[HOWTO] Install CSF + Use it's GUI in VestaCP

[SS88]

Did not work.

Of sorry, that was for vsftpd. Can you show me the logs of Proftpd which show the login errors and I can make a regular expression to match the ip address.

See my /var/log/proftpd/proftpd.log

2017-05-10 16:16:36,926 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:37,351 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:39,719 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:16:45,316 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:45,770 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:48,695 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:16:53,935 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:54,347 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:57,455 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:17:51,363 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:17:51,805 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:17:55,304 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:05,902 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:08,694 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:09,591 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:14,167 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:16,702 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:17,136 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:22,371 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:24,977 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:25,183 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.

Which one is the users IP address?

[ServerHost]

Of sorry, that was for vsftpd. Can you show me the logs of Proftpd which show the login errors and I can make a regular expression to match the ip address.

See my /var/log/proftpd/proftpd.log

2017-05-10 16:16:36,926 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:37,351 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:39,719 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:16:45,316 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:45,770 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:48,695 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:16:53,935 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:54,347 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:57,455 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:17:51,363 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:17:51,805 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:17:55,304 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:05,902 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:08,694 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:09,591 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:14,167 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:16,702 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:17,136 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:22,371 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:24,977 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:25,183 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.

Which one is the users IP address?

200.105.xxx.xxx = 200.105.57.142

[SS88]

See my /var/log/proftpd/proftpd.log

2017-05-10 16:16:36,926 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:37,351 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:39,719 server.domain.com proftpd[30716] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:16:45,316 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:45,770 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:48,695 server.domain.com proftpd[30717] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:16:53,935 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:16:54,347 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:16:57,455 server.domain.com proftpd[30719] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:17:51,363 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:17:51,805 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER user: no such user found from 200.105.xxx.xxx [200.105.xxx.xxx] to ::ffff:192.98.xxx.xxx:21
2017-05-10 16:17:55,304 server.domain.com proftpd[30727] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:05,902 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:08,694 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:09,591 server.domain.com proftpd[30728] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:14,167 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:16,702 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:17,136 server.domain.com proftpd[30729] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.
2017-05-10 16:18:22,371 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session opened.
2017-05-10 16:18:24,977 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): USER admin (Login failed): Incorrect password
2017-05-10 16:18:25,183 server.domain.com proftpd[30734] 192.98.xxx.xxx (200.105.xxx.xxx[200.105.xxx.xxx]): FTP session closed.

Which one is the users IP address?

200.105.xxx.xxx = 200.105.57.142

Assuming the IP address is in the brackets [] this should work:

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ \[(\S+)\]\).*\(Login failed\))) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

[ServerHost]

Which one is the users IP address?

200.105.xxx.xxx = 200.105.57.142

Assuming the IP address is in the brackets [] this should work:

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ \[(\S+)\]\).*\(Login failed\))) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

LDF down

May 10 17:52:21 server.domain.com lfd[3769]: (Missing operator before \?)
May 10 17:52:21 server.domain.com lfd[3769]: syntax error at /usr/local/csf/bin/regex.custom.pm line 37, near "+)"
May 10 17:52:21 server.domain.com lfd[3769]: syntax error at /usr/local/csf/bin/regex.custom.pm line 47, near "}"
May 10 17:52:21 server.domain.com lfd[3769]: Compilation failed in require at /usr/local/csf/lib/ConfigServer/RegexMain.pm line 50.
May 10 17:52:21 server.domain.com lfd[3769]: Compilation failed in require at /usr/sbin/lfd line 26.
May 10 17:52:21 server.domain.com lfd[3769]: BEGIN failed--compilation aborted at /usr/sbin/lfd line 26.
May 10 17:52:21 server.domain.com systemd[1]: lfd.service: control process exited, code=exited status=255
May 10 17:52:21 server.domain.com systemd[1]: Failed to start ConfigServer Firewall & Security - lfd.
May 10 17:52:21 server.domain.com systemd[1]: Unit lfd.service entered failed state.
May 10 17:52:21 server.domain.com systemd[1]: lfd.service failed.

[SS88]

200.105.xxx.xxx = 200.105.57.142

Assuming the IP address is in the brackets [] this should work:

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ \[(\S+)\]\).*\(Login failed\))) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

LDF down

May 10 17:52:21 server.domain.com lfd[3769]: (Missing operator before \?)
May 10 17:52:21 server.domain.com lfd[3769]: syntax error at /usr/local/csf/bin/regex.custom.pm line 37, near "+)"
May 10 17:52:21 server.domain.com lfd[3769]: syntax error at /usr/local/csf/bin/regex.custom.pm line 47, near "}"
May 10 17:52:21 server.domain.com lfd[3769]: Compilation failed in require at /usr/local/csf/lib/ConfigServer/RegexMain.pm line 50.
May 10 17:52:21 server.domain.com lfd[3769]: Compilation failed in require at /usr/sbin/lfd line 26.
May 10 17:52:21 server.domain.com lfd[3769]: BEGIN failed--compilation aborted at /usr/sbin/lfd line 26.
May 10 17:52:21 server.domain.com systemd[1]: lfd.service: control process exited, code=exited status=255
May 10 17:52:21 server.domain.com systemd[1]: Failed to start ConfigServer Firewall & Security - lfd.
May 10 17:52:21 server.domain.com systemd[1]: Unit lfd.service entered failed state.
May 10 17:52:21 server.domain.com systemd[1]: lfd.service failed.

Sorry, forgot the / and /

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ /\[(\S+)\]\).*\(Login failed\)/)) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

[ServerHost]

Assuming the IP address is in the brackets [] this should work:

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ \[(\S+)\]\).*\(Login failed\))) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

LDF down

May 10 17:52:21 server.domain.com lfd[3769]: (Missing operator before \?)
May 10 17:52:21 server.domain.com lfd[3769]: syntax error at /usr/local/csf/bin/regex.custom.pm line 37, near "+)"
May 10 17:52:21 server.domain.com lfd[3769]: syntax error at /usr/local/csf/bin/regex.custom.pm line 47, near "}"
May 10 17:52:21 server.domain.com lfd[3769]: Compilation failed in require at /usr/local/csf/lib/ConfigServer/RegexMain.pm line 50.
May 10 17:52:21 server.domain.com lfd[3769]: Compilation failed in require at /usr/sbin/lfd line 26.
May 10 17:52:21 server.domain.com lfd[3769]: BEGIN failed--compilation aborted at /usr/sbin/lfd line 26.
May 10 17:52:21 server.domain.com systemd[1]: lfd.service: control process exited, code=exited status=255
May 10 17:52:21 server.domain.com systemd[1]: Failed to start ConfigServer Firewall & Security - lfd.
May 10 17:52:21 server.domain.com systemd[1]: Unit lfd.service entered failed state.
May 10 17:52:21 server.domain.com systemd[1]: lfd.service failed.

Sorry, forgot the / and /

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ /\[(\S+)\]\).*\(Login failed\)/)) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

Thank you friend
Now it worked! :)

Two questions:

1- How to block if the user is wrong? Because it is only blocking if the password is wrong.
2- How to limit the number of attempts according to the configuration in LF_FTPD?

[SS88]

LDF down

May 10 17:52:21 server.domain.com lfd[3769]: (Missing operator before \?)
May 10 17:52:21 server.domain.com lfd[3769]: syntax error at /usr/local/csf/bin/regex.custom.pm line 37, near "+)"
May 10 17:52:21 server.domain.com lfd[3769]: syntax error at /usr/local/csf/bin/regex.custom.pm line 47, near "}"
May 10 17:52:21 server.domain.com lfd[3769]: Compilation failed in require at /usr/local/csf/lib/ConfigServer/RegexMain.pm line 50.
May 10 17:52:21 server.domain.com lfd[3769]: Compilation failed in require at /usr/sbin/lfd line 26.
May 10 17:52:21 server.domain.com lfd[3769]: BEGIN failed--compilation aborted at /usr/sbin/lfd line 26.
May 10 17:52:21 server.domain.com systemd[1]: lfd.service: control process exited, code=exited status=255
May 10 17:52:21 server.domain.com systemd[1]: Failed to start ConfigServer Firewall & Security - lfd.
May 10 17:52:21 server.domain.com systemd[1]: Unit lfd.service entered failed state.
May 10 17:52:21 server.domain.com systemd[1]: lfd.service failed.

Sorry, forgot the / and /

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ /\[(\S+)\]\).*\(Login failed\)/)) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

Thank you friend
Now it worked! :)

Two questions:

1- How to block if the user is wrong? Because it is only blocking if the password is wrong.
2- How to limit the number of attempts according to the configuration in LF_FTPD?

This one for "no such user":

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ /\[(\S+)\]\).*USER user: no such user found/)) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

Change option in csf.conf

Enable login failure detection of ftp connections

SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
this file about RESTRICT_SYSLOG before enabling this option:

LF_FTPD = 20
LF_FTPD_PERM = 1

Means 20 login failures = permanent ban.

[ServerHost]

Sorry, forgot the / and /

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ /\[(\S+)\]\).*\(Login failed\)/)) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

Thank you friend
Now it worked! :)

Two questions:

1- How to block if the user is wrong? Because it is only blocking if the password is wrong.
2- How to limit the number of attempts according to the configuration in LF_FTPD?

This one for "no such user":

Code: Select all

if (($lgfile eq $config{FTPD_LOG}) and ($line =~ /\[(\S+)\]\).*USER user: no such user found/)) { return ("Failed FTP login from",$1,"proftpd_ss88","5","20,21","1"); }

Change option in csf.conf

Enable login failure detection of ftp connections

SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
this file about RESTRICT_SYSLOG before enabling this option:

LF_FTPD = 20
LF_FTPD_PERM = 1

Means 20 login failures = permanent ban.

I changed "5" to ($ config {LF_FTPD}) and it worked! :)

Thank you again for you help. Good Job!

[amitz]

Helllo,

I do get this error installing it on debian 8 vps

Install VestaCP Front...
converted 'https://vestacp.ss88.uk/Install_CSF_on_VestaCP/csf.zip' (ANSI_X3.4-1968) -> 'https://vestacp.ss88.uk/Install_CSF_on_VestaCP/csf.zip' (UTF-8)
--2017-05-12 09:23:44-- https://vestacp.ss88.uk/Install_CSF_on_VestaCP/csf.zip
Resolving vestacp.ss88.uk (vestacp.ss88.uk)... 185.122.57.134
Connecting to vestacp.ss88.uk (vestacp.ss88.uk)|185.122.57.134|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 428388 (418K) [application/zip]
Saving to: 'csf.zip'

csf.zip 100%[=====================>] 418.35K 630KB/s in 0.7s

2017-05-12 09:23:45 (630 KB/s) - 'csf.zip' saved [428388/428388]

./Install.sh: line 44: unzip: command not found

[SS88]

Helllo,

I do get this error installing it on debian 8 vps

Install VestaCP Front...
converted 'https://vestacp.ss88.uk/Install_CSF_on_VestaCP/csf.zip' (ANSI_X3.4-1968) -> 'https://vestacp.ss88.uk/Install_CSF_on_VestaCP/csf.zip' (UTF-8)
--2017-05-12 09:23:44-- https://vestacp.ss88.uk/Install_CSF_on_VestaCP/csf.zip
Resolving vestacp.ss88.uk (vestacp.ss88.uk)... 185.122.57.134
Connecting to vestacp.ss88.uk (vestacp.ss88.uk)|185.122.57.134|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 428388 (418K) [application/zip]
Saving to: 'csf.zip'

csf.zip 100%[=====================>] 418.35K 630KB/s in 0.7s

2017-05-12 09:23:45 (630 KB/s) - 'csf.zip' saved [428388/428388]

./Install.sh: line 44: unzip: command not found

You do not have unzip installed, try running this:

Code: Select all

apt-get install unzip

And run the installer again