ConfigServer Security and Firewall

ConfigServer Security and Firewall

ConfigServer Security and Firewall

Supported and Tested Operating Systems
RedHat Enterprise v3 to v7 *openSUSE v10, v11, v12
CentOS v3 to v7 *Debian v3.1 – v8
CloudLinux v5 to v7 *Ubuntu v6 to v15
Fedora v1 to v22 *Slackware v12

(* may require custom regex patterns for some functions)

Supported and Tested Virtual Servers
**Virtuozzo **OpenVZ
VMware UML
Xen MS Virtual Server
VirtualBox KVM

CSF (ConfigServer Filewall) is an free script iptables firewall. Its installation is very simple and straightforward. CSF supports most of common used Linux operting systems like Red Hat Enterprise Linux, CentOS, CloudLinux, Fedora, openSUSE, Debian, Ubuntu & Slackware.

Follow the below steps to install CSF firewall in your Linux operating system.

LFD stands for Login Failure Daemon. Its an process that actively monitors the log file for user login entries and send the alerts to admin on basis of configured rules.

Step 1: Download CSF Source Archive

Download latest CSF archive source code from its official site and extract on your Linux box. Then extract source code.

$ cd /opt
$ wget
$ tar -xvf csf.tgz

Step 2: Install CSF

CSF provides and bash script to easily install it on any operating system. This script automatically detect your operating system and install CSF accordingly. Run script.

$ cd /opt/csf
$ sh

Step 3: Test iptables modules

Run the perl script to verify if all the required iptables modules are installed on your system to make is proper working.

$ perl /usr/local/csf/bin/
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing ipt_recent...OK
Testing xt_connlimit...OK
Testing ipt_owner/xt_owner...OK
Testing iptable_nat/ipt_REDIRECT...OK
Testing iptable_nat/ipt_DNAT...OK

RESULT: csf should function on this server

Step 4: Enable and Restart CSF

After successfully installing CSF on your system, You need to change following setting in csf.conf to enable CSF.

$ nano /etc/csf/csf.conf


Now restart CSF firewall to reload new changes using following command.

$ cd /etc/csf
$ csf -r

Prevent DDOS Attacks

Configure CSF+LDF to prevent server from DDOS attacks. To enable it edit /etc/csf/csf.conf and update following settings.

  • Total number of connections allowed from single host. To disable this feature, set this to 0
    CT_LIMIT = "20"
  • Connection Tracking interval in seconds.
    CT_INTERVAL = "30"
  • Sent email alerts for each blocked ip.
  • Set this to 1 to block ips permanent.
  • If you opt for temporary IP blocks for CT, then the following is the interval
    in seconds that the IP will remained blocked
    CT_BLOCK_TIME = 1800
  • If you only want to count specific ports (e.g. 22,23,80,443) then add the ports. else keep it empty to check all ports
    CT_PORTS = "22,23,80,443"

Addition Steps-:

If found warning like below-:

*WARNING* URLGET set to use LWP but perl module is not installed, reverting to HTTP::Tiny

Please install below required packages -:

$ sudo apt-get install -y libwww-perl

If found warning like below-:

*WARNING* RESTRICT_SYSLOG is disabled. See SECURITY WARNING in /etc/csf/csf.conf.

Please open csf.conf file nano /etc/csf/csf.conf


Reload the csf firewall

csf -r

Post a comment