I found the problem!! In SMTPAUTH_LOG I had /var/log/maillog! It wasn’t .log, now I’m logged in normally!
May 24 15:08:11 cp lfd[3128]: (smtpauth) Failed SMTP AUTH login from 194.169.175.17 (LT/Lithuania/-): 20 in the last 3600 secs - Blocked in csf [LF_SMTPAUTH]
May 24 15:11:16 cp lfd[3479]: (smtpauth) Failed SMTP AUTH login from 194.169.175.20 (LT/Lithuania/-): 20 in the last 3600 secs - Blocked in csf [LF_SMTPAUTH]
May 24 15:11:46 cp lfd[3555]: (smtpauth) Failed SMTP AUTH login from 194.169.175.10 (LT/Lithuania/-): 20 in the last 3600 secs - Blocked in csf [LF_SMTPAUTH]
May 24 15:14:15 cp lfd[3745]: SYSLOG CHECK Failed to detect check line [deacZ2IrBU1VpbjqZwY] sent to SYSLOG
Yep I install on ubuntu. I had to change the SMTPAUTH_LOG to point tho the correct log file.
Default points to /var/log/secure, you need to edit to point to /var/log/mail.log else CSF won’t block the bad SASL logins.
May 24 16:33:28 cp lfd[4619]: (smtpauth) Failed SMTP AUTH login from 194.169.175.17 (LT/Lithuania/-): 20 in the last 3600 secs - Blocked in csf [LF_SMTPAUTH]
/var/log/syslog OR /var/log/messages:
Shows general messages and info regarding the system. Basically a data log of all activity throughout the global system. Know that everything that happens on Redhat-based systems, like CentOS or Rhel, will go in messages. Whereas for Ubuntu and other Debian systems, they go in /var/log/syslog.
/var/log/auth.log OR/var/log/secure:
Keep authentication logs for both successful or failed logins, and authentication processes. Storage depends on system type. For Debian/Ubuntu, look in /var/log/auth.log. For Redhat/CentOS, go to /var/log/secure.
What settings have I applied on my Ubuntu 22.04 with CSFirewall ?
I found SMTPAUTH_LOG should be /var/log/mail.log
I tested with auth.log but it did pick up any failures.
I think the failures in there are in the wrong format for CSF
Because I didn’t have the /var/log/messages file and CSF would sometimes show me the message “SYSLOG Check Failed”
I searched on Internet and I saw dozens of people who had the same problem.
One of the solutions was on my Ubuntu system to add this code without create the /var/log/messages file and change all the:
/var/log/messages ➙ /var/log/syslog
/var/log/secure ➙ /var/log/auth.log
So I did that and I think that CSF is working OK on my system. But I keep have the email from CSF that “SYSLOG Check Failed”.
Another solution was to create these files and do not change anything on CSF. But I tried and nothing better happened.
But, both ways CSF works amazingly on my server.
I would suggest you not to make radical changes and if you don’t have the messages file and the secure file, then just change the CSF settings, as I have done on my previous post on CSF settings, or create the message and secure files with the following commands:
touch /var/log/messages
touch /var/log/secure
In the end I am not an expert. I am a simple user and every server have different requirements
Now I have changed some settings as per suggestion of stefan1959 and CSF keep working exactly excellent as before.
