CSF or Config Server Firewall is a powerful tool that enhances the security of your server by providing a Stateful Packet Inspection (SPI) firewall based on IPtables and Perl. It not only monitors your services for authentication failures but also integrates with popular web-based server management tools like Webmin, cPanel, and DirectAdmin. In this comprehensive guide, we will walk you through the step-by-step process of installing and configuring CSF on a Debian 12 server.
Prerequisites
Before we begin, make sure you have the following:
- A Debian 12 server.
- A non-root user with administrator privileges.
Step 1: Preparing the System
Before installing CSF, we need to ensure that all the necessary dependencies are installed on our Debian 12 server. Start by updating the server’s repository using the following command:
sudo apt update
Once the repository is updated, install the required dependencies for CSF using the following command:
sudo apt install libio-socket-inet6-perl libsocket6-perl sendmail dnsutils unzip libio-socket-ssl-perl libcrypt-ssleay-perl git perl iptables libnet-libidn-perl libwww-perl liblwp-protocol-https-perl libgd-graph-perl
Step 2: Downloading and Installing CSF
In this step, we will download and install CSF manually from the source. Follow the instructions below:
- Download the CSF source code by running the following command:
wget http://download.configserver.com/csf.tgz
- Extract the downloaded file using the following command:
sudo tar -xvzf csf.tgz
- Navigate to the extracted directory using the following command:
cd csf
- Run the installation script to start the installation:
sudo sh install.sh
- Once the installation is complete, verify the installation by running the following command:
perl /usr/local/csf/bin/csftest.pl
Step 3: Configuring CSF
After successfully installing CSF, it’s time to configure it to suit your server’s needs. The main configuration file for CSF is located at /etc/csf/csf.conf
. Open the file using your preferred text editor:
sudo nano /etc/csf/csf.conf
Allowing Traffic via CSF
To allow incoming and outgoing traffic through specific ports, find the TCP_*
and UDP_*
options in the configuration file and add the desired ports. For example:
TCP_IN = "20,21,22,25,53,853,80,110,143,443,465,587,993,995"
TCP_OUT = "20,21,22,25,53,853,80,110,113,443,587,993,995"
UDP_IN = "20,21,53,853,80,443"
UDP_OUT = "20,21,53,853,113,123"
Allow/Deny Ping or ICMP Requests
To enable or disable Ping or ICMP requests, find the ICMP_IN
and ICMP_OUT
options in the configuration file. Set them to 1
to allow Ping and 0
to disable it. For example:
ICMP_IN = "1" ICMP_OUT = "1"
Synflood Protection
If you want to enable SYN Flood protection to safeguard your server against Denial of Service (DoS) attacks, find the SYNFLOOD
option in the configuration file and set it to 1
. For example:
SYNFLOOD = "1"
Limiting Concurrent Connections
To limit the number of concurrent connections allowed for specific ports, use the CONNLIMIT
option in the configuration file. Specify the port and the maximum number of connections separated by a semicolon. For example:
CONNLIMIT = "22;5,21;10"
Disabling TESTING Mode and Restricting Access to Syslog
By default, CSF runs in TESTING mode, which allows you to verify the configuration without blocking any IP addresses. Once you have configured CSF, change the TESTING
option to 0
to disable TESTING mode. Additionally, restrict access to rsyslog sockets by setting RESTRICT_SYSLOG
to 3
. For example:
TESTING = "0" RESTRICT_SYSLOG = "3"
Save the changes to the configuration file and exit the text editor.
Step 4: Testing and Starting CSF Service
Before we start the CSF service, it’s essential to test the configuration for any errors. Run the following command to verify your CSF configuration:
csf -v
If there are no errors, start the CSF and lfd services using the following command:
sudo systemctl start csf lfd
To check the status of both services, run the following command:
sudo systemctl status csf lfd
If the services are running without any issues, you have successfully installed and configured CSF on your Debian 12 server.
Step 5: Blocking IP Addresses via CSF
One of the key features of CSF is the ability to block IP addresses using various methods. In this step, we will cover two popular methods: blocking IP addresses via IP BLOCK lists and blocking IP addresses based on their geographical location using GeoIP.
Blocking IP Addresses via IP BLOCK Lists
CSF allows you to block IP addresses by leveraging IP BLOCK lists. Open the /etc/csf/csf.blocklists
file using your text editor:
sudo nano /etc/csf/csf.blocklists
To block IP addresses from the Spamhaus database, uncomment the following lines:
SPAMDROP|86400|0|http://www.spamhaus.org/drop/drop.txt SPAMDROPV6|86400|0|https://www.spamhaus.org/drop/dropv6.txt SPAMEDROP|86400|0|http://www.spamhaus.org/drop/edrop.txt
Save the changes and exit the text editor.
Blocking IP Addresses via GeoIP
Another method to block IP addresses is by their geographical location using GeoIP. Open the CSF configuration file again:
sudo nano /etc/csf/csf.conf
To block incoming traffic from specific countries, find the CC_DENY
and CC_ALLOW
options and modify them accordingly. For example:
CC_DENY = "RU,CN" CC_ALLOW = "US,GB,DE,NL,SG"
If you prefer to use the MaxMind GeoIP database, change the CC_SRC
option to 1
and provide your MaxMind license key in the MM_LICENSE_KEY
field.
Save the changes and exit the text editor.
Restart CSF and lfd services to apply the new configurations:
sudo csf -ra
Step 6: Enabling CSF Web UI
CSF provides a convenient web-based user interface (UI) for monitoring and managing your firewall settings. To enable the CSF Web UI, open the CSF configuration file:
sudo nano /etc/csf/csf.conf
Set the UI
option to 1
to enable the CSF Web UI:
UI = "1"
Adjust the UI_PORT
, UI_IP
, UI_USER
, and UI_PASS
options to your desired values. For example:
UI_PORT = "1048" UI_IP = "127.0.0.1" UI_USER = "shapehost" UI_PASS = "passw0rd"
Save the changes and exit the text editor.
To access the CSF Web UI, whitelist your public IP address by adding it to the /etc/csf/csf.allow
and /etc/csf/ui/ui.allow
files:
sudo nano /etc/csf/csf.allow sudo nano /etc/csf/ui/ui.allow
Add your IP address to the whitelist:
# single ip your_public_ip_address
Save the files and exit the text editor.
Restart CSF and lfd services for the changes to take effect:
sudo csf -ra
Conclusion
Congratulations! You have successfully installed and configured CSF (Config Server Firewall) on your Debian 12 server. You have learned how to allow traffic through specific ports, enable or disable Ping requests, set up connection limits, and block IP addresses using IP BLOCK lists and GeoIP. Additionally, you have enabled the CSF Web UI for convenient monitoring and management of your firewall settings.
CSF is an essential tool for enhancing the security of your server, and its integration with popular server management tools makes it even more powerful. With CSF, you can have peace of mind knowing that your server is protected from unauthorized access and malicious attacks.
If you are looking for reliable and secure cloud hosting solutions, Shape.host offers Linux SSD VPS services that are optimized for performance and security. Our expert team is dedicated to providing you with efficient and scalable hosting solutions tailored to your specific needs.