How to Install CSF on Ubuntu

CSF stands for “ConfigServer Security & Firewall,” which is a popular firewall management tool and intrusion detection system (IDS) designed for Linux servers. It provides an interface for managing and configuring iptables, the default firewall management tool for Linux. CSF aims to enhance server security by implementing advanced firewall rules, intrusion detection capabilities, and various security-related features.

Key features of CSF include:

1. Firewall Management: CSF simplifies the management of iptables rules by providing a user-friendly interface for adding, removing, and modifying firewall rules. This allows server administrators to control network traffic and filter out unwanted or malicious connections.
2. Intrusion Detection System (IDS): CSF includes an IDS module that monitors system log files for suspicious activities and attempts to detect unauthorized access or potential security breaches. It can automatically block IP addresses that exhibit suspicious behavior.
3. Connection Tracking: CSF tracks active connections to the server and can block IP addresses that exceed specified connection limits, preventing excessive resource usage and potential denial-of-service attacks.
4. Advanced Filtering: CSF offers advanced filtering options, including support for port-based and protocol-based filtering, as well as the ability to create custom rules for specific applications or services.
5. Brute Force Protection: The firewall can be configured to detect and block repeated failed login attempts, protecting against brute-force attacks targeting services such as SSH, FTP, and cPanel.
6. Logging and Reporting: CSF logs various events and activities, making it easier for administrators to monitor and analyze network traffic and security-related incidents. It can generate reports on blocked IP addresses, detected intrusion attempts, and more.
7. Email Notifications: The tool can send email notifications to administrators when certain events occur, such as when an IP address is blocked, an intrusion is detected, or firewall rules are modified.
8. IP Whitelisting and Blacklisting: Administrators can maintain lists of trusted and blocked IP addresses, allowing fine-grained control over access to the server.

CSF is widely used in the web hosting industry and by system administrators to enhance the security of their Linux servers. It provides an additional layer of protection by adding features and functionality on top of the existing iptables firewall. However, it’s important to configure and use CSF correctly to avoid accidentally blocking legitimate traffic or causing disruptions to server operations.

Step 1: Remove UFW

 apt remove ufw

Step 2: Update your system

sudo apt update
sudo apt upgrade

Step 3: Download and Install CSF

Download CSF using curl:

sudo curl -L https://download.configserver.com/csf.tgz -o csf.tgz

Extract the downloaded archive:

sudo tar -xzf csf.tgz

Change to the CSF directory:

cd csf

Run the installation script:

sudo sh install.sh

The installation script will perform some checks and install the necessary files.

Verify the status of CSF after the installation is complete:

perl /usr/local/csf/bin/csftest.pl

Step 4: Configure CSF

The CSF runs in TEST mode by default. To disable it, edit /etc/csf/csf.conf

nano /etc/csf/csf.conf

Locate the line TESTING = 1 and change the value to 0.

TESTING = "0"

Locate the line RESTRICT_SYSLOG = 0 and change its value to 3. This means only members of the RESTRICT_SYSLOG_GROUP can access the syslog/rsyslog files. To do this, use the following command:

RESTRICT_SYSLOG = "3"

Stop and reload the CSF using the ra option.

csf -ra