Skip to main content

CSF Firewall tweaks



Create single-port CSF rule via SSH

  1. Login to SSH.
  2. Open /etc/csf/csf.allow in your preferred text editor. For the sake of this tutorial I'll be using VIM.
  3. Add your rules to this file, one per line.
    • We'll be adding lines in the same format as tcp/udp|in/out|s/d=port|s/d=ip.
    • Example: 
      So to open the mysql port to IP 11.22.33.44 , add the following lines. 

tcp:in:d=3306:d=11.22.33.44
tcp:out:d:3306:d=11.22.33.44



    • For example if we want to create a rule to allow inbound MySQL connections from IP 67.222.0.1 it would look like this:


      tcp|in|d=3306|s=67.222.0.1
  4. Save the file. If you're in nano, use ^X (Ctrl+X) and tell it "Y" to overwrite the file.
  5. Restart CSF using csf -r.

Open Port in CSF Firewall through SSH


  1. Login to your Linux machine through SSH. Open csf.conf file using any text editor.

    /etc/csf/csf.conf
  2. Add the port you wish to open and restart CSF firewall for the changes to take into effect.

    # Allow incoming TCP ports
TCP_IN = "20,443,465,21,22,587,993,25,53,80,110,143,995"
# Allow outgoing TCP ports
TCP_OUT = "20,21,443,587,22,25,80,110,43,53"
    csf -r  // To restart CSF firewall



Useful CSF SSH Command Line Commands (CSF Cheat Sheet)

CommandDescriptionExample
csf -sStart the firewall rulesroot@server[~]#csf -s
csf -fFlush/Stop firewall rules (note: lfd may restart csf)root@server[~]#csf -f
csf -rRestart the firewall rulesroot@server[~]#csf -r
csf -a [IP.add.re.ss] [comment]Allow an IP and add to /etc/csf/csf.allowroot@server[~]#csf -a 187.33.3.3 Home IP Address
csf -tr [IP.add.re.ss]Remove an IP from the temporary IP ban or allow list.root@server[~]#csf -tr 66.192.23.1
csf -tfFlush all IPs from the temporary IP entriesroot@server[~]#csf -tf
csf -d [IP.add.re.ss] [comment]Deny an IP and add to /etc/csf/csf.denyroot@server[~]#csf -d 66.192.23.1 Blocked This Guy
csf -dr [IP.add.re.ss]Unblock an IP and remove from /etc/csf/csf.denyroot@server[~]#csf -dr 66.192.23.1
csf -dfRemove and unblock all entries in /etc/csf/csf.denyroot@server[~]#csf -df
csf -g [IP.add.re.ss]Search the iptables and ip6tables rules for a match (e.g. IP, CIDR, Port Number)root@server[~]#csf -g 66.192.23.1
csf -t Displays the current list of temporary allow and deny IP entries with their TTL and comment root@server[~]#csf -t




Comments

Post a Comment

Popular posts from this blog

Nginx startup script

#!/bin/sh # # nginx - this script starts and stops the nginx daemon # # chkconfig:   - 85 15 # description:  NGINX is an HTTP(S) server, HTTP(S) reverse \ #               proxy and IMAP/POP3 proxy server # processname: nginx # config:      /etc/nginx/nginx.conf # config:      /etc/sysconfig/nginx # pidfile:     /var/run/nginx.pid # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. [ "$NETWORKING" = "no" ] && exit 0 nginx="/usr/local/nginx/sbin/nginx" prog=$(basename $nginx) NGINX_CONF_FILE="/usr/local/nginx/conf/nginx.conf" [ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx lockfile=/var/lock/subsys/nginx make_dirs() {    # make required directories    user=`$nginx -V 2>&1 | grep "configure arguments:.*--user=" | sed...
Post a Comment
Read more

Tomcat NIO Connector and How to Configure It

In  HTTP 1.1 , all connections between the browser and the server are considered persistent unless declared otherwise. Persistence, in this context, means to use a single TCP connection to send and receive multiple HTTP requests/responses, as opposed to opening a new connection for every single request/response pair. In tomcat, the default HTTP connector is blocking and follows a one thread per connection model. This means that in order to serve 100 concurrent users, it requires 100 active threads. We end up wasting resources (the thread) because connections may not be used heavily, but just enough to avoid a timeout. Opposed to this is the relatively new NIO or non blocking connector. This connector has a couple of poller threads used to keep the connection alive for all connected users while worker threads are called whenever data (a new HTTP request) is available. This model leads to a much better sharing of resources (threads) and a larger number of concurrent users can ...
Post a Comment
Read more

Java + HTTPS: Unable to Find Valid Certification Path to Requested Target

Run  InstallCert.java , with your hostname and https port, and press “ 1 ” when ask for input. It will add your “localhost” as a trusted keystore, and generate a file named “ jssecacerts “. C : \ > java InstallCert localhost : 8443 Loading KeyStore C : \Program Files\Java\jre6\lib\security\cacerts . . . Opening connection to localhost : 8443 . . . Starting SSL handshake . . . javax . net . ssl . SSLHandshakeException : sun . security . validator . ValidatorException : PKIX path building failed : sun . security . provider . certpath . SunCertPathBuilderException : unable to find valid certification path to requested target at com . sun . net . ssl . internal . ssl . Alerts . getSSLException ( Unknown Source ) at com . sun . net . ssl . internal . ssl . SSLSocketImpl . fatal ( Unknown Source ) at com . sun . net . ssl . internal . ssl . Handshaker . fatalSE ( Unknown Source ) at com . sun . net . ssl . internal . ssl . Handshaker...
Post a Comment
Read more