ConfigServer Security & Firewall - anyone familiar with the settings?

[tehbasmentdwell]

We've been having issues with dos/ddos attacks on our forum for a while now - last night i decided to do a bit of tinkering with CSF and i've made a bit of a boo boo

I ran the "Check server security" command then started to go through all the 'warning' messages one at a time, altering the relevant settings to fix the warning.

Everything seemed ok at first but a bit later i discovered that our main forum page (the page you get first if you google our site) is just showing as a blank page

http://tehbasement.com/ just gives you a blank page

http://tehbasement.com/forum/ takes you to the cloudflare smarterrors page

Only http://tehbasement.com/forum.php takes you to our forum now.


Anyone know which setting i've changed that has caused this? I'm a relative noob at this stuff, just trying to beef up security and it's gone a bit awry

Thanks in advance for any help! Goofy.

[snakes1100]

Sorry, trying to guess at which one of your changes caused it is basically a guessing game.

Did you check your error_log for apache/nginx/etc?

Id also check your syslog or messages log.

[tehbasmentdwell]

Originally Posted by snakes1100

Sorry, trying to guess at which one of your changes caused it is basically a guessing game.

Did you check your error_log for apache/nginx/etc?

Id also check your syslog or messages log.

Checked the error log through cpanel - here's a couple of the latest errors:

[Tue May 14 19:42:18 2013] [error] [client xxx.xxx.xx.xx] File does not exist: /home/tehbasem/public_html/404.shtml, referer: https://vborg.vbsupport.ru/showthread.php?p=2422041
[Tue May 14 19:42:18 2013] [error] [client xxx.xxx.xx.xx] File does not exist: /home/tehbasem/public_html/forum, referer: https://vborg.vbsupport.ru/showthread.php?p=2422041

(ip address edited to protect the innocent, possibly yourself )

Is this any help? Are there other logs i should check for more info? (i'm a tech n00b) Thanks.

[snakes1100]

As i said, would be rather hard to guess, the error log results dont help.

Did you do anything related to suPHP or disable_functions?

[tehbasmentdwell]

Originally Posted by snakes1100

Did you do anything related to suPHP or disable_functions?

Not that i can think of mate.

Would an htaccess file redirect work? ie set it up the .htaccess file to redirect both http://tehbasement.com/ and http://tehbasement.com/forum/ to http://tehbasement.com/forum.php?

[snakes1100]

Yes you can simply redirect it with a htaccess redirect, but that isnt going to fix the real issue.

enable display_errors in php.ini & restart apache

[ForceHSS]

As you said u are a noob at this so before you break something else give your host a call tell them what you did and get them to fix it