CSF Configuration Files in Linux

CSF developed an SPI iptables firewall that is straight-forward, easy and flexible to configure and secure with extra checks to ensure smooth operation. The CSF installation includes preconfigured configurations and control panel UI’s for cPanel, DirectAdmin and Webmin. You can also know more about configuration files.

Related Articles:

• Install CSF (ConfigServer Firewall) on Linux
• Use of CSF Firewall in Linux
• Block Countries using CSF Firewall On Linux
• Email Alert Setup for CSF

CSF Configuration Files

• Wide Configuration File

  /etc/csf/csf.conf
  

• IP addresses will be allowed through iptables.

  /etc/csf/csf.allow
  

• IP addresses will be blocked in iptables.

  /etc/csf/csf.deny
  

• List of port and/or IP address assignments to direct traffic to alternative ports/IP addresses.

  /etc/csf/csf.redirect
  

• List of Reseller accounts that you want to allow access to limited csf functionality.

  /etc/csf/csf.resellers
  

• List of directories and files that you want to be alerted when they change.

  /etc/csf/csf.dirwatch
  

• List of log files for the UI System Log Watch and Search features.

  /etc/csf/csf.syslogs
  

• List of log files for the LOGSCANNER feature.

  /etc/csf/csf.logfiles
  

• List of regular expressions for the LOGSCANNER feature.

  /etc/csf/csf.logignore
  

• The file contains definitions to IP BLOCK lists.

  /etc/csf/csf.blocklists
  

• IP addresses will be ignored by all lfd checks.

  /etc/csf/csf.ignore
  

• List of executables (exe) command lines (cmd) and usernames (user) that lfd process tracking will ignore.

  /etc/csf/csf.pignore
  

• List of domains and partial domain that lfd process tracking will ignore based on a reverse and forward DNS lookups.

  /etc/csf/csf.rignore
  

• List of files that lfd directory watching will ignore.

  /etc/csf/csf.fignore
  

• List of files that LF_SCRIPT_ALERT will ignore.

  /etc/csf/csf.signore
  

• List of usernames that are ignored during the LF_EXPLOIT.

  /etc/csf/csf.suignore
  

• List of user ID’s (UID) that are ignored by the User ID Tracking feature.

  /etc/csf/csf.uidignore
  

• List of usernames and local IP addresses that RT_LOCALRELAY_ALERT will ignore.

  /etc/csf/csf.mignore
  

• This file is to list any server configured IP addresses for which you don’t want to allow any incoming or outgoing traffic.

  /etc/csf/csf.sips
  

• The following FQDN’s will be allowed through the firewall. This is controlled by lfd which checks the DNS resolution of the FQDN and adds the IP address into the ALLOWDYNIN and ALLOWDYNOUT iptables chains.

  /etc/csf/csf.dyndns
  

• This file contains the usernames which should be allowed to log via syslog/rsyslog.

  /etc/csf/csf.syslogusers
  

• The following IP addresses will allow EXIM to advertise SMTP AUTH.

  /etc/csf/csf.smtpauth
  

• This file configures optional entries for the IP checking against RBLs within CSF.

  /etc/csf/csf.rblconf
  

Enjoy it!