What CSF does

CSF (ConfigServer Security & Firewall) is a firewall front end for iptables, with a login failure daemon called lfd. Together they:

• Open only the ports you list, and block everything else.
• Block IP addresses that fail too many logins to SSH, cPanel, email or FTP.
• Alert you by email about suspicious logins, processes and file changes.
• Block whole countries, if you choose to.
• Add a WHM plugin for managing the firewall from the browser.

Before you install

• ✓ Root access to a VPS or dedicated server running AlmaLinux, Rocky Linux, CloudLinux, Debian or Ubuntu.
• ✓ Console access (VNC or KVM) in case a rule blocks SSH.
• ✓ Your own public IP address. Search “what is my IP” from your computer.
• ✓ Only one firewall manager. Turn off firewalld or ufw before you start CSF.

Step 1: install the dependencies

# AlmaLinux, Rocky Linux, CloudLinux
dnf install -y wget tar perl perl-libwww-perl perl-LWP-Protocol-https perl-GDGraph ipset
systemctl disable --now firewalld 2>/dev/null

# Debian and Ubuntu
apt install -y wget tar perl libwww-perl liblwp-protocol-https-perl libgd-graph-perl iptables ipset
ufw disable 2>/dev/null

Step 2: download and install CSF

cd /usr/src
wget https://backup.underhost.com/mirror/configserver/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

# Check that the required Perl modules and iptables features are present
perl /usr/local/csf/bin/csftest.pl

csftest.pl should end with “RESULT: csf should function on this server”. CSF installs in test mode, where its rules are cleared automatically every few minutes, so a mistake cannot lock you out for long.

Already running an older CSF? The mirror also has a migration script that backs up your settings, installs v15.00 and restores them. Try it first with --dry-run. See the mirror page for the commands.

Step 3: allow your own IP address

csf -a YOUR.PUBLIC.IP.ADDRESS "my office"

Addresses in the allow list are never blocked by lfd. Add every fixed IP address you or your team use.

Step 4: check the open ports

Open /etc/csf/csf.conf, or WHM’s Firewall Configuration page, and review these settings:

If you moved SSH to another port, make sure that port is in TCP_IN, and remove 22 only after you have tested the new port.

Step 5: turn off test mode

1. Set TESTING = "0" in csf.conf, or untick Testing in WHM, and save.
2. Restart CSF and lfd with csf -ra.
3. Open a new SSH session and log in. Keep the old session open until this works.

Everyday commands

If you lock yourself out

1. Log in through your provider’s console.
2. Run csf -g YOUR.IP to see why you are blocked.
3. Remove the block with csf -dr YOUR.IP and add yourself with csf -a YOUR.IP.
4. If nothing else works, run csf -x to turn the firewall off, fix the setting, then csf -e.

Good practice

• ✓ Use SSH keys and turn off SSH password logins. CSF limits guessing, keys stop it.
• ✓ Keep the allow list short and up to date.
• ✓ Read the lfd alert emails, and act on repeated login failures.
• ✓ If you use Cloudflare, add Cloudflare’s IP ranges to the allow list so visitors are never blocked through it.
• ✓ Add a malware scanner such as Linux Malware Detect.