Last updated at Fri, 08 Dec 2017 20:17:19 GMT

Synopsis

CSF also known as Config Server Firewall is a free and open source advance firewall application suite base on iptables that provides additional security to your server. CSF comes with additional security features, such as ssh, su login detection and also recognizes a lot of different types of attack like SYN flood, port scan, DOS and brute force. CSF supports most of common used operating systems like CentOS, openSUSE, RedHat, CloudLinux, Fedora, Slackware, Ubuntu and Debian. You can easily integrate CSF with cPanel, DirectAdmin, and Webmin user interface.

CSF Provides lots of features, some of them are listed below:

  • Check and notify login authentication failures for ssh, su, pop3/imap, smtp, ftp, cPanel, password protected web pages.
  • Notify potential exploits running on the server.
  • Monitor suspicious file and directory, notify if directory or a file changes.
  • Protect against SYN Flood and Ping of death.
  • Suspicious process reporting and notify if potential exploits running on the server.
  • Port Scan tracking and blocking.
  • Notify if server load average remains high for a specified length of time.
  • Provides system statistics via graphs, e.g. Load Averages, CPU Usage, Memory Usage, etc.
  • Download list of blocked IP addresses automatically from sources defined by you.

In this tutorial, we will learn how to install and configure CSF on Ubuntu 16.04 server.

System Requirements

  • Newly deployed Ubuntu 16.04 server.
  • A static IP address is configured on your server.

Update the System

First, it is recommended to update your system with the latest stable version.
You can update system by running the following command:

apt-get update -y

apt-get upgrade -y

After updating system, restart your system and log in with root user.

Install CSF

By default, Ubuntu 16.04 comes with UFW firewall, so you will need to disable it first.
You can disable UFW with the following command:

ufw disable

CSF is currently not available in Ubuntu repositories, so you will need to download it from the ConfigServer’s website.

You can easily download it with the wget command as shown below:

wget http://download.configserver.com/csf.tgz

Once the download is complete, unpack the downloaded file with the following command:

tar -xvzf csf.tgz

Now, change the directory to CSF and run the following script to install CSF:

cd csf

bash install.sh

If everything is fine, you should see the following output:

 'csf/LICENSE.txt' -> 'webmin/csf/images/LICENSE.txt' 
 'csf/bootstrap/js/bootstrap.min.js' -> 'webmin/csf/images/bootstrap/js/bootstrap.min.js' 
 'csf/bootstrap/css/bootstrap.min.css.map' -> 'webmin/csf/images/bootstrap/css/bootstrap.min.css.map' 
 'csf/bootstrap/css/bootstrap.min.css' -> 'webmin/csf/images/bootstrap/css/bootstrap.min.css' 
 'csf/bootstrap/fonts/glyphicons-halflings-regular.eot' -> 'webmin/csf/images/bootstrap/fonts/glyphicons-halflings-regular.eot' 
 'csf/bootstrap/fonts/glyphicons-halflings-regular.woff2' -> 'webmin/csf/images/bootstrap/fonts/glyphicons-halflings-regular.woff2' 
 'csf/bootstrap/fonts/glyphicons-halflings-regular.svg' -> 'webmin/csf/images/bootstrap/fonts/glyphicons-halflings-regular.svg' 
 'csf/bootstrap/fonts/glyphicons-halflings-regular.ttf' -> 'webmin/csf/images/bootstrap/fonts/glyphicons-halflings-regular.ttf' 
 'csf/bootstrap/fonts/glyphicons-halflings-regular.woff' -> 'webmin/csf/images/bootstrap/fonts/glyphicons-halflings-regular.woff' 
 'csf/configserver.css' -> 'webmin/csf/images/configserver.css' 
 'csf/csf-loader.gif' -> 'webmin/csf/images/csf-loader.gif' 
 'csf/csf.svg' -> 'webmin/csf/images/csf.svg' 
 'csf/csf_small.png' -> 'webmin/csf/images/csf_small.png' 
 'csf/jquery.min.js' -> 'webmin/csf/images/jquery.min.js' 
 'csf/loader.gif' -> 'webmin/csf/images/loader.gif' 
 '/etc/csf/csfwebmin.tgz' -> '/usr/local/csf/csfwebmin.tgz'
 
 Installation Completed

Once csf is installed, you will need to verify whether all of the required firewall modules are available or not.

You can verify it with the following command:

perl /usr/local/csf/bin/csftest.pl

If everything is fine, you should see the following output:

 Testing ip_tables/iptable_filter...OK 
 Testing ipt_LOG...OK 
 Testing ipt_multiport/xt_multiport...OK 
 Testing ipt_REJECT...OK 
 Testing ipt_state/xt_state...OK 
 Testing ipt_limit/xt_limit...OK 
 Testing ipt_recent...OK 
 Testing xt_connlimit...OK 
 Testing ipt_owner/xt_owner...OK 
 Testing iptable_nat/ipt_REDIRECT...OK 
 Testing iptable_nat/ipt_DNAT...OK
 
 RESULT: csf should function on this server

Configure CSF

The default CSF configuration file csf.conf is located inside /etc/csf directory.

Let’s start by configuring the TCP_IN, TCP_OUT, UDP_IN and UDP_OUT options in csf.conf file:

nano /etc/csf/csf.conf

Make the following changes as per your requirements:

 #Enable CSF TESTING = "0"
 
 # Allow incoming TCP ports 
 TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995"
 
 # Allow outgoing TCP ports
 
 TCP_OUT = "20,21,22,25,53,80,110,113,443,587,993,995"
 
 # Allow incoming UDP ports 
 UDP_IN = "20,21,53"
 
 # Allow outgoing UDP ports 
 # To allow outgoing traceroute add 33434:33523 to this list 
 UDP_OUT = "20,21,53,113,123"
 
 # Allow incoming PING 
 ICMP_IN = "1"
 
 # Set the per IP address incoming ICMP packet rate 
 # To disable rate limiting set to "0" 
 ICMP_IN_RATE = "1/s"
 
 # Allow outgoing PING 
 ICMP_OUT = "1"

Save and close the file, then reload CSF firewall with the following command:

csf -r

You can see the list of default rules of CSF with the following command:

csf -l

To start the CSF firewall, run the following command:

csf -s

To stop the CSF firewall, run the following command:

csf -f

Allow and Block IP Addresses

You can easily allowing and denying IP addresses by editing csf.allow and csf.deny file.

If you want to allow specific IP address or range of IP address, edit the csf.allow file and add the IP address which you want to allow:

nano /etc/csf/csf.allow

Add the following lines:

 192.168.15.12 
 193.192.168.0.0/24

If you don’t want to edit csf.allow file, then you can also allow the IP address by running the following command:

csf -a 192.168.15.12

You should see the following output:

 Adding 192.168.15.12 to csf.allow and iptables ACCEPT... 
 ACCEPT all opt -- in !lo out * 192.168.15.12 -> 0.0.0.0/0 
 ACCEPT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.15.12

If you want to block specific IP address range, run the following command:

csf -d 192.168.15.0/24

You should see the following output:

 Adding 192.168.15.0/24 to csf.deny and iptables DROP... 
 DROP all opt -- in !lo out * 192.168.15.0/24 -> 0.0.0.0/0 
 LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.15.0/24

If you want to delete IP from csf.allow and csf.deny file, just run the following command:

csf -ar 192.168.15.12 
csf -dr 192.168.15.0/24

It is necessary to restart CSF after editing any CSF file.

CSF Advance Configuration

You can also secure your server from DDOS attacks. You can do this by editing csf.conf file:

nano /etc/csf/csf.conf

Update the following lines:

 #Total number of connections allowed from the single host. All IPs with more than 50 connections will be blocked. 
 CT_LIMIT = "50"
 
 #Block IPs permanent 
 CT_PERMANENT = 1
 
 #Block IPs for 600 seconds
 
 CT_BLOCK_TIME = 600
 
 #To set the connection limits for multiple ports. The maximum concurrent connections to port 80 and 22 from single IP is 15.
 
 CONNLIMIT = "80;15,22;15"
 
 #The number of connections to port 80 exceeds 30 in five seconds, all the new connections will be blocked.
 
 PORTFLOOD = "80;tcp;30;5"

Save and close the file, then reload CSF firewall to make this changes:

csf -r

That’s it. You have successfully installed CSF firewall on Ubuntu 16.04 server.

References