In this article we will discuss ConfigServer Security Firewall or CSF useful commands. In this era of cyber attacks it is very important to setup a firewall to protect our servers from cyber attackers and one of the most popular Linux firewall today is CSF.
ConfigServer Security Firewall or CSF, is a Stateful Packet Inspection (SPI) firewall, Login/Intrusion Detection and Security application for Linux servers.
ConfigServer Security Firewall also comes with LFD or Login Failure Daemon service that watches users activity such us excessive login failures often called “Brute-force attacks” and suspicious process running on a certain user .
CSF has wide range of options to manage Linux firewall via comman-line and from the control panel. CSF is mostly used in Control Panels like DirectAdmin and WHM/cPanel.
1 Useful Commands:
Checking the status of CSF service
[[email protected] ~]# sudo systemctl status csf
● csf.service - ConfigServer Firewall & Security - csf
Loaded: loaded (/usr/lib/systemd/system/csf.service; enabled; vendor preset: disabled)
Active: active (exited) since Sat 2021-10-30 08:39:07 UTC; 3 weeks 5 days ago
Main PID: 20825 (code=exited, status=0/SUCCESS)
If you want to disable CSF you can run:
To enable CSF:
Allowing an IP address:
csf -a 192.168.1.1
This command will allow IP address 220.127.116.11 to access server.
Placing an IP on the temporary deny list which is in /var/lib/csf/csf.tempban
csf -td 192.168.1.1
IP address 192.168.1.1 will be placed to the temporary deny list.
To remove the IP address from temporary IP ban:
csf -tr 192.168.1.1
To deny or block the IP:
csf -d 192.168.1.1
The IP will be placed to etc/csf/csf.deny.
To unblock the IP:
csf -dr 192.168.1.1
The IP will be removed from etc/csf/csf.deny.
Displaying the current list of temporary allowed and denied IP address:
2Whitelisting an IP Address
In order to fully whitelist an IP address you need to add the IP to csf.ignore this will instruct LFD to ignore the IP , and please make sure to restart CSF after adding the IP to csf.ignore(/etc/csf/csf.ignore).