csf.conf

Basic CSF commands

Enable CSF
```
csf -e
```
Disable CSF
```
csf -x
```
Start CSF
```
csf -s
```
Flush/Stop CSF
```
csf -f
```
Reload CSF
```
csf -r
```
Allow an IP and add it to csf.allow – /etc/csf/csf.allow
```
csf -a 162.162.1.219
```
Remove and delete an IP from csf.allow – /etc/csf/csf.allow
```
csf -ar 162.162.1.209
```
Place an IP on temporary deny list in /var/lib/csf/csf.tempban
```
csf -td
```
Remove an IP from the temporary IP ban or allow list
```
csf -tr 162.162.1.209
```
Flush all IPs from the temporary IP entries
```
csf -tf
```
Deny an IP and add to csf.deny
```
csf -d 162.162.1.209
```
Remove and Unblock an IP from csf.deny
```
csf -dr 162.162.1.209
```
Remove and Unblock all entries from csf.deny
```
csf -df
```
Search for a pattern match on iptables e.g : IP, CIDR, Port Number
```
csf -g 152.167.1.118
```

Advanced Configuration to csf.conf at /etc/csf/csf.conf

Add root and admin notification email addresses at /etc/aliases.
```
root: root@domain.com
admin: admin@domain.com
```
Add email address to get all notifications – /etc/csf
(csf > firewall configuration > Reporting Settings > LF_ALERT_TO = alert@domain.com)
```
LF_ALERT_TO = "alert@domain.com"
```
Stop or disable “excessive resource usage” change PT_USERTIME = 0
```
PT_USERTIME = "0"
```
Under Process Tracking at /etc/csf
Don’t Block IP addresses that are in the csf.allow files
```
IGNORE_ALLOW = "1"
```
Allow Incoming and Outgoing ICMP
```
ICMP_IN = "1"
```
```
ICMP_OUT = "1"
```

Block Certain Countres

CC_DENY = "CA,CN,US"

CC_ALLOW = "IN,ME,DE"

Send the Su and SSH Login log by Email

LF_SSH_EMAIL_ALERT = "1"

LF_SU_EMAIL_ALERT = "1"

Get alert or notification
```
LF_ALERT_TO = "email@domain.tld"
```

Warning in CSF

SYSLOG_CHECK option check
(This option helps prevent brute force attacks on your server services)
- Open /etc/csf/csf.conf
- Search for “SYSLOG_CHECK”
- Put value between 300 and 3600 seconds
```
SYSLOG_CHECK = "600"
```
- Restart CSF firewall
```
#csf -r
```
Check for DNS recursion restrictions
(You have a local DNS server running but do not appear to have any recursion restrictions set. This is a security and performance risk and you should look at restricting recursive lookups to the local IP addresses only)
- Add following options to /etc/named.conf
```
options {        
   allow-recursion {
   localhost;
};
```
- Restart named
```
service named restart
```
Check for cxs
(You should consider using cxs to scan web script uploads and user accounts for exploits uploaded to the server)
```
ConfigServer eXploit Scanner (cxs) - from $60/server
```
https://configserver.com/cp/cxs.html
Check for osm
(You should consider using osm to provide protection from spammers exploiting the server)
```
Outgoing Spam Monitor (osm) - $40/server
```
https://www.configserver.com/cp/osm.html
Check for swap file
(The server appears to have no swap file. This is usually considered a stability and performance risk. You should either add a swap partition, or create one via a normal file on an existing partition)
SSH/Telnet Check
- Check SSH PasswordAuthentication
  (You should disable PasswordAuthentication and only allow access using PubkeyAuthentication to improve brute-force SSH security)
- Check SSH UseDNS
  (You should disable UseDNS by editing /etc/ssh/sshd_config. Otherwise, lfd will be unable to track SSHD login failures successfully as the log files will not report IP addresses)
```
UseDNS no
```