AWS Monster | Your Technical Partner

Getting CSF Firewall error after CSF Updating . From 2019-12-29, MaxMind REQUIRES you to create an account on their site and to generate a license key to use their databases. Run the following Command: # csf -ra Error Country Code Lookups setting MM_LICENSE_KEY must be set in /etc/csf/csf.conf to continue using the MaxMind databases You MUST set the following to continue using the IP lookup features of csf, otherwise an error will be generated and the features will not work. Visit the following website to create new account (https://www.maxmind.com/en/geolite2/signup) and update your billing address and issue your Licence key for CSF firewall. Now Edit your CSF configuration file & use your Key. # vi /etc/csf/csf.conf MM_LICENSE_KEY = "your licence key" CC_SRC = 1 See: https://blog.configserver.com/?p=3216 https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/

Country-level filtering in CSF uses the Maxmind GeoLite Country database to obtain CIDR (Classless Inter-Domain Routing) ranges for specific countries. Each CIDR range covers all the IP addresses assigned to that country. There are a number of reasons why a server administrator may wish to block traffic from a specific country, with reducing bandwidth, minimizing exposure to security risks, and ensuring that a site’s content is viewable only in geographic locations where it is permitted among the most common. However, there are several important factors to consider before choosing to filter traffic at the country level: A small percentage of unwanted traffic still may get through, and a small percentage of desired traffic could be blocked, because: the CIDR range lists used for country-level blocks are not 100 percent accurate. some Internet Service Providers and web services use non-geographic IP addresses for their clients. proxy services and virtual private networks can be us

CSF – How to limit the number of connections per IP address (Rate Limit Incoming Traffic By CSF Connection Tracking): The first thing that can be done to mitigate the effects of an incoming attack is to limit the number of connections per IP address. When properly configured, CSF will track the number of connections from IP address hitting the server and block IP addresses at the firewall level should they exceed a defined limit. It’s important not to set the limit too low, as protocols such as FTP, IMAP, and even HTTP all legitimately make multiple connections. Also, remember that most companies as well as homes and public hotspots may have many different computers on their internal network which all share a single public IP address. To set the limit on connections per IP address, scroll down to the Connection Tracking section of the Firewall Configuration page and set CT_LIMIT to the desired value. 1. If you want use 150 connections per IP address as an upper limit. You m

By Default CWP server comes with Postfix + Dovecot + AntiSpam Solutions. We need to do some modifications on Postfix + Dovecot , for better security and high performance. In this series tutorials , We will learn how to build Postfix + Dovecot with AntiSpam Solutions . Build CWP Mail Server 1. At first, We must have a valid FQDN with DNS Records (A & PTR). To generate new FQDN , Go to Server Settings >> Change Hostname . We will 2048 key Size which is default or you can use 4096 key Size which is slower than 2048 key Size . 2. Build Postfix mail Server with AntiSpam/AntiVirus and  DKIM & SPF . Go to Email >> Mail Server Manager . Provide the FQDN and Domain then click on "Rebuild Mail Server" 3. Enable SPF & DKIM for parent Domain: Go to Email >> DKIM Manager  Check also below the directory:    TruestedHosts File Location: /etc/opendkim/TrustedHosts    SigningTable File Location: /etc/opendkim/SigningTable    KeyTable File L

Some mail clients will use a system called "Autodiscover" to figure out which settings to use for the pop/imap/smtp settings. You can set this up if you'd like, it basically requires a subdomain and a SRV record. You can add the SRV record into any domain you want to use these settings for. If you've got a global SSL certificate in Postfix/dovecot for your hostname, this would be a good way to ensure clients use the correct value, so they don't get SSL certificate errors. Let's assume you're going to have your clients with datahead.biz  connect to host.datahead.biz for both IMAP and SMTP. So we have a subdomain called host.datahead.biz to store the XML, where  host.datahead.biz is a Server FQDN .  1. Setup a SRV record in the datahead.biz DNS zone: _autodiscover._tcp.datahead.biz. 3600 IN SRV 10 10 443 host.datahead.biz. 2. Next, Creat a file named autodiscover.php on  /usr/local/apache/htdocs/ # vi /usr/local/apache/htdocs/autodiscover.php N

Postfix architecture is modular and contains different daemons each specifically handling only a few tasks. The most important daemons are the following: master is the main daemon that starts all the other daemons. smtpd is the SMTP server daemon handling incoming connections to receive emails from another mail server or client. smtp is the SMTP client handling outgoing connections to send email out to another mail server. local is the local delivery agent responsible for delivering email to the local server. qmgr processes and controls all messages in the mail queue. Maps are used in postfix to control email routing. Such maps are used to accept or reject email, inform postfix about local recipients and more. The main configuration files are main.cf which is the global configuration for all daemons and the master.cf which defines the runtime environment for the daemons. The master.cf configuration thereby overrides the configuration options from the main.cf. Lets Secure

By Default CWP Server is using Modified Nginx server which is called CWP server and It is used for Admin, Client & Webmail Panel Login. I am also using Let's Encrypt SSL for my CWP Admin, Client & Webmail Panel . Follow This Article : ( Part 1) CWP: How to Configure Let's Encrypt SSL Certificate for your server Hostname/FQDN on CWP7.admin N.B: I am using the below cipherlist https://cipherli.st/ https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://wiki.mozilla.org/Security/Server_Side_TLS https://ssl-config.mozilla.org/#server=apache&server-version=2.4.39&config=intermediate&openssl-version=1.0.2k-fips https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options https://ssldecoder.org/ CWP Admin Panel Link (by hostname) CWP Admin Panel Link: http://server1.datahead.biz:2030 CWP Admin Panel Link: http://server1.datahead.biz:2086 CWP Admin Panel SSL Link: https://server1.datahead.biz:2031 CWP Admin Panel SSL Link: