How to Monitor & Secure CSF Firewall on Linux Server

To monitor and secure CSF Firewall on a Linux server, enable LFD for intrusion detection, harden /etc/csf/csf.conf (ports, rate limits, floods), turn off TESTING, configure alert emails, and watch logs in real time. Use csf -l/-g/-t for visibility, automate reports via cron, and maintain allow/deny lists with ipset for performance.

In this guide, you’ll learn exactly how to monitor & secure CSF Firewall on Linux—step by step. We’ll configure ConfigServer Security & Firewall (CSF) with LFD, tune alerts, harden rules, and build a reliable monitoring workflow. Whether you run cPanel, DirectAdmin, or a plain VPS, this setup keeps attacks out and visibility high.

What CSF + LFD Does (and Why It Matters)

CSF (ConfigServer Security & Firewall) is a server-level firewall wrapper for iptables/nftables. It ships with LFD (Login Failure Daemon), which analyzes logs and automatically blocks brute-force attempts, port scans, and suspicious behavior. Together, they give you policy control (ports, limits) and active intrusion prevention, ideal for Linux hosting environments.

Prerequisites and Compatibility

• Linux distributions: RHEL/CentOS/Alma/Rocky, CloudLinux, Debian/Ubuntu.
• Root or sudo access.
• iptables or nftables available (CSF uses iptables; on newer systems you may switch to iptables-legacy).
• Mail transfer agent (Postfix/Exim) for alert emails.

Note: Avoid running multiple firewalls simultaneously (e.g., firewalld/ufw and CSF). Disable others before enabling CSF to prevent conflicts.

Install or Verify CSF on Your Linux Server

If CSF isn’t installed, use the official method below. If you’re on cPanel/WHM, the installer also adds a GUI under WHM > Plugins > ConfigServer Security & Firewall.

# 1) Install dependencies (example)
# RHEL/CentOS/Alma/Rocky
sudo yum -y install wget perl-libwww-perl perl-LWP-Protocol-https

# Debian/Ubuntu
sudo apt update && sudo apt -y install wget perl libwww-perl liblwp-protocol-https-perl

# 2) Download and install CSF
cd /usr/src
sudo wget https://download.configserver.com/csf.tgz
sudo tar -xzf csf.tgz
cd csf
sudo sh install.sh

# 3) Test environment (iptables modules, etc.)
sudo perl /usr/local/csf/bin/csftest.pl

If you’re on Debian/Ubuntu 10+ with nftables by default, consider switching to iptables-legacy for best CSF compatibility:

sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

Quick Start: Secure Defaults You Must Set

Open the main configuration file and harden the essentials. Then restart CSF/LFD.

sudo nano /etc/csf/csf.conf

Recommended baseline settings (adapt to your stack):

# Disable testing mode (required for production)
TESTING = "0"

# Inbound ports (only what you use)
TCP_IN = "22,80,443,25,465,587,110,143,993,995"
UDP_IN = "53"

# Outbound ports (restrict; add what apps need)
TCP_OUT = "80,443,25,465,587,110,143,993,995,53"
UDP_OUT = "53,123"

# Login failure & brute-force controls (via LFD)
LF_SSHD = "5"
LF_SSH_EMAIL_ALERT = "1"
LF_TRIGGER = "5"
LF_PERMBLOCK = "1"
LF_TEMP_PERM = "1"

# Flood & rate limits
SYNFLOOD = "1"
SYNFLOOD_RATE = "75/s"
SYNFLOOD_BURST = "150"

# Connection tracking (total concurrent connections from 1 IP)
CT_LIMIT = "100"
CT_INTERVAL = "30"
CT_LOGGING = "1"

# Limit per-port concurrent connections (example)
CONNLIMIT = "22;5,80;50,443;50"

# Per-port rate limit (example: SSH max 5 connections per 300s)
PORTFLOOD = "22;tcp;5;300"

# Use ipset for big blocklists (performance)
LF_IPSET = "1"

# Restrict syslog to root (prevents log snooping)
RESTRICT_SYSLOG = "3"

# Country blocks (optional; use sparingly)
# CC_DENY = "CN,RU,IR"
# CC_DENY_PORTS = "22,25"

# SMTP outbound control (spam prevention)
SMTP_BLOCK = "1"

Restart services after edits:

sudo systemctl restart csf lfd
sudo systemctl enable csf lfd

Monitor CSF in Real Time

Check firewall status and active rules

# Show active rules
sudo csf -l

# Quick firewall restart (after config changes)
sudo csf -r

# Enable/disable CSF
sudo csf -e
sudo csf -x

# Low-level view (iptables)
sudo iptables -L -n -v

Track attackers and temporary bans

# List temporary bans
sudo csf -t

# Find everything about an IP (allow/deny/temp/log hits)
sudo csf -g 203.0.113.25

# Follow LFD actions in real time
sudo tail -f /var/log/lfd.log

Typical log locations:

• /var/log/lfd.log (intrusion events, bans)
• /var/log/messages or /var/log/syslog (system-wide notices)
• /var/log/maillog or /var/log/mail.log (alert delivery)

Email alerts you should enable

Set a reliable recipient and make alerts actionable. In /etc/csf/csf.conf:

LF_ALERT_TO = "security@example.com"
LF_EMAIL_ALERT = "1"
LF_PTLS = "1"            # Process tracking alerts
LF_DIRWATCH = "300"      # Directory watch interval (if enabled)
LF_SSH_EMAIL_ALERT = "1" # Notify on successful root SSH login

Test mail delivery with a manual ban to see if alerts arrive:

sudo csf -d 203.0.113.25 "test ban"
sudo csf -dr 203.0.113.25

Live dashboards from the CLI

# Watch dropped/rejected packets update every 2s
watch -n 2 "sudo csf -l | egrep 'DROP|REJECT'"

# Top connecting IPs (quick triage)
watch -n 2 "ss -ntu | awk 'NR>1{print \$5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head"

Hardening CSF for Production

Lock down SSH and management ports

• Change SSH to a non-default port (adjust TCP_IN).
• Require key-based auth; disable root password login (sshd_config).
• Enable PORTFLOOD/CONNLIMIT for SSH to throttle brute-force attempts.

Connection tracking and rate limits

CT_LIMIT blocks abusive IPs that open too many connections. Combine it with per-port CONNLIMIT and PORTFLOOD for layered protection without harming legitimate traffic. Start conservative and observe logs before tightening.

Service-specific brute-force rules

LFD can watch many daemons (SSHD, Exim/Postfix, Dovecot, Pure-FTPd/vsftpd, cPanel/DirectAdmin logins). Tune LF_* thresholds to match your environment and enable permanent blocks for repeat offenders.

Geo/ASN blocking (use sparingly)

Country-level blocks are coarse and can create false positives. If you must, prefer CC_DENY_PORTS to restrict sensitive ports (e.g., SSH) instead of full denial for web traffic. Always enable ipset to keep performance acceptable.

Manage allow/deny lists safely

# Files
/etc/csf/csf.allow  # Persistent allow list (whitelist)
/etc/csf/csf.deny   # Persistent deny list
/etc/csf/csf.ignore # Ignore from LFD tracking

# Commands
sudo csf -a 198.51.100.10 "office IP"
sudo csf -ar 198.51.100.10
sudo csf -d 203.0.113.25 "abuse"
sudo csf -dr 203.0.113.25

Log Management and Security Auditing

Create a weekly offender report

Use a simple cron job to summarize top banned IPs and noisy ports. Send it to your security mailbox for trend analysis.

sudo nano /usr/local/bin/csf-weekly-report.sh

#!/usr/bin/env bash
LOG="/var/log/lfd.log"
echo "CSF/LFD Weekly Report - $(hostname) - $(date)"
echo
echo "Top offending IPs:"
grep -i "lfd: (.*) .* blocked" "$LOG" | awk '{print $NF}' | sed 's/[]()[]//g' | sort | uniq -c | sort -nr | head
echo
echo "Recent permanent blocks:"
grep -i "permanent" "$LOG" | tail -n 20
echo
echo "Most targeted ports (last 7 days):"
grep "$(date --date='7 days ago' '+%Y')" -A99999 "$LOG" 2>/dev/null | egrep -o 'dpt=[0-9]+' | cut -d= -f2 | sort | uniq -c | sort -nr | head

sudo chmod +x /usr/local/bin/csf-weekly-report.sh
(crontab -l 2>/dev/null; echo "15 3 * * 1 /usr/local/bin/csf-weekly-report.sh | mail -s 'CSF Weekly Report' security@example.com") | crontab -

Centralize and retain logs

• Forward logs to a SIEM (Elastic/Graylog) for correlation.
• Ensure logrotate covers lfd.log to prevent disk bloat.
• Keep at least 30–90 days of security logs for investigations.

Performance and Reliability Tips

Use ipset for large blocklists

ipset stores IPs in kernel sets, making lookups much faster than thousands of iptables rules. With LF_IPSET=1 and country/block feeds, you’ll keep memory and CPU usage in check.

Service management and persistence

sudo systemctl enable --now csf lfd
sudo systemctl status csf lfd
sudo csf -v   # show CSF version

nftables environments

On distributions where nftables is default, CSF can still manage rules via iptables-compat or iptables-legacy. Ensure alternatives are set correctly and no other firewall (firewalld/ufw) is competing for control.

Troubleshooting Common CSF Issues

CSF won’t start (TESTING=1)

CSF refuses to fully enable when TESTING is left on. Set TESTING=”0″ in /etc/csf/csf.conf and restart csf/lfd.

Unexpectedly blocked services

• Confirm ports in TCP_IN/UDP_IN match your stack.
• Check CONNLIMIT/PORTFLOOD thresholds aren’t too strict.
• Whitelist critical IPs in /etc/csf/csf.allow (monitoring, CDN, office).

Alert emails not arriving

• Verify LF_ALERT_TO and mail logs.
• Ensure your MTA can relay externally (DNS, port 25/587 permissions).
• Check spam filtering or add from address to allow list.

Secure Operations Checklist (Use Weekly)

• Review /var/log/lfd.log for new attack patterns.
• Prune stale entries in csf.allow and csf.deny.
• Rotate and back up /etc/csf/*.conf and profile snapshots.
• Validate only required ports are open (ss -tulpn).
• Test alerts and ban/unban flows after updates.

Pro Tip: Save and Reuse CSF Profiles

For multi-server fleets, save a hardened baseline and apply it consistently.

# Save current config as a reusable profile
sudo csf --profile save hardened-baseline

# List or apply later
sudo csf --profile list
sudo csf --profile apply hardened-baseline

YouStable Advice for Busy Teams

If you’re hosting on YouStable VPS or Dedicated Servers, ask our support to provision a CSF-hardened image with alerts, ipset, and sane defaults pre-configured. We’ll align firewall policies to your stack (web, mail, panel) and document changes so your team can audit and iterate confidently.

FAQs: How to Monitor & Secure CSF Firewall on Linux