APF çok sorun oluşturdu onu kaldırdım, yerine Cpanel ile daha uyumlu olan ConfigServer Security & Firewall - csf v3.10 kurdum. Security Level olarak da High olanı tercih ettim. Kurulumdan sonra port kısımlarına TCP_IN kısmına Radyo, Eschat ve IRC portunu ekledim. Chat sorunsuz açıyor ama Radyoya kimse bağlanamıyor. Radyo portu 2005, TCP_IN 'e ekliydi normalde, TCP_OUT, UDP_IN ve UDP_OUT 'a da ekledim. Ama nafile, radyoya bağlanamıyoruz winampla. Ne zamanki firewallı kapatıyorum, o zaman bağlanabiliyorum.
CONf ayarları aşağıdaki gibi :
###############################################################################
# Copyright 2006, Way to the Web Limited
# URL: http://www.waytotheweb.com
# Email: sales@waytotheweb.com
###############################################################################
# Testing flag - enables a CRON job that clears iptables incase of
# configuration problems when you start csf. This should be enabled until you
# are sure that the firewall works - i.e. incase you get locked out of your
# server! Then do remember to set it to 0 and restart csf when you're sure
# everything is OK. Stopping csf will remove the line from /etc/crontab
TESTING = 0
# The interval for the crontab in minutes. Since this uses the system clock the
# CRON job will run at the interval past the hour and not from when you issue
# the start command. Therefore an interval of 5 minutes means the firewall
# will be cleared in 0-5 minutes from the firewall start
TESTING_INTERVAL = 5
# Enabling auto updates creates a cron job called /etc/cron.d/csf_update which
# runs once per day to see if there is an update to csf+lfd and upgrades if
# available and restarts csf and lfd. Updates do not overwrite configuration
# files or email templates. An email will be sent to the root account if an
# update is performed
AUTO_UPDATES = 0
# Ethernet device setting is taken from the shared IP address in
# /etc/wwwacct.conf but can be overridden here (e.g. "eth0")
#
# If you have multiple ethernet NICs that you want to apply all rules to, then
# you can set the following to the interface name immediately followed by a
# plus sign. For example, eth+ will apply all rules to eth0, eth1, etc
ETH_DEVICE =
# Unfiltered ethernet devices in a comma separated list (e.g "eth1,eth2")
ETH_DEVICE_SKIP =
# Lists of ports in the following comma separated lists can be added using a
# colon (e.g. 30000:35000).
# Allow incoming TCP ports
TCP_IN = 20,21,22,25,53,80,110,143,443,465,953,993,995,2077,2078,2082,2083,2086,2087,2095,2096,8055(eschat),2005(radyo),6667(irc)
# Allow outgoing TCP ports
TCP_OUT = 20,21,22,25,37,43,53,80,110,113,443,587,873,953,2087,2089,2703
# Allow incoming UDP ports
UDP_IN = 20,21,53,953
# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = 20,21,53,113,123,873,953,6277
# Allow incoming PING
ICMP_IN = 0
# Set the per IP address incoming ICMP packet rate
# To disable rate limiting set to "0"
ICMP_IN_RATE = 1/s
# Allow outgoing PING
ICMP_OUT = 0
# Set the per IP address outgoing ICMP packet rate
# To disable rate limiting set to "0"
ICMP_OUT_RATE = 1/s
# Block outgoing SMTP except for root, exim and mailman (forces scripts/users
# to use the exim/sendmail binary instead of sockets access). This replaces the
# protection as WHM > Tweak Settings > SMTP Tweaks
SMTP_BLOCK = 1
# If SMTP_BLOCK is enabled but you want to allow local connections to port 25
# on the server (e.g. for web scripts) then enable this option too
SMTP_ALLOWLOCAL = 1
# If this is a MONOLITHIC kernel (i.e. it has no LKM support, e.g. a VPS) then
# set this to 1. Because of the nature of monolithic kernels, it's not easy to
# determine which modules have been built-in, so some functionality may not be
# available and this firewall script may not work.
#
# One example is if the ip_conntrack and ip_conntrack_ftp iptables kernel
# modules are not available. If this happens, FTP passive mode (PASV) won't
# work. In such circumstances you will have to open a hole in your firewall and
# configure the FTP daemon to use that same hole. For example, with pure-ftpd
# you could add the port range 30000:35000 to TCP_IN and add the following line
# to /etc/pure-ftpd.conf (without the leading #):
# PassivePortRange 30000 35000
# Then restart pure-ftpd and csf and passive FTP should then work
MONOLITHIC_KERNEL = 0
# Drop target for iptables rules. This can be set to either DROP ot REJECT.
# REJECT will send back an error packet, DROP will not respond at all. REJECT
# is more polite, however it does provide extra information to a hacker and
# lets them know that a firewall is blocking their attempts. DROP hangs their
# connection, thereby frustrating attempts to port scan the server.
DROP = DROP
# Enable logging of dropped connections to blocked ports to syslog, usually
# /var/log/messages
DROP_LOGGING = 1
# Enable logging of dropped connections to blocked IP addresses in csf.deny or
# by lfd with temporary connection tracking blocks
DROP_IP_LOGGING = 0
# Only log reserved port dropped connections (0:1023). Useful since you're not
# usually bothered about ephemeral port drops
DROP_ONLYRES = 1
# Commonly blocked ports that you do not want logging as they tend to just fill
# up the log file. These ports are specifically blocked (applied to TCP and UDP
# protocols) for incoming connections
DROP_NOLOG = 67,68,111,113,135:139,445,513,520
# Enable packet filtering for unwanted or illegal packets
PACKET_FILTER = 1
# Log packets dropped by the packet filtering option PACKET_FILTER. This will
# show packet drops that iptables has deemed INVALID (i.e. there is no
# established TCP connection in the state table), or if the TCP flags in the
# packet are out of sequence or illegal in the protocol exchange.
#
# If you see packets being dropped that you would rather allow then disable the
# PACKET_FILTER option above by setting it to "0"
DROP_PF_LOGGING = 0
# Enable SYN flood protection. This option configures iptables to offer some
# protection from tcp SYN packet DOS attempts. You should set the RATE so that
# false-positives are kept to a minimum otherwise visitors may see connection
# issues (check /var/log/messages for *SYNFLOOD Blocked*). See the iptables
# man page for the correct --limit rate syntax
SYNFLOOD = 1
SYNFLOOD_RATE = 4/s
# Enable verbose output of iptables commands
VERBOSE = 1
# Log lfd messages to SYSLOG in addition to /var/log/lfd.log. You must have the
# perl module Sys::Syslog installed to use this feature
SYSLOG = 0
# If you wish to allow access from dynamic DNS records (for example if your IP
# address changes whenever you connect to the internet but you have a dedicated
# dynamic DNS record from the likes of dyndns.org) then you can list the FQDN
# records in csf.dyndns and then set the following to the number of seconds to
# poll for a change in the IP address. If the IP address has changed iptables
# will be updated.
#
# A setting of 600 would check for IP updates every 10 minutes. Set the value
# to 0 to disable the feature
DYNDNS = 0
# Enable this option if you wish to allow access from all IP's that have
# authenticated using POP before SMTP (i.e. are valid clients). This option
# checks for IP addresses in /etc/relayhosts, which last for 30 minutes in that
# file after a successful POP authentication.
#
# Set the value to 0 to disable the feature
RELAYHOSTS = 0
# Limit the number of IP's kept in the /etc/csf/csf.deny file. This can be
# important as a large number of IP addresses create a large number of iptables
# rules (4 times the number of IP's) which can cause problems on some systems
# where either the the number of iptables entries has been limited (esp VPS's)
# or where resources are limited. This can result in slow network performance,
# or, in the case of iptables entry limits, can prevent your server from
# booting as not all the required iptables chain settings will be correctly
# configured. The value set here is the maximum number of IPs/CIDRs allowed
# if the limit is reached, the entries will be rotated so that the oldest
# entries (i.e. the ones at the top) will be removed and the latest is added.
# The limit is only checked when using csf -d (which is what lfd also uses)
# Set to 0 to disable limiting
DENY_IP_LIMIT = 100
# The follow Global options allow you to specify a URL where csf can grab a
# centralised copy of an IP allow or deny block list of your own. You need to
# specify the full URL in the following options, i.e.:
# http://www.somelocation.com/allow.txt
#
# The actual retrieval of these IP's is controlled by lfd, so you need to set
# LF_GLOBAL to the interval (in seconds) when you want lfd to retrieve. lfd
# will perform the retrieval when it runs and then again at the specified
# interval. A sensible interval would probably be every 3600 seconds (1 hour)
#
# You do not have to specify both an allow and a deny file
#
# You can also configure a global ignore file for IP's that lfd should ignore
GLOBAL_ALLOW =
GLOBAL_DENY =
GLOBAL_IGNORE =
LF_GLOBAL =
# Enable login failure detection daemon (lfd). If set to 0 none of the other LF
# settings have any effect as the daemon won't start.
# When the trigger level of failures is reached lfd will use csf to add the IP
# to the /etc/csf/csf.deny file and block it
LF_DAEMON = 1
# The following[*] triggers are application specific. If you set LF_TRIGGER to
# "0" the value of each trigger is the number of failures against that
# application that will trigger lfd to block the IP address
#
# If you set LF_TRIGGER to a value greater than "0" then the following[*]
# application triggers are simply on or off ("0" or "1") and the value of
# LF_TRIGGER is the total cumulative number of failures that will trigger lfd
# to block the IP address
#
# Setting the application trigger to "0" disables it
LF_TRIGGER = 5
# If LF_TRIGGER is > 1 then the following can be set to "1" to permanently
# block the IP address, or if set to a value greater than "1" then the IP
# address will be blocked temporarily for the value in seconds. For example:
# LF_TRIGGER_PERM = "1" => the IP is blocked permanently
# LF_TRIGGER_PERM = "3600" => the IP is blocked temporarily for 1 hour
#
# If LF_TRIGGER is 0, then the application LF_[application]_PERM value works in
# the same way as above
LF_TRIGGER_PERM = 1
# To only block access to the failed application instead of a complete block
# for an ip address, you can set the following to "1", but LF_TRIGGER must be
# set to "0" with specific application[*] trigger levels also set
LF_SELECT = 0
#[*]Enable login failure detection of sshd connections
LF_SSHD = 5
LF_SSHD_PERM = 1
#[*]Enable login failure detection of pure-ftpd connections
LF_FTPD = 10
LF_FTPD_PERM = 1
#[*]Enable login failure detection of SMTP AUTH connections
LF_SMTPAUTH = 5
LF_SMTPAUTH_PERM = 1
#[*]Enable login failure detection of courier pop3 connections. This will not
# trap the older cppop daemon
LF_POP3D = 10
LF_POP3D_PERM = 1
#[*]Enable login failure detection of courier imap connections. This will not
# trap the older cpimap (uwimap) daemon
LF_IMAPD = 10
LF_IMAPD_PERM = 1
#[*]Enable login failure detection of Apache .htpasswd connections
# Due to the often high logging rate in the Apache error log, you might want to
# enable this option only if you know you are suffering from attacks against
# password protected directories
LF_HTACCESS = 5
LF_HTACCESS_PERM = 1
#[*]Enable failure detection of Apache mod_security connections
# Due to the often high logging rate in the Apache error log, you might want to
# enable this option only if you know you are suffering from attacks against
# web scripts
LF_MODSEC = 5
LF_MODSEC_PERM = 1
#[*]Enable login failure detection of cpanel, webmail and whm connections
LF_CPANEL = 5
LF_CPANEL_PERM = 1
# Check that csf appears to have been stopped. This checks the status of the
# iptables INPUT chain. If it's not set to DROP, LF will run csf. This will not
# happen if TESTING is enabled above. The check is done every 300 seconds
LF_CSF = 1
# Send an email alert if anyone logs in successfully using SSH
LF_SSH_EMAIL_ALERT = 1
# Send an email alert if anyone uses su to access another account. This will
# send an email alert whether the attempt to use su was successful or not
LF_SU_EMAIL_ALERT = 1
# Enable scanning of the exim mainlog for repeated emails sent from scripts.
# To use this feature you must add an extended email logging line to WHM >
# Exim Configuration Editor > Switch to Advanced Mode > in the first textbox
# add the following line (without the preceding #):
#
# log_selector = +arguments +subject
#
# If you already use extended exim logging, then you need to either include
# +arguments or use +all
#
# This setting will then send an alert email if more than LF_SCRIPT_LIMIT lines
# appear with the same cwd= path in them within an hour. This can be useful in
# identifying spamming scripts on a server, especially PHP scripts running
# under the nobody account. The email that is sent includes the exim log lines
# and also attempts to find scripts that send email in the path that may be the
# culprit
LF_SCRIPT_ALERT = 1
# The limit afterwhich the email alert for email scripts is sent. Care should
# be taken with this value if you allow clients to use web scripts to maintain
# psuedo-mailing lists which have large recipients
LF_SCRIPT_LIMIT = 100
# This setting will have lfd chattr +i and chmod 000 the directory which is
# identified by LF_SCRIPT_ALERT and so disable any scripts within the directory,
# the alert email will then contain the commands needed to restore the
# directory to its former glory. Obviously, care should be taken with this as
# false-positives are possible
LF_SCRIPT_PERM = 0
# Enable Directory Watching. This enables lfd to check /tmp and /dev/shm
# directories for suspicious files, i.e. script exploits. If a suspicious
# file is found an email alert is sent. Only one alert per file is sent until
# lfd is restarted, so if you remove a suspicious file, remember to restart lfd
#
# To enable this feature set the following to the checking interval in seconds.
# Set to disable set to "0"
LF_DIRWATCH = 60
# To remove any suspicious files found during directory watching, enable the
# following. These files will be appended to a tarball in
# /etc/csf/suspicious.tar
LF_DIRWATCH_DISABLE = 1
# This option allows you to have lfd watch a particular file or directory for
# changes and should they change and email alert using watchalert.txt is sent
#
# To enable this feature set the following to the checking interval in seconds
# (a value of 60 would seem sensible) and add your entries to csf.dirwatch
#
# Set to disable set to "0"
LF_DIRWATCH_FILE = 0
# System Integrity Checking. This enables lfd to compare md5sums of the
# servers OS binary application files from the time when lfd starts. If the
# md5sum of a monitored file changes an alert is sent. This option is intended
# as an IDS (Intrusion Detection System) and is the last line of detection for
# a possible root compromise.
#
# There will be constant false-positives as the servers OS is updated or
# monitored application binaries are updated. However, unexpected changes
# should be carefully inspected.
#
# Modified files will only be reported via email once.
#
# To enable this feature set the following to the checking interval in seconds
# (a value of 3600 would seem sensible). This option may increase server I/O
# load onto the server as it checks system binaries.
#
# To disable set to "0"
LF_INTEGRITY = 3600
# System Exploit Checking. This enables lfd to check for the Random JS Toolkit
# and may check for others in the future:
# http://www.cpanel.net/security/notes/random_js_toolkit.html
# It compares md5sums of the binaries listed in the exploit above for changes
# and also attempts to create and remove a number directory
#
# Modified files will only be reported via email once, though will be reset
# after an hour
#
# To enable this feature set the following to the checking interval in seconds
# (a value of 300 would seem sensible).
#
# To disable set to "0"
LF_EXPLOIT = 300
# Set the time interval to track login failures within (seconds), i.e.
# LF_TRIGGER failures within the last LF_INTERVAL seconds
LF_INTERVAL = 300
# Set the log file parsing interval (seconds). This is how long the daemon
# sleeps before processing the log file entries since the last scan finished
LF_PARSE = 5
# Send an email alert if an IP address is blocked
LF_EMAIL_ALERT = 1
# Send an email alert if an account exceeds LT_POP3D/LT_IMAPD logins per hour
# per IP
LT_EMAIL_ALERT = 1
# Block POP3 logins if greater than LT_POP3D times per hour per account per IP
# address (0=disabled)
#
# This is a temporary block for the rest of the hour, afterwhich the IP is
# unblocked
LT_POP3D = 60
# Block IMAP logins if greater than LT_IMAPD times per hour per account per IP
# address (0=disabled) - not recommended for IMAP logins due to the ethos
# within which IMAP works. If you want to use this, setting it quite high is
# probably a good idea
#
# This is a temporary block for the rest of the hour, afterwhich the IP is
# unblocked
LT_IMAPD = 0
# Relay Tracking. This allows you to track email that is relayed through the
# server. It tracks general email sent into the server (RELAY), email sent out
# after POP before SMTP (POPRELAY) and SMTP_AUTH (AUTHRELAY) authentication,
# local email sent from the server (LOCALRELAY). There are also options to send
# alerts and block IP addresses if the number of emails relayed per hour
# exceeds configured limits. The blocks can be either permanent or temporary.
#
# The following information applies to each of the following types of relay
# check:
# RT_[relay type]_ALERT: 0 = disable, 1 = enable
# RT_[relay type]_LIMIT: the limit/hour afterwhich an email alert will be sent
# RT_[relay type]_BLOCK: 0 = no block;1 = perm block;nn=temp block for nn secs
RT_RELAY_ALERT = 1
RT_RELAY_LIMIT = 100
RT_RELAY_BLOCK = 0
RT_AUTHRELAY_ALERT = 1
RT_AUTHRELAY_LIMIT = 100
RT_AUTHRELAY_BLOCK = 0
RT_POPRELAY_ALERT = 1
RT_POPRELAY_LIMIT = 100
RT_POPRELAY_BLOCK = 0
RT_LOCALRELAY_ALERT = 1
RT_LOCALRELAY_LIMIT = 100
RT_LOCALRELAY_BLOCK = 0
# Enable IP range blocking using the DShield Block List at
# http://www.dshield.org/block_list_info.php
# To enable this feature, set the following to the interval in seconds that you
# want the block list updated. The list is reasonably static during the length
# of a day, so it would be appropriate to only update once every 24 hours, so
# a value of "86400" is recommended
LF_DSHIELD = 86400
# The DShield block list URL. If you change this to something else be sure it
# is in the same format as the block list
LF_DSHIELD_URL = http://feeds.dshield.org/block.txt
# Enable IP range blocking using the Spamhaus DROP List at
# http://www.spamhaus.org/drop/index.lasso
# To enable this feature, set the following to the interval in seconds that you
# want the block list updated. The list is reasonably static during the length
# of a day, so it would be appropriate to only update once every 24 hours, so
# a value of "86400" is recommended
LF_SPAMHAUS = 86400
# The Spamhaus DROP List URL. If you change this to something else be sure it
# is in the same format as the drop list
LF_SPAMHAUS_URL = http://www.spamhaus.org/drop/drop.lasso
# Enable IP range blocking using the BOGON List at
# http://www.cymru.com/Bogons/
# To enable this feature, set the following to the interval in seconds that you
# want the block list updated. The list is reasonably static during the length
# of a day, so it would be appropriate to only update once every 24 hours, so
# a value of "86400" is recommended
#
# Do NOT use this option if your server uses IP's on the bogon list (e.g. this
# is often the case with servers behind a NAT firewall using ip routing)
LF_BOGON = 0
# The BOGON List URL. If you change this to something else be sure it
# is in the same format as the drop list
LF_BOGON_URL = http://www.cymru.com/Documents/bogon-bn-agg.txt
# Connection Tracking. This option enables tracking of all connections from IP
# addresses to the server. If the total number of connections is greater than
# this value then the offending IP address is blocked. This can be used to help
# prevent some types of DOS attack.
#
# Care should be taken with this option. It's entirely possible that you will
# see false-positives. Some protocols can be connection hungry, e.g. FTP, IMAPD
# and HTTP so it could be quite easy to trigger, especially with a lot of
# closed connections in TIME_WAIT. However, for a server that is prone to DOS
# attacks this may be very useful. A reasonable setting for this option might
# be arround 200.
#
# To disable this feature, set this to 0
CT_LIMIT = 300
# Connection Tracking interval. Set this to the the number of seconds between
# connection tracking scans. Don't set this too low or you will affect server
# performance as lfd runs netstat each time to determine the connections
CT_INTERVAL = 60
# Send an email alert if an IP address is blocked due to connection tracking
CT_EMAIL_ALERT = 1
# If you want to make IP blocks permanent then set this to 1, otherwise blocks
# will be temporary and will be cleared periodically or whenever the firewall
# is restarted
CT_PERMANENT = 1
# If you opt for temporary IP blocks for CT, then the following is the interval
# in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins)
CT_BLOCK_TIME = 1800
# If you don't want to count the TIME_WAIT state against the connection count
# then set the following to "1"
CT_SKIP_TIME_WAIT = 0
# If you only want to ount specific states (e.g. SYN_RECV) then add the states
# to the following as a comma separated list. E.g. "SYN_RECV,TIME_WAIT"
#
# Leave this option empty to count all states against CT_LIMIT
CT_STATES =
# Process Tracking. This option enables tracking of user and nobody processes
# and examines them for suspicious executables or open network ports. Its
# purpose is to identify potential exploit processes that are running on the
# server, even if they are obfuscated to appear as system services. If a
# suspicious process is found an alert email is sent with relevant information.
# It is then the responsibility of the recipient to investigate the process
# further as the script takes no further action. Processes (PIDs) are only
# reported once unless lfd is restarted.
#
# The following is the number of seconds a process has to be active before it
# is inspected. If you set this time too low, then you will likely trigger
# false-positives with CGI or PHP scripts.
# Set the value to 0 to disable this feature
PT_LIMIT = 30
# How frequently processes are checked in seconds
PT_INTERVAL = 60
# If you want process tracking to highlight php or perl scripts that are run
# through apache for greater than PT_LIMIT seconds then disable the following,
# i.e. set it to 0
#
# While enabling this setting will reduce false-positives, having it set to 0
# does provide better checking for exploits running on the server
PT_SKIP_HTTP = 0
# User Process Tracking. This option enables the tracking of the number of
# process any given cPanel account is running at one time. If the number of
# processes exceeds the value of the following setting an email alert is sent
# with details of those processes. A user is only reported once, so lfd must be
# restarted to reinstate checking of all users. If you specify a user in
# csf.pignore it will be ignored
#
# Set to 0 to disable this feature
PT_USERPROC = 0
# This User Process Tracking option sends an alert if any cPanel user process
# exceeds the memory usage set (MB). To ignore specific processes or users use
# csf.pignore
#
# Set PT_USERKILL to have lfd kill off the process
#
# Set to 0 to disable this feature
PT_USERMEM = 100
# This User Process Tracking option sends an alert if any cPanel user process
# exceeds the time usage set (seconds). To ignore specific processes or users
# use csf.pignore
#
# Set PT_USERKILL to have lfd kill off the process
#
# Set to 0 to disable this feature
PT_USERTIME = 1800
# If this option is set then processes detected by PT_USERMEM or PT_USERTIME
# or PT_USERPROC are killed
PT_USERKILL = 0
# Check the PT_LOAD_AVG minute Load Average (can be set to 1 5 or 15 and
# defaults to 5 if set otherwise) on the server every PT_LOAD seconds. If the
# load average is greater than or equal to PT_LOAD_LEVEL then an email alert is
# sent. lfd then does not report subsequent high load until PT_LOAD_SKIP
# seconds has passed to prevent email floods.
#
# Set PT_LOAD to "0" to disable this feature
PT_LOAD = 30
PT_LOAD_AVG = 5
PT_LOAD_LEVEL = 6
PT_LOAD_SKIP = 3600
# Port Scan Tracking. This feature tracks port blocks logged by iptables to
# syslog. If an IP address generates a port block that is logged more than
# PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked.
#
# This feature could, for example, be useful for blocking hackers attempting
# to access the standard SSH port if you have moved it to a port other than 22
# and have removed 22 from the TCP_IN list so that connection attempts to the
# old port are being logged
#
# Note: This feature will only track iptables blocks from the log file set in
# IPTABLES_LOG below and if you have DROP_LOGGING enabled
#
# Warning: It's possible that an elaborate DDOS (i.e. from multiple IP's)
# could very quickly fill the iptables rule chains and cause a DOS in itself.
# The DENY_IP_LIMIT should help to mitigate such problems with permanent blocks
#
# Set PS_INTERVAL to "0" to disable this feature. A value of between 60 and 300
# would be sensible to enable this feature
PS_INTERVAL = 300
PS_LIMIT = 5
# You can specify the ports and/or port ranges that should be tracked by the
# Port Scan Tracking feature. The following setting is a comma separated list
# of those ports and uses the same format as TCP_IN. The default setting of
# 0:65535 covers all ports
PS_PORTS = 0:65535
# You can select whether IP blocks for Port Scan Tracking should be temporary
# or permanent. Set PS_PERMANENT to "0" for temporary and "1" for permanent
# blocking. If set to "0" PS_BLOCK_TIME is the amount of time in seconds to
# temporarily block the IP address for
PS_PERMANENT = 0
PS_BLOCK_TIME = 3600
# Set the following to "1" to enable Port Scan Tracking email alerts, set to
# "0" to disable them
PS_EMAIL_ALERT = 1
# BETA Option 001
# This option will check for outgoing connections to port 25, excluding root,
# exim and mailman. The purpose of the feature is to log SMTP connections if
# you believe you have a spammer on the server who is bypassing exim to send
# out spam emails - this is traditionally a very difficult form of spam to
# track down. The option currently logs relevant process information to lfd.log
# to avoid an email alert flood.
#
# Because of the need to run this option frequently, it will consume server
# resources while enabled. For this reason, you should only use it if you know
# you have such a spamming problem. Since such connections are transitory in
# nature, the setting (in seconds) needs to be frequent, e.g. 5 or 10 seconds.
# If you find this too much of a load burden, then you can of course adjust the
# scanning interval, but the longer it is, the less likely it will pick up the
# outgoing connections.
#
# To disable this option, set it to 0. To enable it, set it to the scanning
# interval (in seconds)
PT_SMTP = 0
# OS settings
IPTABLES = /sbin/iptables
MODPROBE = /sbin/modprobe
IFCONFIG = /sbin/ifconfig
SENDMAIL = /usr/sbin/sendmail
NETSTAT = /bin/netstat
PS = /bin/ps
FUSER = /sbin/fuser
VMSTAT = /usr/bin/vmstat
LS = /bin/ls
MD5SUM = /usr/bin/md5sum
TAR = /bin/tar
CHATTR = /usr/bin/chattr
# Log files
HTACCESS_LOG = /usr/local/apache/logs/error_log
MODSEC_LOG = /usr/local/apache/logs/error_log
SSHD_LOG = /var/log/secure
SU_LOG = /var/log/secure
FTPD_LOG = /var/log/messages
SMTPAUTH_LOG = /var/log/exim_mainlog
SMTPRELAY_LOG = /var/log/exim_mainlog
POP3D_LOG = /var/log/maillog
IMAPD_LOG = /var/log/maillog
CPANEL_LOG = /usr/local/cpanel/logs/login_log
SCRIPT_LOG = /var/log/exim_mainlog
IPTABLES_LOG = /var/log/messagesShoutcastı engelleyen, yayını Radyoya bağlanmayı engelleyen ne olabilir acaba, port yazılı ve açık normalde TCP_IN 'de 2005 olarak. Başka ne gibi bişey yapmak lazım acaba?
