Now you should check that CSG really works on this server. Go to the "/usr/local/csf/bin/" directory, and run "csftest.pl".

cd /usr/local/csf/bin/

perl csftest.pl

If you see the test results as shown below, then CSF is running without problems on your server:

RESULT: csf should function on this server

Step 3 - Configure CSF on CentOS 7

Before stepping into the CSF configuration process, the first thing you must know is that "CentOS 7" has a default firewall application called "firewalld". You have to stop firewalld and remove it from the startup.

Stop the firewalld:

systemctl stop firewalld

Disable/Remove firewalld from the startup:

systemctl disable firewalld

Then go to the CSF Configuration directory "/etc/csf/" and edit the file "csf.conf" with the vim editor:

cd /etc/csf/

vim csf.conf

Change line 11 "TESTING " to "0" for applying the firewall configuration.

    TESTING = "1"

626 LF_ALERT_TO = "u1@worldcm.net"

633 LF_ALERT_FROM = "csf@worldcm.net"

638 LF_ALERT_SMTP = "202.202.202.1"         #set the following to a relaying SMTP server,             

By default CSF allows incoming and outgoing traffic for the SSH standard port 22, if you use a different SSH port then please add your port to the configuration in line 139 "TCP_IN".

Now start CSF and LFD with systemctl command:

systemctl start csf

systemctl start lfd

And then enable the csf and lfd services to be started at boot time:

systemctl enable csf

systemctl enable lfd

Now you can see the list default rules of CSF with command:

csf -l

WARNING: RESTRICT_SYSLOG is disabled. See SECURITY WARNING in Firewall Configuration

# vi /etc/csf/csf.conf

search for “RESTRICT_SYSLOG”. It will be like RESTRICT_SYSLOG = “0”

                                    Change it to                  RESTRICT_SYSLOG = “3”

Step 4 - Basic CSF Commands

1. Start the firewall (enable the firewall rules):

csf -s

2. Flush/Stop the firewall rules.

csf -f

3. Reload the firewall rules.

csf -f

4. Allow an IP and add it to csf.allow.

csf -a 192.168.1.109

Results:

Adding 192.168.1.109 to csf.allow and iptables ACCEPT...

ACCEPT  all opt -- in !lo out *  192.168.1.109  -> 0.0.0.0/0  

ACCEPT  all opt -- in * out !lo  0.0.0.0/0  -> 192.168.1.109

5. Remove and delete an IP from csf.allow.

csf -ar 192.168.1.109

Results:

Removing rule...

ACCEPT  all opt -- in !lo out *  192.168.1.109  -> 0.0.0.0/0  

ACCEPT  all opt -- in * out !lo  0.0.0.0/0  -> 192.168.1.109

6. Deny an IP and add to csf.deny:

csf -d 192.168.1.109

Results:

Adding 192.168.1.109 to csf.deny and iptables DROP...

DROP  all opt -- in !lo out *  192.168.1.109  -> 0.0.0.0/0  

LOGDROPOUT  all opt -- in * out !lo  0.0.0.0/0  -> 192.168.1.109

7. Remove and delete an IP from csf.deny.

csf -dr 192.168.1.109

Results:

Removing rule...

DROP  all opt -- in !lo out *  192.168.1.109  -> 0.0.0.0/0  

LOGDROPOUT  all opt -- in * out !lo  0.0.0.0/0  -> 192.168.1.109

8. Remove and Unblock all entries from csf.deny.

csf -df

Results:

DROP  all opt -- in !lo out *  192.168.1.110  -> 0.0.0.0/0  

LOGDROPOUT  all opt -- in * out !lo  0.0.0.0/0  -> 192.168.1.110  

DROP  all opt -- in !lo out *  192.168.1.111  -> 0.0.0.0/0  

LOGDROPOUT  all opt -- in * out !lo  0.0.0.0/0  -> 192.168.1.111    

csf: all entries removed from csf.deny

9. Search for a pattern match on iptables e.g : IP, CIDR, Port Number

csf -g 192.168.1.110

Step 5 - Advanced Configuration

Here are some tweaks about CSF, so you can configure as you need.

Back to the csf configuration directory, and edit the csf.conf configuration file:

cd /etc/csf/

vim csf.conf

1. Don't Block IP addresses that are in the csf.allow files.

By default lfd also will block an IP under csf.allow files, so if you want that an IP in csf.allow files never get blocked by lfd, then please go to the line 272 and change "IGNORE_ALLOW" to "1". This is useful wehn you have a static IP at home or in office and want to ensure that your IP never gets blocked by the firewall on your internet server.

IGNORE_ALLOW = "1"

2. Allow Incoming and Outgoing ICMP.

Go to the line 152 for incoming ping/ICMP:

ICMP_IN = "1"

And line 159 for outgoing ping ping/ICMP:

ICMP_OUT = "1"

3. Block Certain Countrys

CSF provide an option to allow and deny access by country using the CIDR (Country Code). Go to line 836 and add the country codes that shall be allowed and denied:

CC_DENY = "CN,UK,US"

CC_ALLOW = "ID,MY,DE"

4. Send the Su and SSH Login log by Email.

You can set an email address that is used by LFD to send an email about "SSH Login" events and users that run the "su"command, go to the line 1069 and change the value to "1".

LF_SSH_EMAIL_ALERT = "1"

...

LF_SU_EMAIL_ALERT = "1"

And then define the email address you want to use in line 588.

LF_ALERT_TO = "mymail@mydomain.tld"

# Enable syslog monitoring #

Set "SYSLOG_CHECK" to "1800"

Set "SMTP_BLOCK" to "1" in "SMTP Settings" section.

Set "LF_SCRIPT_LIMIT" to "250" to identify scripts sending out 250 emails messages in an hour.

Set "LF_SCRIPT_ALERT" to "1" to send an email alert to the system administrator when the limit 

# Detect suspicious process #

Set "PT_DELETED" to "1"    set = 0

SMTP_BLOCK = 1

SMTP_BLOCK = “0″

If SMTP_BLOCK is enabled but you want to allow local connections to port 25 on the server (e.g. for webmail or web scripts) then enable this option to allow outgoing SMTP connections to the loopback device

SMTP_ALLOWLOCAL = “1″

If SMTP_BLOCK is enabled but you want to allow local connections to port 25 on the server (e.g. for webmail or web scripts) then enable "

SMTP_ALLOWLOCAL" option to allow outgoing SMTP connections to the loopback device.

----

SMTP_ALLOWLOCAL=1

----

Step 5: Enable CSF Web UI

Use our following tutorial to enable web UI for CSF firewall on Linux system.

https://tecadmin.net/how-to-enable-csf-firewall-web-ui/

Step 6: Prevent DDOS Attacks

Configure CSF+LDF to prevent server from DDOS attacks. To enable it edit /etc/csf/csf.conf and update following settings.

Total number of connections allowed from single host. To disable this feature, set this to 0

CT_LIMIT = "20"

Connection Tracking interval in seconds.

CT_INTERVAL = "30"

Sent email alerts for each blocked ip.

CT_EMAIL_ALERT =1

Set this to 1 to block ips permanent.

CT_PERMANENT = 1

If you opt for temporary IP blocks for CT, then the following is the interval

in seconds that the IP will remained blocked

CT_BLOCK_TIME = 1800

If you only want to count specific ports (e.g. 22,23,80,443) then add the ports. else keep it empty to check all ports

CT_PORTS = "22,23,80,443"

If you want more tweaks, read the options in the "/etc/csf/csf.conf" configuration file.

Uninstalling CSF and LFD

If you want to remove CSF completely, then just use the following two commands.

cd /etc/csf

sh uninstall.sh

ConfigServer Security & Firewall installation on Webmin

-------