Installing CSF LFD on Plesk Panel CentOS CloudLinux

Perfect for Web Hosting Providers, Becomes even easier by installing Webmin over your Plesk Panel Panel 12 Installation. Not recommended from a security perspective.

Securing your server these days is a must! Alpha Computer Services will be showing you how to secure your Server / VPS with CSF / LFD and includes packet inspection, firewall with login intrusion detection and security application for Linux Servers. Requires SSH access to your Dedicated Server or VPS.

 

You can view more detailed information by visiting their website

http://configserver.com/cp/csf.html

UI integration for cPanel, DirectAdmin and Webmin, but we’ll be installing it on Parallels Plesk Panel 12 which does not include a interface.

I HIGHLY RECOMMEND NOT INSTALLING WEBMIN OVER PLESK UNLESS YOU’RE REALLY NEW TO MANAGING A PLESK SERVER, USE SSH INSTEAD.

How to Install Webmin Plesk CentOS

You can install webmin over your plesk installation, visit webmins website and once you install, login to your webmin control panel. https://yourIP_or_DomainName:10000 and then go to Webmin – Webmin Configuration – Webmin Modules – From Local File and then Browse to usually /etc/csf/csfwebmin.tgz then click install module. You will have to install csf first, if not webmin will install it for you. It will install under System in your webmin control panel, from here you can instantly increase your servers security levels and check log files, unblock, block ips and lots more.

As long as you don’t use webmin to edit or update anything you don’t have to worry about it, but you can use it to edit your configuration files pretty easily. Don’t do it unless you know what you’re doing.

You can view screen shots I just made with CSF / LFD using webmin here:


webmin csf



webmincsf2


Tip: when using ssh terminal begin by typing for example nano /etc/csf/cs and keep hitting tab key. it will show you the available combinations for the remaining file names in that directory. This trick will save you a heck of a lot of time using terminal “SSH” shell, whatever you want to call it. Okay, well lets begin.

If using windows you can download Putty SSH Cient If you’re using Linux or Mac you can open Terminal. I prefer Terminator because you can open other terminal sessions inside the same window by right clicking the terminal and clicking split horizontally.

tip: when you try typing nano and if the command is not found type this:

Debian Based “Ubuntu” etc : apt-get install nano

RedHat Based “CentOS” etc : yum install nano

Add sudo before command if not ROOT.

CSF LFD Works in Linux Dedicated Server and VPS “Virtual Private Servers”

Install on Dedicated Server or VPS “Virtual Private Servers”, We run ours in virtual private servers in the cloud so we can move our nodes from host to host.

Downloading and Installing Webmin in Parallels Plesk Panel 12 using SSH

Must be logged in as ROOT:
su – root
cd /root

Download and installation:
wget http://www.configserver.com/free/csf.tgz
tar –xzf csf.tgz
cd csf
sh install.sh

Which ports do I need open?
Once you run the install script it will tell you the current TCP and UDP listening ports for incoming connections. This will not give you all the ports you need open, nor will it tell you which ports you need closed. but gives you a good starting point.

Note: your settings might be different, if you have no idea just copy the current ports listed when you installed config server or just contact us and we’ll be happy to help you for free.

Check http://kb.parallels.com/391 for more details on which ports plesk panel 12 uses.

Make sure iptables has the correct modules:
perl /etc/csf/csftest.pl

Change to csf installed directory:
cd /etc/csf

Now edit csf main config file. the creators of configserver did an excellent job explaining what all the options do. So read your configuration and adjust to your liking, depending on how much you want to lock down your system. If you’re a web hosting business make sure to look at the perspective from your hosting customers point of view.

nano /etc/csf/csf.conf

Tip: when done editing your file type CTRL+X and than Y to save changes.

lfd will not start while this is enabled

TESTING = 

# The interval for the crontab in minutes. Since this uses the system clock the
# CRON job will run at the interval past the hour and not from when you issue
# the start command. Therefore an interval of 5 minutes means the firewall
# will be cleared in 0-5 minutes from the firewall start

TESTING_INTERVAL =  Default: 5 [1-60]

# Enabling auto updates creates a cron job called /etc/cron.d/csf_update which
# runs once per day to see if there is an update to csf+lfd and upgrades if
# available and restarts csf and lfd
#
# You should check for new version announcements at http://blog.configserver.com

AUTO_UPDATES =  Default: 1 [0-1]

###############################################################################
# SECTION:IPv4 Port Settings
###############################################################################
# Lists of ports in the following comma separated lists can be added using a
#

Lookup your Plesk Panel Version for Ports to Open and if your Server uses other ervices Open Ports for Which ones you want to Allow Access to the Outside World

colon (e.g. 30000:35000).# Allow incoming TCP ports

TCP_IN = 

 

# If you do not want to allow external access to MySQL or PostgreSQL. I would block it as people logging into plesk panel 12 will still be able to install applications and access the database using phpmyadmin or phpPGadmin. block incoming PostgrelSQL: 5432 and MYSQL: 3306

# Allow outgoing TCP ports

TCP_OUT = 20,21,22,25,43,53,80,106,110,113,143,443,465,587,873,990,993,995,3310,5224,5353,8443,8447,8880,9080,

# Allow incoming UDP ports

UDP_IN = 

# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list

UDP_OUT = 

# Allow incoming PING

 
ICMP_IN_RATE = 

# Allow outgoing PING

ICMP_OUT =  Default: 1 [0-1]

# Set the per IP address outgoing ICMP packet rate (hits per second allowed),
# e.g. “1/s”
# To disable rate limiting set to “0”

ICMP_OUT_RATE = 

###############################################################################
# By default, csf will auto-configure iptables to filter all traffic except on
# the loopback device. If you only want iptables rules applied to a specific

NIC, then list it here (e.g. eth1, or eth+)

ETH_DEVICE = 

# By adding a device to this option, ip6tables can be configured only on the
# specified device. Otherwise, ETH_DEVICE and then the default setting will be
# used

If you want to skip maybe your local intranet than an example would be eth2, eth+ means all networking devices will be protected.

ETH_DEVICE_SKIP = 

# To switch from the deprecated iptables “state” module to the “conntrack”
# module, change this to 1

# SECTION:Logging Settings
###############################################################################
LOGFLOOD_ALERT =  Default: 0 [0-1]

# Configure csf to watch IP addresses (with csf -w [ip]). This option will add
# overhead to packet traversal through iptables and syslog logging, so should
# only be enabled while actively watching IP addresses. See readme.txt for more
# information on the use of this option

###############################################

Important Setup Email Address To Receive Logs

# SECTION:Reporting Settings
###############################################################################
# By default, lfd will send alert emails using the relevant alert template to
# the To: address configured within that template. Setting the following
# option will override the configured To: field in all lfd alert emails
#
#Leave this option empty to use the To: field setting in each alert template
LF_ALERT_TO = 

# By default, lfd will send alert emails using the relevant alert template from
# the From: address configured within that template. Setting the following
# option will override the configured From: field in all lfd alert emails
#
# Leave this option empty to use the From: field setting in each alert template

LF_ALERT_FROM = 

# By default, lfd will send all alerts using the SENDMAIL binary. To send using
# SMTP directly, you can set the following to a relaying SMTP server, e.g.
# “127.0.0.1”. Leave this setting blank to use SENDMAIL

IF YOU STILL CAN’T GET EMAIL FROM CSF LFD THAN TRY USING SMTP DIRECTLY BY CHANGING LF_ALERT_SMTP = “” to LF_ALERT_SMTP = “127.0.0.1” OR WHERE YOUR EMAIL SERVER IS LOCATED.

 

Important! Make sure to Setup Login Failure Blocking for Specific Services

###############################################################################
# SECTION:Login Failure Blocking and Alerts
###############################################################################
# The following[*] triggers are application specific. If you set #LF_TRIGGER to
# “0” the value of each trigger is the number of failures against that
# application that will trigger lfd to block the IP address
#
# If you set LF_TRIGGER to a value greater than “0” then the following[*]
# application triggers are simply on or off (“0″ or “1”) and the value of
# LF_TRIGGER is the total cumulative number of failures that will #trigger lfd
# to block the IP address
#
# Setting the application trigger to “0” disables it
LF_TRIGGER = “0”
# If LF_TRIGGER is > “0” then LF_TRIGGER_PERM can be set to “1” to #permanently
# block the IP address, or LF_TRIGGER_PERM can be set to a value #greater than
# “1” and the IP address will be blocked temporarily for that value in #seconds.
# For example:
# LF_TRIGGER_PERM = “1” => the IP is blocked permanently
# LF_TRIGGER_PERM = “3600” => the IP is blocked temporarily for 1 hour
#
# If LF_TRIGGER is “0”, then the application LF_[application]_PERM value #works
# in the same way as above and LF_TRIGGER_PERM serves no function
LF_TRIGGER_PERM = “1”

 

# To only block access to the failed application instead of a complete #block
# for an ip address, you can set the following to “1”, but LF_TRIGGER #must be
# set to “0” with specific application[*] trigger levels also set #appropriately
#
# The ports that are blocked can be configured by changing the #PORTS_* options

LF_SELECT = “0”

# Send an email alert if an IP address is blocked by one of the [*] #triggers

LF_EMAIL_ALERT = “1”

# [*]Enable login failure detection of sshd connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:

LF_SSHD = “8”
LF_SSHD_PERM = “1”

# [*]Enable login failure detection of ftp connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_FTPD = “14”
LF_FTPD_PERM = “1”

# [*]Enable login failure detection of SMTP AUTH connections
LF_SMTPAUTH = “15”
LF_SMTPAUTH_PERM = “1”# [*]Enable syntax failure detection of Exim connections
LF_EXIMSYNTAX = “2”
LF_EXIMSYNTAX_PERM = “1”# [*]Enable login failure detection of pop3 connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_POP3D = “20”
LF_POP3D_PERM = “1”# [*]Enable login failure detection of imap connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_IMAPD = “20”
LF_IMAPD_PERM = “1”# [*]Enable login failure detection of Apache .htpasswd connections
# Due to the often high logging rate in the Apache error log, you might #want to
# enable this option only if you know you are suffering from attacks #against
# password protected directories
LF_HTACCESS = “”
LF_HTACCESS_PERM = “1”# [*]Enable failure detection of repeated Apache mod_security rule #triggers
LF_MODSEC = “3”
LF_MODSEC_PERM = “1”# [*]Enable detection of repeated BIND denied requests
# This option should be enabled with care as it will prevent blocked IPs #from
# resolving any domains on the server. You might want to set the #trigger value
# reasonably high to avoid this
# Example: LF_BIND = “100”
LF_BIND = “100”
LF_BIND_PERM = “1”# [*]Enable detection of repeated suhosin ALERTs
# Example: LF_SUHOSIN = “5”
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_SUHOSIN = “5”
LF_SUHOSIN_PERM = “1”# [*]Enable detection of repeated cxs ModSecurity mod_security rule #triggers
# This option will block IP addresses if cxs detects a hits from the
# ModSecurity rule associated with it
#
# Note: This option takes precedence over LF_MODSEC and removes #any hits
# counted towards LF_MODSEC for the cxs rule
#
# This setting should probably set very low, perhaps to 1, if you want #to
# effectively block IP addresses for this trigger option
LF_CXS = “1”
LF_CXS_PERM = “1”# [*]Enable detection of repeated Apache mod_qos rule triggers
LF_QOS = “2”
LF_QOS_PERM = “1”# [*]Enable detection of repeated Apache symlink race condition #triggers from
# the Apache patch provided by:
# http://www.mail-archive.com/dev@httpd.apache.org/msg55666.html
# This patch has also been included by cPanel via the easyapache #option:
# “Symlink Race Condition Protection”
LF_SYMLINK = “2”
LF_SYMLINK_PERM = “1”# [*]Enable login failure detection of webmin connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_WEBMIN = “1”
LF_WEBMIN_PERM = “1”# Send an email alert if anyone logs in successfully using SSH
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_SSH_EMAIL_ALERT = “1”# Send an email alert if anyone uses su to access another account. This #will
# send an email alert whether the attempt to use su was successful or #not
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_SU_EMAIL_ALERT = “1”# Send an email alert if anyone accesses webmin
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_WEBMIN_EMAIL_ALERT = “1”# Send an email alert if anyone logs in successfully to root on the #console
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_CONSOLE_EMAIL_ALERT = “1”
# System Exploit Checking. This option is designed to perform a series #of tests
# to send an alert in case a possible server compromise is detected
#
# To enable this feature set the following to the checking interval in #seconds
# (a value of 300 would seem sensible).
#
# To disable set to “0”
LF_EXPLOIT = “300”

If you want to Setup Directories that will be Watched for Changes

###############################################################################
# SECTION:Directory Watching & Integrity
###############################################################################
# Enable Directory Watching. This enables lfd to check /tmp and /dev/shm
# directories for suspicious files, i.e. script exploits. If a suspicious
# file is found an email alert is sent. One alert per file per LF_FLUSH
# interval is sent
#
# To enable this feature set the following to the checking interval in seconds.
# To disable set to “0”
LF_DIRWATCH = “1800”# To remove any suspicious files found during directory watching, enable the
# following. These files will be appended to a tarball in
# /var/lib/csf/suspicious.tar
LF_DIRWATCH_DISABLE = “0”# This option allows you to have lfd watch a particular file or directory for
# changes and should they change and email alert using watchalert.txt is sent
#
# To enable this feature set the following to the checking interval in seconds
# (a value of 60 would seem sensible) and add your entries to csf.dirwatch
#
# Set to disable set to “0”
LF_DIRWATCH_FILE = “240”
###############################################################################
# SECTION:Distributed Attacks
###############################################################################
# Distributed Account Attack. This option will keep track of login #failures
# from distributed IP addresses to a specific application account. If the
# number of failures matches the trigger value above, ALL of the IP addresses
# involved in the attack will be blocked according to the temp/perm #rules above
#
# Tracking applies to LF_SSHD, LF_FTPD, LF_SMTPAUTH, LF_POP3D, #LF_IMAPD,
# LF_HTACCESS
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_DISTATTACK = “1”
# Set the following to the minimum number of unique IP addresses #that trigger
# LF_DISTATTACK
LF_DISTATTACK_UNIQ = “3”

 

# Distributed FTP Logins. This option will keep track of successful FTP logins.
# If the number of successful logins to an individual account is at least
# LF_DISTFTP in LF_DIST_INTERVAL from at least LF_DISTFTP_UNIQ IP #addresses,
# then all of the IP addresses will be blocked
#
# This option can help mitigate the common FTP account compromise #attacks that
# use a distributed network of zombies to deface websites
#
# A sensible setting for this might be 5, depending on how many #different
# IP addresses you expect to an individual FTP account within #LF_DIST_INTERVAL
#
# To disable set to “0”
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_DISTFTP = “8”

# Set the following to the minimum number of unique IP addresses #that trigger
# LF_DISTFTP. LF_DISTFTP_UNIQ must be <= LF_DISTFTP for this to #work
LF_DISTFTP_UNIQ = “5”

# If this option is set to 1 the blocks will be permanent
# If this option is > 1, the blocks will be temporary for the specified #number
# of seconds
LF_DISTFTP_PERM = “1”

# Distributed SMTP Logins. This option will keep track of successful #SMTP
# logins. If the number of successful logins to an individual account is #at
# least LF_DISTSMTP in LF_DIST_INTERVAL from at least #LF_DISTSMTP_UNIQ IP
# addresses, then all of the IP addresses will be blocked. These options #only
# apply to the exim MTA
#
# This option can help mitigate the common SMTP account #compromise attacks that
# use a distributed network of zombies to send spam
## A sensible setting for this might be 5, depending on how many #different
# IP addresses you expect to an individual SMTP account within #LF_DIST_INTERVAL
#
# To disable set to “0”
LF_DISTSMTP = “8”

# Set the following to the minimum number of unique IP addresses #that trigger
# LF_DISTSMTP. LF_DISTSMTP_UNIQ must be <= LF_DISTSMTP for this #to work
LF_DISTSMTP_UNIQ = “4”

# If this option is set to 1 the blocks will be permanent
# If this option is > 1, the blocks will be temporary for the specified #number
# of seconds
LF_DISTSMTP_PERM = “1”

# This is the interval during which a distributed FTP or SMTP attack is
# measured
LF_DIST_INTERVAL = “300”

###############################################################################
# SECTION:Login Tracking
###############################################################################
# Block POP3 logins if greater than LT_POP3D times per hour per #account per IP
# address (0=disabled)
#
# This is a temporary block for the rest of the hour, afterwhich the IP is
# unblocked
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LT_POP3D = “10”

# Block IMAP logins if greater than LT_IMAPD times per hour per #account per IP
# address (0=disabled) – not recommended for IMAP logins due to the #ethos
# within which IMAP works. If you want to use this, setting it quite high #is
# probably a good idea
#
# This is a temporary block for the rest of the hour, afterwhich the IP is
# unblocked
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LT_IMAPD = “30”

# Send an email alert if an account exceeds LT_POP3D/LT_IMAPD logins #per hour
# per IP
LT_EMAIL_ALERT = “1”

# If LF_PERMBLOCK is enabled but you do not want this to apply to
# LT_POP3D/LT_IMAPD, then enable this option
LT_SKIPPERMBLOCK = “0”

###############################################################################
# SECTION:Connection Tracking
###############################################################################
# Connection Tracking. This option enables tracking of all connections #from IP
# addresses to the server. If the total number of connections is greater #than
# this value then the offending IP address is blocked. This can be used #to help
# prevent some types of DOS attack.
#
# Care should be taken with this option. It’s entirely possible that you #will
# see false-positives. Some protocols can be connection hungry, e.g. #FTP, IMAPD
# and HTTP so it could be quite easy to trigger, especially with a lot of
# closed connections in TIME_WAIT. However, for a server that is prone #to DOS
# attacks this may be very useful. A reasonable setting for this option #might
# be around 300.
#
# To disable this feature, set this to 0
CT_LIMIT = “500”
# Connection Tracking interval. Set this to the the number of seconds #between
# connection tracking scans
CT_INTERVAL = “30”

 

# Send an email alert if an IP address is blocked due to connection #tracking
CT_EMAIL_ALERT = “1”

# If you want to make IP blocks permanent then set this to 1, otherwise #blocks
# will be temporary and will be cleared after CT_BLOCK_TIME seconds
CT_PERMANENT = “1”

# If you opt for temporary IP blocks for CT, then the following is the #interval
# in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins)
CT_BLOCK_TIME = “1800”

###############################################################################
# SECTION:Process Tracking
###############################################################################
# Process Tracking. This option enables tracking of user and nobody #processes
# and examines them for suspicious executables or open network #ports. Its
# purpose is to identify potential exploit processes that are running on #the
# server, even if they are obfuscated to appear as system services. If a
# suspicious process is found an alert email is sent with relevant #information.
# It is then the responsibility of the recipient to investigate the process
# further as the script takes no further action
#
# The following is the number of seconds a process has to be active #before it
# is inspected. If you set this time too low, then you will likely trigger
# false-positives with CGI or PHP scripts.
# Set the value to 0 to disable this feature
PT_LIMIT = “60”
# How frequently processes are checked in seconds
PT_INTERVAL = “60”
# This User Process Tracking option sends an alert if any linux user #process
# exceeds the memory usage set (MB). To ignore specific processes or #users use
# csf.pignore
#
# Set to 0 to disable this feature
PT_USERMEM = “200”
# Check the PT_LOAD_AVG minute Load Average (can be set to 1 5 or 15 #and
# defaults to 5 if set otherwise) on the server every PT_LOAD seconds. If #the
# load average is greater than or equal to PT_LOAD_LEVEL then an #email alert is
# sent. lfd then does not report subsequent high load until #PT_LOAD_SKIP
# seconds has passed to prevent email floods.
#
# Set PT_LOAD to “0” to disable this feature
PT_LOAD = “20”
PT_LOAD_AVG = “5”
PT_LOAD_LEVEL = “6”
PT_LOAD_SKIP = “3600”
# Fork Bomb Protection. This option checks the number of processes #with the
# same session id and if greater than the value set, the whole session #tree is
# terminated and an alert sent
#
# You can see an example of common session id processes on most #Linux systems
# using: “ps axf -O sid”
#
# On cPanel servers, PT_ALL_USERS should be enabled to use this #option
# effectively
#
# This option will check root owned processes. Session id 0 and 1 will #always
# be ignored as they represent kernel and init processes. csf.pignore #will be
# honoured, but bear in mind that a session tree can contain a variety #of users
# and executables
#
# Care needs to be taken to ensure that this option only detects #runaway fork
# bombs, so should be set higher than any session tree is likely to get 3(e.g.
# httpd could have 100s of legitimate children on very busy systems). A
# sensible starting point on most servers might be 250
PT_FORKBOMB = “250”

Important to Block Port Scan Attempts – Important

###############################################################################
# SECTION:Port Scan Tracking
###############################################################################
# Port Scan Tracking. This feature tracks port blocks logged by #iptables to
# syslog. If an IP address generates a port block that is logged more #than
# PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked.
#
# This feature could, for example, be useful for blocking hackers #attempting
# to access the standard SSH port if you have moved it to a port other #than 22
# and have removed 22 from the TCP_IN list so that connection #attempts to the
# old port are being logged
#
# This feature blocks all iptables blocks from the iptables logs, #including
# repeated attempts to one port or SYN flood blocks, etc
#
# Note: This feature will only track iptables blocks from the log file set #in
# IPTABLES_LOG below and if you have DROP_LOGGING enabled. #However, it will
# cause redundant blocking with DROP_IP_LOGGING enabled
#
# Warning: It’s possible that an elaborate DDOS (i.e. from multiple IP’s)
# could very quickly fill the iptables rule chains and cause a DOS in #itself.
# The DENY_IP_LIMIT should help to mitigate such problems with #permanent blocks
# and the DENY_TEMP_IP_LIMIT with temporary blocks
#
# Set PS_INTERVAL to “0” to disable this feature. A value of between 60 #and 300
# would be sensible to enable this feature
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
PS_INTERVAL = “120”
PS_LIMIT = “10”
# You can specify the ports and/or port ranges that should be tracked #by the
# Port Scan Tracking feature. The following setting is a comma #separated list
# of those ports and uses the same format as TCP_IN. The default #setting of
# 0:65535,ICMP covers all ports
PS_PORTS = “0:65535,ICMP”

# To specify how many different ports qualifies as a Port Scan you can #increase

# the following from the default value of 1. The risk in doing so will #mean
# that persistent attempts to attack a specific closed port will not be
# detected and blocked
PS_DIVERSITY = “1”

# You can select whether IP blocks for Port Scan Tracking should be #temporary
# or permanent. Set PS_PERMANENT to “0” for temporary and “1” for #permanent
# blocking. If set to “0” PS_BLOCK_TIME is the amount of time in #seconds to
# temporarily block the IP address for
PS_PERMANENT = “1”
PS_BLOCK_TIME = “3600”
# Set the following to “1” to enable Port Scan Tracking email alerts, set #to
# “0” to disable them
PS_EMAIL_ALERT = “1”
###############################################################################
# SECTION:User ID Tracking
###############################################################################
# User ID Tracking. This feature tracks UID blocks logged by iptables to
# syslog. If a UID generates a port block that is logged more than UID_LIMIT
# times within UID_INTERVAL seconds, an alert will be sent
#
# Note: This feature will only track iptables blocks from the log file set in
# IPTABLES_LOG and if DROP_OUT_LOGGING and DROP_UID_LOGGING are enabled.
#
# To ignore specific UIDs list them in csf.uidignore and then restart lfd
#
# Set UID_INTERVAL to “0” to disable this feature. A value of between 60 and 300
# would be sensible to enable this feature
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
UID_INTERVAL = “120”
UID_LIMIT = “10”
###############################################################################
# SECTION:Account Tracking
###############################################################################
# Account Tracking. The following options enable the tracking of modifications
# to the accounts on a server. If any of the enabled options are triggered by
# a modifications to an account, an alert email is sent. Only the modification
# is reported. The cause of the modification will have to be investigated
# manually
#
# You can set AT_ALERT to the following:
# 0 = disable this feature
# 1 = enable this feature for all accounts
# 2 = enable this feature only for superuser accounts (UID = 0, e.g. root, etc)
# 3 = enable this feature only for the root account
AT_ALERT = “1”# This options is the interval between checks in seconds
AT_INTERVAL = “60”# Send alert if a new account is created
AT_NEW = “1”# Send alert if an existing account is deleted
AT_OLD = “1”# Send alert if an account password has changed
AT_PASSWD = “1”# Send alert if an account uid has changed
AT_UID = “1”# Send alert if an account gid has changed
AT_GID = “1”# Send alert if an account login directory has changed
AT_DIR = “1”# Send alert if an account login shell has changed
AT_SHELL = “1”
###############################################################################
# SECTION:Log Scanner
###############################################################################
# Log Scanner. This feature will send out an email summary of the log lines of
# each log listed in /etc/csf/csf.logfiles. All lines will be reported unless
# they match a regular expression in /etc/csf/csf.logignore
#
# File globbing is supported for logs listed in /etc/csf/csf.logfiles. However,
# be aware that the more files lfd has to track, the greater the performance
# hit. Note: File globs are only evaluated when lfd is started
#
# Note: lfd builds the report continuously from lines logged after lfd has
# started, so any lines logged when lfd is not running will not be reported
# (e.g. during reboot). If lfd is restarted, then the report will include any
# lines logged during the previous lfd logging period that weren’t reported
#
# 1 to enable, 0 to disable
LOGSCANNER = “1”
# This is the interval each report will be sent based on the logalert.txt
# template
#
# The interval can be set to:
# “hourly” – sent on the hour
# “daily” – sent at midnight (00:00)
# “manual” – sent whenever “csf –logrun” is run. This allows for scheduling
# via cron job
LOGSCANNER_INTERVAL = “hourly”

# Report Style
# 1 = Separate chronological log lines per log file
# 2 = Simply chronological log of all lines
LOGSCANNER_STYLE = “1”

# Send the report email even if no log lines reported
# 1 to enable, 0 to disable
LOGSCANNER_EMPTY = “1”

# Maximum number of lines in the report before it is truncated. This is to
# prevent log lines flooding resulting in an excessively large report. This
# might need to be increased if you choose a daily report
LOGSCANNER_LINES = “3000”

Parallels Plesk Panel 12 Log File Locations:

# Log file locations

HTACCESS_LOG = “/var/log/httpd/error_log”
MODSEC_LOG = “/var/log/httpd/error_log”
SSHD_LOG = “/var/log/secure”
SU_LOG = “/var/log/secure”
FTPD_LOG = “/var/log/secure”
SMTPAUTH_LOG = “/usr/local/psa/var/log/maillog”
POP3D_LOG = “/usr/local/psa/var/log/maillog”
IMAPD_LOG = “/usr/local/psa/var/log/maillog”
IPTABLES_LOG = “/var/log/messages”
SUHOSIN_LOG = “/var/log/messages”
BIND_LOG = “/var/log/messages”
SYSLOG_LOG = “/var/log/messages”
WEBMIN_LOG = “/var/log/secure”
#CUSTOM1_LOG = “/var/www/vhosts/*/logs/access_log”
CUSTOM2_LOG = “/usr/local/psa/admin/logs/sitebuilder.log”
CUSTOM3_LOG = “/var/log/sw-cp-server/error_log”
CUSTOM4_LOG = “/var/www/vhosts/DOMAIN/logs/error_log”
CUSTOM6_LOG = “/var/www/vhosts/DOMAIN/logs/webmail_access_log”
CUSTOM7_LOG = “/usr/local/psa/admin/logs/panel.log”
CUSTOM10_LOG = “/var/log/nginx/error.log”
CUSTOM11_LOG = “/var/log/magicspam/mslog”
If you changed your SSH port change it here.

Now you need to edit the /etc/csf/csf.logfiles and add:

nano /etc/csf/csf.logfiles and make sure none are missing.

# All:
/var/log/messages
/var/log/lfd.log
/var/log/cxswatch.log
/var/log/secure
#/var/log/httpd/access_log
/var/log/httpd/error_log
/usr/local/psa/admin/logs/sitebuilder.log
/usr/local/psa/var/log/maillog
/usr/local/psa/admin/logs/panel.log
#/var/log/nginx/access.log
/var/log/nginx/error.log
/var/log/sw-cp-server/error_log
/var/www/vhosts/system/*/logs/error_log
/var/log/plesk/panel.log

Parallels Plesk Panel 12 Log File Locations:

/var/log/plesk/panel.log
/var/log/maillog
/var/log/psa-horde/psa-horde.log
/var/log/secure
/var/log/plesk-roundcube/errors

/usr/local/psa/admin/logs/sitebuilder.log

/var/log/httpd/error_log

/var/log/nginx/error.log

/var/log/sw-cp-server/error_log

/var/www/vhosts/*/logs/access_log

/var/log/messages

/var/www/vhosts/*/logs/access_log

#/var/log/nginx/access.log

Now you need to edit the /etc/csf/csf.logfiles and put in the correct logs.

Add CloudFlare Capabilities to your Plesk Panel Web Hosting Server

nano /etc/csf/csf.blocklists

You will can add IP Block Lists adding some cloudflare capabilities to your plesk panel 12 web hosting services.

Uncomment:

#Spamhaus Don’t Route Or Peer List (DROP)
# Details: http://www.spamhaus.org/drop/

SPAMDROP|86400|0|http://www.spamhaus.org/drop/drop.lasso

# Spamhaus Extended DROP List (EDROP)
# Details: http://www.spamhaus.org/drop/

SPAMEDROP|86400|0|http://www.spamhaus.org/drop/edrop.lasso

# DShield.org Recommended Block List
# Details: http://dshield.org

DSHIELD|86400|0|http://www.dshield.org/block.txt

# BOGON list
# Details: http://www.team-cymru.org/Services/Bogons/
BOGON|86400|0|http://www.cymru.com/Documents/bogon-bn-agg.txt
# Project Honey Pot Directory of Dictionary Attacker IPs
# Details: http://www.projecthoneypot.org
HONEYPOT|86400|0|http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1
#CIARMY|86400|0|http://www.ciarmy.com/list/ci-badguys.txt
# C.I. Army Malicious IP List
# Details: http://www.ciarmy.com
CIARMY|86400|0|http://www.ciarmy.com/list/ci-badguys.txt
# BruteForceBlocker IP List
# Details: http://danger.rulez.sk/index.php/bruteforceblocker/
BFB|86400|0|http://danger.rulez.sk/projects/bruteforceblocker/blist.php
# Emerging Threats – Russian Business Networks List
# Details:
#http://doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
RBN|86400|0|http://rules.emergingthreats.net/blockrules/rbn-ips.txt
# OpenBL.org 30 day List
# Details: http://www.openbl.org
OPENBL|86400|0|http://www.us.openbl.org/lists/base_30days.txt
# Autoshun Shun List
# Details: http://www.autoshun.org/
AUTOSHUN|86400|0|http://www.autoshun.org/files/shunlist.csv
# MaxMind GeoIP Anonymous Proxies
# Details: http://www.maxmind.com/en/anonymous_proxies
MAXMIND|86400|0|http://www.maxmind.com/en/anonymous_proxies
You will see some TOR networks that you can add to your iptables block lists, but a lot of legitimate consumers are starting to use the TOR Network for their own online anonymity and privacy searching online. I recommend not banning the TOR network as it could block good people that are just trying to stay anonymous.
# TOR Exit Nodes List
#To use this list you’ll probably need vhange URLGET in csf.conf to use
#LWP asthis list uses an SSL connection.Alternatively use ALTTORbelow
#Detai-https://trac.torproject.org/projects/tor/wiki/doc/TorDNSExitList
#TOR|86400|0|http://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1
# Alternative TOR Exit Nodes List
# Details: http://torstatus.blutmagie.de/
#ALTTOR|86400|0|http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv
Remember to always do these 2 commands any time you make any changes to CSF LFD config files.
sudo csf -r
sudo service lfd restart

################################################################################################

Adding legitimate files to be ignored in /etc/csf/csf.pignore

Now for the tricky part. You will need to edit your process and users ignore file to ignore legitimate processes and users:
Tip: check the email address you set in the configuration to send logs you will need to check if you need to ignore anymore users or processes.
cmd:   for commands
exe:    for executables
user:   for users you get the point.
it will basically tell you in the log report sent to your email address on which commands, executables and users to start adding to /etc/csf/csf.pignore . After you put our csf.pignore template inside /etc/csf/csf.pignore . you might have other processes and users you will have to ignore depending on which other services you’re providing.
nano /etc/csf/csf.pignore

## Custom Added ##
exe:/opt/drweb/drwebd.real
cmd:drwebd.real
user:drweb
user:apache
exe:/usr/sbin/httpd
cmd:/usr/sbin/httpd
user:nginx
exe:/usr/sbin/nginx
cmd:/usr/sbin/nginx
cmd:nginx: worker process
user:postfix
exe:/usr/lib64/plesk-9.0/psa-pc-remote
cmd:/usr/lib64/plesk-9.0/psa-pc-remote -p inet:12768@localhost
exe:/usr/libexec/postfix/tlsmgr
cmd:tlsmgr -l -t unix -u
exe:/usr/libexec/postfix/qmgr
cmd:qmgr -l -t fifo -u
exe:/usr/bin/php-cgi
user:hspc
exe:/usr/bin/perl
cmd:/usr/bin/perl /usr/sbin/hspc-plugin-rpc.fcgi

# Plesk process/user template #
user:admin
exe:/var/qmail/bin/qmail-smtpd
exe:/usr/bin/imapd
exe:/var/qmail/bin/qmail-queue
exe:/usr/bin/pop3d
exe:/var/qmail/bin/qmail-send
cmd:qmail-send
cmd:/usr/bin/pop3d Maildir
cmd:/var/qmail/bin/qmail-queue
cmd:/var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
cmd:/usr/bin/imapd Maildir
exe:/var/qmail/bin/qmail-rspawn
cmd:qmail-rspawn
exe:/var/qmail/bin/qmail-clean
cmd:qmail-clean
exe:/usr/sbin/clamd
cmd:clamd
exe:/var/qmail/bin/splogger
cmd:splogger qmail
exe:/var/qmail/bin/qmail-remote.moved
user:qmaill
user:popuser
user:qmaild
user:qmails
user:qmailr
user:qmailq
user:qscand
exe:/usr/sbin/avahi-daemon
user:avahi
exe:/usr/local/sbin/zabbix_agentd
cmd:/usr/local/sbin/zabbix_agentd
user:zabbix
exe:/usr/bin/sw-engine-cgi
cmd:/usr/bin/sw-engine-cgi
user:sso
exe:/usr/sbin/sw-cp-serverd
cmd:/usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
user:sw-cp-server
exe:/usr/bin/sw-engine-cgi
cmd:/usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaadm
user:psaadm
exe:/usr/libexec/mysqld
cmd:/usr/libexec/mysqld -basedir=/usr -datadir=/var/lib/mysql -user=mysql -pid-file=/var/run/mysqld/mysqld.pid -skip-external-locking -socket=/var/lib/mysql/m$
user:mysql
exe:/usr/libexec/hald-addon-acpi
exe:/usr/sbin/hald
cmd:hald
user:haldaemon
exe:/usr/bin/postgres
user:postgres
exe:/sbin/portmap
cmd:portmap
user:rpc
exe:/usr/bin/xfs
cmd:xfs -droppriv -daemon
user:xfs
exe:/usr/bin/python
cmd:/usr/bin/python /usr/lib/mailman/bin/qrunner -runner=VirginRunner:0:1 -s
user:mailman
exe:/usr/java/jdk1.6.0_20/bin/java
user:tomcat

CTRL+X to exit and Y to save changes.
You can always lock down your system even more by adding your IP’s in the /etc/csf/csf.allow and /etc/csf/csf.ignore files. This is highly suggested if you have an infrastructure and have dedicated database servers and or billing servers, offsite servers and similar situations. The ip you logged in from using ssh to install CSF LFD will automatically be stored in that file. if you do not have static ip addresses there’s a dyndns feature.

You have now successfully installed CSF / LFD configserver on your server.

Enable CSF
csf –e

Disable CSF
csf -x

Starting CSF
csf -s

Ban IP:
csf -d 1.2.3.4

Stop CSF
csf –stop

Flush CSF
csf -f

Stop LFD
service lfd stop

Start LFD
service lfd star

  • 1 Users Found This Useful
Was this answer helpful?