{"id":416,"date":"2017-11-10T16:21:21","date_gmt":"2017-11-10T08:21:21","guid":{"rendered":"https:\/\/play.datalude.com\/blog\/?p=416"},"modified":"2023-08-15T09:00:10","modified_gmt":"2023-08-15T01:00:10","slug":"switch-from-ufw-and-fail2ban-to-csf","status":"publish","type":"post","link":"https:\/\/play.datalude.com\/blog\/2017\/11\/switch-from-ufw-and-fail2ban-to-csf\/","title":{"rendered":"Switch from UFW and fail2ban to CSF"},"content":{"rendered":"\n

Having played with CSF for a while on one server, I've decided I like it more than UFW and fail2ban. It seems much better at blocking mail bruteforce attacks and SSH as a distributed attack. So anyway, here's a list of steps to achieve that, as much for my record as anything. The server is running Ubuntu 16.04, but these general steps should work anywhere. In addition the server I did it on is also running VestaCP, so there are a couple more steps for that.<\/p>\n\n\n\n\n\n\n\n

  1. Download and install CSF<\/strong>
    cd code
    wget https:\/\/download.configserver.com\/csf.tgz
    tar -xzf csf.tgz
    cd csf
    install.sh<\/li>
  2. Edit Open ports<\/strong> in \/etc\/csf\/csf.conf to reflect\u00a0 your environment. csf install will automatically detect ssh running on non-standard ports and add those. It will also tell you during install which ports are listening. Review:
    TCP_OUT = \"20,21,22,25,53,80,110,113,443,587,993,995\"
    TCP_IN = \"22,25,80,110,143,443,465\"
    Also TCPV6_OUT and TCPV6_IN.<\/li>
  3. Set the following values<\/strong>
    TESTING = \"1\"
    RESTRICT_SYSLOG = \"3\"
    RESTRICT_SYSLOG_GROUP = \"sysloggers\"
    LF_ALERT_TO = \"x@domain.com\"
    LF_ALERT_FROM = \"csf@domain.com\"
    LF_DISTATTACK = \"1\"
    PT_USERTIME = \"1\"<\/li>
  4. Review log settings<\/strong> from\u00a0HTACCESS_LOG onwards. Specifically on Ubuntu, you need to set
    SSHD_LOG = \"\/var\/log\/auth.log\"
    SU_LOG = \"\/var\/log\/auth.log\"
    FTPD_LOG = \"\/var\/log\/syslog\"
    SMTPAUTH_LOG = \"\/var\/log\/secure\"
    POP3D_LOG = \"\/var\/log\/mail.log\"
    IMAPD_LOG = \"\/var\/log\/mail.log\"
    IPTABLES_LOG = \"\/var\/log\/syslog\"
    SUHOSIN_LOG = \"\/var\/log\/syslog\"
    BIND_LOG = \"\/var\/log\/syslog\"
    SYSLOG_LOG = \"\/var\/log\/syslog\"
    WEBMIN_LOG = \"\/var\/log\/auth.log\"<\/li>
  5. You can now start csf.<\/strong> It will replace all the UFW rules with its own.
    ufw disable
    systemctl disable ufw
    systemctl disable fail2ban
    csf -ra<\/li>
  6. Archive off fail2ban and remove logrotate config<\/strong>
    tar -cvf \/etc\/fail2ban.tar \/etc\/fail2ban\/
    apt remove fail2ban ufw
    rm \/etc\/logrotate.d\/fail2ban<\/li>
  7. Extra steps for VestaCP<\/strong>
    In \/usr\/local\/vesta\/conf\/vesta.conf file.
    FIREWALL_SYSTEM=\"
    FIREWALL_EXTENSION=\"
    Install the vesta UI and v-csf script from\u00a0https:\/\/github.com\/haipham\/csf-vestacp\/blob\/master\/install.sh
    (prefer to do this manually)<\/li>
  8. Final hacking.<\/strong> Over the next few days you'll need to pay attention to other files in \/etc\/csf\/
    csf.ignore
    csf.pignore
    csf.blocklists
    csf.allow
    csf.deny<\/li>
  9. Extra aggressive settings for those email bruteforcers.<\/strong>
    LF_POP3D = 5
    LF_POP3D_PERM = 86400
    LF_IMAPD = 5
    LF_POP3D_PERM = 86400<\/li>
  10. Adjust Logwatch as necessary.<\/li><\/ol>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    Having played with CSF for a while on one server, I've decided I like it more than UFW and fail2ban. It seems much better at blocking mail bruteforce attacks and SSH as a distributed attack. So anyway, here's a list of steps to achieve that, as much for my record as anything. The server is … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[4,5],"tags":[],"class_list":["post-416","post","type-post","status-publish","format-standard","hentry","category-linux","category-security"],"_links":{"self":[{"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/posts\/416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/comments?post=416"}],"version-history":[{"count":0,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/posts\/416\/revisions"}],"wp:attachment":[{"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/media?parent=416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/categories?post=416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/tags?post=416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}