ARE, IT'S HOW BAD YOU WANT IT."

  3. #3
    Join Date
    May 2009
    Location
    Bangladesh
    Posts
    133
    yes, i can find the banned IPs from csf.deny file but can i get more information? also how can i find log for those IP which are not listed on the deny list but are not able to access the network.
    TetraHost Bangladesh
    Shared Hosting | Reseller Hosting | Shoutcast Radio Hosting
    Biased for true hosting experience - www.tetrahostbd.com

  4. #4
    Join Date
    Jan 2005
    Location
    Darwin, Australia
    Posts
    1,333
    it will normally tell you why in that file

    example:
    83.170.88.xxx # lfd: 10 (pop3d) login failures from 83.170.88.xxx in the last 300 secs - Mon Sep 28 17:12:26 2009

    Exceeded the allowed number of pop3 password attempts
    Graham Craig

    "IT'S NOT HOW GOOD YOU ARE, IT'S HOW BAD YOU WANT IT."

  5. #5
    Join Date
    Aug 2000
    Posts
    2,750
    Are you running cPHulk ?

  6. #6
    Try to find the IP from /var/log/lfd.log using the following command.

    grep <IP> /var/log/lfd.log

    You can find the exact reason.

  7. #7
    Join Date
    Oct 2004
    Location
    Kerala, India
    Posts
    4,750
    There are temporary ban in csf. To get the list of files where the banned IP may be present you can use this.
    Code:
    grep -rl IP /etc/csf
    David | www.cliffsupport.com
    Affordable Server Management Solutions sales AT cliffsupport DOT com
    CliffWebManager | Access WHM from iPhone and Android

  8. #8
    Join Date
    May 2009
    Location
    Bangladesh
    Posts
    133
    none of the above solutions worked for me. i have tried both the following commands for those IP who were not able to access our network "grep -rl IP /etc/csf" and "grep <IP> /var/log/lfd.log" and there was no reason though when i added those IP to white list, the problem was gone :|

    any idea guys what can be the issue?
    TetraHost Bangladesh
    Shared Hosting | Reseller Hosting | Shoutcast Radio Hosting
    Biased for true hosting experience - www.tetrahostbd.com

  9. #9
    Join Date
    Feb 2004
    Posts
    61
    i have all the denied IPs logged in /var/log/syslog (running debian that would be standard) - have you tried grepping the IP from there?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •