Security Why CSF doesn't block the ip's in the syslog (port scanning)

negative · Apr 27, 2019

Hello,

I've configured the csf well and it is working. However, i shows that someone scanning the ports on my webserver.

Also, i have configured the port scanning feature on csf and restarted the csf. I though something wrong on my webserver about csf.
Code (Text):
PS_INTERVAL = "300"
PS_LIMIT = "15"
I shows that logs via var/log/messages but csf doesn't do something about that. Same ip's scanning the all of my ports as you can see at the screenshot below.

Yes, you can say that firewall working and blocks the connections but, why that same attacker ip's scan my server continuously ? I see the same ips for all days. csf should block that ips which scan my webserver 15 times in 300 seconds (as my csf settings)

eva2000 · Apr 27, 2019

That is how firewalls work there's a difference between successful and unsuccessful connections.. Firewalls like CSF Firewall use by Centmin Mod prevent a successful connection to your server. The logs just show the failed attempts at connecting i.e. TCP_IN Blocked or UDP_IN Blocked etc. Firewalls can't stop IPs from attempting (unsuccessfully) to connect.

negative · Apr 27, 2019

So why port scanning function in the CSF then? Someone scanning my ports from same ip's even.

eva2000 · Apr 27, 2019

Not sure I understand the question ? CSF Firewall is doing it's job. When an IP scans your ports after threshold it will block the IP from successfully connecting i.e. sshd port 22 and then it will log into server system message log whenever that blocked IP attempts to do another scan again and everytime it will block that IP from successfully connecting. If the IP comes back to scan and is still blocked, CSF will again log the unsuccessful attempt in your message log again.

Everytime a blocked IP attempts a connection, it will be logged in /var/log/message log by CSF Firewall. That is how you know CSF Firewall is working by inspecting your system message log.

Jimmy · Apr 27, 2019

It's like kicking a rowdy patron from a bar/pub. You can prohibit him from re-entering the bar/pub, but you can't prevent him from waiting outside and knocking at the front door where the bouncer records every time he tries to re-enter the bar/pub.

negative · Apr 27, 2019

eva2000 said: ↑

Not sure I understand the question ? CSF Firewall is doing it's job. When an IP scans your ports after threshold it will block the IP from successfully connecting i.e. sshd port 22 and then it will log into server system message log whenever that blocked IP attempts to do another scan again and everytime it will block that IP from successfully connecting. If the IP comes back to scan and is still blocked, CSF will again log the unsuccessful attempt in your message log again.

Everytime a blocked IP attempts a connection, it will be logged in /var/log/message log by CSF Firewall. That is how you know CSF Firewall is working by inspecting your system message log.
Click to expand...

I got it, thanks! Anyway, i configured the port scanning feature in CSF but i don't see anything on csf.deny file or i didn't get email that ip blocked. I read articles for this feature, and if it work, csf adding the lines to csf.deny which ip blocked for port scanning. So, something may went wrong on my configuration. Confused.

Jimmy said: ↑

It's like kicking a rowdy patron from a bar/pub. You can prohibit him from re-entering the bar/pub, but you can't prevent him from waiting outside and knocking at the front door where the bouncer records every time he tries to re-enter the bar/pub.
Click to expand...

I Understood. Perfect example!

eva2000 · Apr 27, 2019

CSF Firewall as permanent and temporary IP blocks - more info at https://download.configserver.com/csf/readme.txt including the note about blocked IPs not showing in iptables as it is inspected via /proc/net/ipt_recent/* files

16. Port Flood Protection
#########################

This option configures iptables to offer protection from DOS attacks against
specific ports. This option limits the number of connections per time interval
that new connections can be made to specific ports.

This feature does not work on servers that do not have the iptables module
ipt_recent loaded. Typically, this will be with Monolithic kernels. VPS server
admins should check with their VPS host provider that the iptables module is
included.

By default ipt_recent tracks only the last 100 IP addresses. The tracked IP
addresses can be viewed in /proc/net/ipt_recent/* where the port number is the
filename.

Syntax for the PORTFLOOD setting:

PORTFLOOD is a comma separated list of:
port;protocol;hit count*;interval seconds

So, a setting of PORTFLOOD = "22;tcp;5;300,80;tcp;20;5" means:

1. If more than 5 connections to tcp port 22 within 300 seconds, then block
that IP address from port 22 for at least 300 seconds after the last packet is
seen, i.e. there must be a "quiet" period of 300 seconds before the block is
lifted

2. If more than 20 connections to tcp port 80 within 5 seconds, then block
that IP address from port 80 for at least 5 seconds after the last packet is
seen, i.e. there must be a "quiet" period of 5 seconds before the block is
lifted

More information about the ipt_recent module can be found in the iptables man
page and at http://snowman.net/projects/ipt_recent/

Note: Blocked IP addresses do not appear in any of the iptables chains when
using this module. You must manipulate the /proc/net/ipt_recent/* files as per
the module documentation to view and remove IP addresses that are currently
blocked if the blocks have not yet expired.

Restarting csf resets the ipt_recent tables and removes all of its blocks.

Note: There are some restrictions when using ipt_recent:

1. By default it only tracks 100 addresses per table (we try and increase this
to 1000 via modprobe)

2. By default it only counts 20 packets per address remembered

*This means that you need to keep the hit count to below 20.
Click to expand...

and from /etc/csf/csf.conf CSF Firewall config file

###############################################################################
# SECTIONort Scan Tracking
###############################################################################
# Port Scan Tracking. This feature tracks port blocks logged by iptables to
# syslog. If an IP address generates a port block that is logged more than
# PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked.
#
# This feature could, for example, be useful for blocking hackers attempting
# to access the standard SSH port if you have moved it to a port other than 22
# and have removed 22 from the TCP_IN list so that connection attempts to the
# old port are being logged
#
# This feature blocks all iptables blocks from the iptables logs, including
# repeated attempts to one port or SYN flood blocks, etc
#
# Note: This feature will only track iptables blocks from the log file set in
# IPTABLES_LOG below and if you have DROP_LOGGING enabled. However, it will
# cause redundant blocking with DROP_IP_LOGGING enabled
#
# Warning: It's possible that an elaborate DDOS (i.e. from multiple IP's)
# could very quickly fill the iptables rule chains and cause a DOS in itself.
# The DENY_IP_LIMIT should help to mitigate such problems with permanent blocks
# and the DENY_TEMP_IP_LIMIT with temporary blocks
#
# Set PS_INTERVAL to "0" to disable this feature. A value of between 60 and 300
# would be sensible to enable this feature
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
PS_INTERVAL = "0"
PS_LIMIT = "15"

# You can specify the ports and/or port ranges that should be tracked by the
# Port Scan Tracking feature. The following setting is a comma separated list
# of those ports and uses the same format as TCP_IN. The setting of
# 0:65535,ICMP,INVALID,OPEN,BRD covers all ports
#
# Special values are:
# ICMP - include ICMP blocks (see ICMP_*)
# INVALID - include INVALID blocks (see PACKET_FILTER)
# OPEN - include TCP_IN and UDP_IN open port blocks - *[proto]_IN Blocked*
# BRD - include UDP Broadcast IPs, otherwise they are ignored
PS_PORTS = "0:65535,ICMP"

# To specify how many different ports qualifies as a Port Scan you can increase
# the following from the default value of 1. The risk in doing so will mean
# that persistent attempts to attack a specific closed port will not be
# detected and blocked
PS_DIVERSITY = "1"

# You can select whether IP blocks for Port Scan Tracking should be temporary
# or permanent. Set PS_PERMANENT to "0" for temporary and "1" for permanent
# blocking. If set to "0" PS_BLOCK_TIME is the amount of time in seconds to
# temporarily block the IP address for
PS_PERMANENT = "0"
PS_BLOCK_TIME = "3600"

# Set the following to "1" to enable Port Scan Tracking email alerts, set to
# "0" to disable them
PS_EMAIL_ALERT = "1"
Click to expand...

eva2000 · Apr 27, 2019

Example for Pure-ftpd port 21 port flooding protection https://community.centminmod.com/th...t-flood-blocking-pure-ftpd-connections.14708/

Log in / Register

Forums

Welcome to Centmin Mod Community

Security Why CSF doesn't block the ip's in the syslog (port scanning)

negative Active Member

eva2000 Administrator Staff Member

negative Active Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

negative Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

Security Why CSF doesn't block the ip's in the syslog (port scanning)

negative Active Member

eva2000 Administrator Staff Member

negative Active Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

negative Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.