Configuring Server Security and Firewall ( CSF )
Step 1 – Installation of CFS dependencies
CSF script requires perl modules , it is a csf dependencies module
[root@nijam ~]# yum install perl-libwww-perl Loaded plugins: auto-update-debuginfo, fastestmirror, protectbase, refresh- : packagekit, security Setting up Install Process Loading mirror speeds from cached hostfile * base: centos.excellmedia.net * epel: epel.mirror.net.in * epel-debuginfo: epel.mirror.net.in ... ... ... Installed: perl-libwww-perl.noarch 0:5.833-2.el6 Complete!
Step 2 – Install CSF
Please go to the “/usr/src/” directory and download CSF with wget command.
[root@nijam ~]# cd /usr/src/ [root@nijam src]# wget http://www.configserver.com/free/csf.tgz --2016-03-17 09:59:46-- http://www.configserver.com/free/csf.tgz Resolving www.configserver.com... 109.70.137.78, 2a01:c0:2:22::3 Connecting to www.configserver.com|109.70.137.78|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently ... ... ... 100%[======================================>] 688,544 364K/s in 1.8s 2016-03-17 09:59:49 (364 KB/s) - “csf.tgz” saved [688544/688544]
To remove existing Firewall :The combination APF (Advanced Policy Firewall) +BFD(Brute Force Detection) must be removed in order to avoid the conflicts. Run the following command to remove the existing Firewall.
[root@nijam src]# sh /usr/src/csf/remove_apf_bfd.sh sh: /tmp/csf/remove_apf_bfd.sh: No such file or directory
Note:I have not installed APF & BFD in before that’s why it say’s no such file or directory
Extract the tar.gz file and go to the csf directory, then install it:
[root@nijam ~]# cd /usr/src [root@nijam src]# tar -xzf csf.tgz [root@nijam src]# cd csf [root@nijam src]# sh install.sh Selecting installer... Running csf generic installer Installing generic csf and lfd Check we're running as root ... ... ... mode of `/etc/init.d/lfd' retained as 0755 (rwxr-xr-x) mode of `/etc/init.d/csf' retained as 0755 (rwxr-xr-x) `/etc/csf/csfwebmin.tgz' -> `/usr/local/csf/csfwebmin.tgz' Installation Completed
Now you should check that CSG really works on this server. Go to the “/usr/local/csf/bin/” directory, and run“csftest.pl”.
# cd /usr/local/csf/bin/ # perl csftest.pl
If you see the test results as shown below, then CSF is running without problems on your server:
RESULT: csf should function on this server
# Allow incoming TCP ports TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995" # Allow outgoing TCP ports TCP_OUT = "20,21,22,25,53,80,110,113,443" # Allow incoming UDP ports UDP_IN = "20,21,53" # Allow outgoing UDP ports # To allow outgoing traceroute add 33434:33523 to this list UDP_OUT = "20,21,53,113,123"
Step 3 – Configure CSF on CentOS 7
Before stepping into the CSF configuration process, the first thing you must know is that “CentOS 7” has a default firewall application called “firewalld”. You have to stop firewalld and remove it from the startup.
Stop the firewalld:
systemctl stop firewalld
Disable/Remove firewalld from the startup:
systemctl disable firewalld
Then go to the CSF Configuration directory “/etc/csf/” and edit the file “csf.conf” with the vim editor:
vim /etc/csf/csf.conf
Change line 11 “TESTING “ to “0” for applying the firewall configuration.
TESTING = "0"
By default CSF allows incoming and outgoing traffic for the SSH standard port 22, if you use a different SSH port then please add your port to the configuration in line 139 “TCP_IN”.
Now start CSF and LFD with systemctl command:
systemctl start csf systemctl start lfd
And then enable the csf and lfd services to be started at boot time:
systemctl enable csf systemctl enable lfd
Step 4 – CSF Configuration Files:
CSF Configuration Usage and Options
- csf.conf : The main configuration file for controlling CSF.
- csf.deny : The list of denied IPs and CIDR addresses on the firewall.
- csf.allow : The list of allowed IPs and CIDR addresses on the firewall.
- csf.*ignore : The list of various ignore files of users, IPs.
- csf.ignore : The list of ignored IP?s and CIDR addresses on the firewall.
Commands and Options of CSF
- Option -r is used to reload all rules.
- Option -d is used to deny an IP address
- Option -a is used to allow an IP address
# csf -d IPADDRESS
# csf -a IPADDRESS
# csf -r
Back to the csf configuration directory, and edit the csf.conf configuration file:
# vi /etc/csf/csf.conf
1. Don’t Block IP addresses that are in the csf.allow files.
By default lfd also will block an IP under csf.allow files, so if you want that an IP in csf.allow files never get blocked by lfd, then please go to the line 272 and change “IGNORE_ALLOW” to “1”. This is useful when you have a static IP at home or in office and want to ensure that your IP never gets blocked by the firewall on your internet server.
IGNORE_ALLOW = "1"
2. Allow Incoming and Outgoing ICMP.
Go to the line 152 for incoming ping/ICMP:
ICMP_IN = "1"
And line 159 for outgoing ping ping/ICMP:
ICMP_OUT = "1"
3. Block Certain Countries
CSF provide an option to allow and deny access by country using the CIDR (Country Code). Go to line 836 and add the country codes that shall be allowed and denied:
CC_DENY = "CN,UK,US" CC_ALLOW = "ID,MY,DE"
4. Send the Su and SSH Login log by Email.
You can set an email address that is used by LFD to send an email about “SSH Login” events and users that run the “su”command, go to the line 1069 and change the value to “1”.
LF_SSH_EMAIL_ALERT = "1" ... LF_SU_EMAIL_ALERT = "1"
And then define the email address you want to use in line 588.
LF_ALERT_TO = "admin@tutorialdba.com"
If you want more tweaks, read the options in the “/etc/csf/csf.conf” configuration file.
Step 5 – CSF Commands
1. Start the firewall (enable the firewall rules):
csf -s
2. Flush/Stop the firewall rules.
csf -f
3. Reload the firewall rules.
csf -r
4. Allow an IP and add it to csf.allow.
# csf -a 192.168.1.109 Adding 192.168.1.109 to csf.allow and iptables ACCEPT... ACCEPT all opt -- in !lo out * 192.168.1.109 -> 0.0.0.0/0 ACCEPT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.1.109
5. Remove and delete an IP from csf.allow.
# csf -ar 192.168.1.109 Removing rule... ACCEPT all opt -- in !lo out * 192.168.1.109 -> 0.0.0.0/0 ACCEPT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.1.109
6. Deny an IP and add to csf.deny:
# csf -d 192.168.1.109 Adding 192.168.1.109 to csf.deny and iptables DROP... DROP all opt -- in !lo out * 192.168.1.109 -> 0.0.0.0/0 LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.1.109
7. Remove and delete an IP from csf.deny.
# csf -dr 192.168.1.109 Removing rule... DROP all opt -- in !lo out * 192.168.1.109 -> 0.0.0.0/0 LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.1.109
8. Remove and Unblock all entries from csf.deny.
# csf -df DROP all opt -- in !lo out * 192.168.1.110 -> 0.0.0.0/0 LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.1.110 DROP all opt -- in !lo out * 192.168.1.111 -> 0.0.0.0/0 LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.1.111 csf: all entries removed from csf.deny
9. Search for a pattern match on iptables e.g : IP, CIDR, Port Number
csf -g 192.168.1.110
10.Now you can see the list default rules of CSF with command:
csf -l
Step 6 – For Example Deny The Host
[root@nijam csf]# csf -d 192.168.7.101 Adding 192.168.7.101 to csf.deny and iptables DROP... DROP all opt -- in !lo out * 192.168.7.101 -> 0.0.0.0/0 LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.7.101 [root@nijam csf]# csf -r Flushing chain `INPUT' Flushing chain `FORWARD' ... ... .... LOCALOUTPUT all opt in * out !lo ::/0 -> ::/0 LOCALINPUT all opt in !lo out * ::/0 -> ::/0
To list the rules:
[root@ijam csf]# csf -l Chain INPUT (policy DROP 0 packets, 0 bytes) num pkts bytes target prot opt in out source des ..... ..... ..... Chain DENYIN (1 references) num pkts bytes target prot opt in out source destination 1 1 165 DROP all -- !lo * 192.168.7.101 0.0.0.0/0 ... ... ...
To verify try to connect the IP :
[root@nijam csf]# ping 192.168.7.101 PING 192.168.7.101 (192.168.7.101) 56(84) bytes of data. ping: sendmsg: Operation not permitted ping: sendmsg: Operation not permitted ping: sendmsg: Operation not permitted
Now add to allow list
[root@nijam csf]# csf -a 192.168.7.101 Removing 192.168.7.101 from csf.deny... Removing rule... DROP all opt -- in !lo out * 192.168.7.101 -> 0.0.0.0/0 LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.7.101 Adding 192.168.7.101 to csf.allow and iptables ACCEPT... ACCEPT all opt -- in !lo out * 192.168.7.101 -> 0.0.0.0/0 ACCEPT all opt -- in * out !lo 0.0.0.0/0 -> 192.168.7.101
[root@ijam csf]# csf -r Flushing chain `INPUT' Flushing chain `FORWARD' ... ... ...
To list the rules again
[root@nijam csf]# csf -l Chain INPUT (policy DROP 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT tcp -- !lo * 8.8.8.8 0.0.0.0/0 tcp dpt:53 Chain ALLOWOUT (1 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT all -- * !lo 0.0.0.0/0 192.168.7.101 .....
To verify output
[root@nijam csf]# ping 192.168.7.101 PING 192.168.7.101 (192.168.7.101) 56(84) bytes of data. 64 bytes from 192.168.7.101: icmp_seq=1 ttl=128 time=1.40 ms 64 bytes from 192.168.7.101: icmp_seq=2 ttl=128 time=0.377 ms 64 bytes from 192.168.7.101: icmp_seq=3 ttl=128 time=0.321 ms 64 bytes from 192.168.7.101: icmp_seq=4 ttl=128 time=0.241 ms 64 bytes from 192.168.7.101: icmp_seq=5 ttl=128 time=0.341 ms ............
Step 7 -To remove CSF Firewall :
Run the following script located under /etc/csf/uninstall.sh directory to remove CSF Firewall.
[root@nijam csf]# /etc/csf/uninstall.sh Uninstalling csf and lfd... Flushing chain `INPUT' Flushing chain `FORWARD' Flushing chain `OUTPUT' ... ... ... removed directory: `/var/lib/csf/ui' removed directory: `/var/lib/csf' ...Done
