Installing and Optimizing CSF: A Comprehensive Guide

ConfigServer Security & Firewall (CSF) is a firewall manager and login-failure daemon for Linux servers, long popular on servers running cPanel or DirectAdmin. This guide explains how to install it on a server you manage, the first settings to get right, and which options are worth tuning. It also covers what changed in 2025, because that should shape whether you install CSF at all on a new server.

1. What CSF does

CSF has two parts that work together:

2. CSF's status in 2026

Way to the Web, the company behind ConfigServer and CSF, stopped developing CSF in 2025. The code was released as open source, and continued versions are distributed by others, but support for each operating system and control panel now depends on which version you use. When we checked on 24 September 2026, the original ConfigServer download site did not respond, so the wget install commands in older guides, including earlier versions of this one, no longer work.

3. CSF or the built-in firewall?

For the built-in tools, follow Modern firewall management with nftables or the firewall guide. The rest of this article assumes you have chosen CSF.

4. Before you install

• Use a supported operating system. CentOS 7 and 8 are end of life. Use AlmaLinux or Rocky Linux 8 or 9, or a current Ubuntu or Debian LTS release.
• Install the Perl modules CSF needs. On AlmaLinux or Rocky Linux: dnf install perl-libwww-perl perl-LWP-Protocol-https perl-Time-HiRes. On Ubuntu or Debian: apt install libwww-perl liblwp-protocol-https-perl.
• Run one firewall manager only. CSF, firewalld and ufw each expect to own the rules. Before you enable CSF, stop the other with systemctl disable --now firewalld or ufw disable.
• Have a way back in. Find your provider's web console before you start. It works even when the firewall blocks SSH.

5. Install and run the self-test

The installer is a shell script inside the CSF archive. With the archive from your chosen source downloaded to /usr/src:

cd /usr/src
tar -xzf csf.tgz
cd csf
sh install.sh

# check that the kernel and iptables support everything CSF uses
perl /usr/local/csf/bin/csftest.pl

Every line of csftest.pl should end in OK. On AlmaLinux and Rocky Linux 8 and later, the iptables command writes nftables rules behind the scenes, and CSF works through it unchanged; see managing CSF rules with nftables.

6. First configuration, safely

All main settings live in /etc/csf/csf.conf. Change them in this order:

Keep your own extra rules in /etc/csf/csfpre.sh or /etc/csf/csfpost.sh. CSF rebuilds its rules on every restart, so rules added any other way disappear.

7. Optimising CSF: the settings that matter

Login failures (lfd). These give the most protection for the least risk. Each service has a limit and an optional block time:

LF_SSHD = "5"
LF_SSHD_PERM = "3600"
LF_FTPD = "10"
LF_SMTPAUTH = "10"
LF_POP3D = "10"
LF_IMAPD = "10"
LF_TRIGGER = "0"

A _PERM value of 1 blocks permanently; a larger number is a block time in seconds. Temporary blocks are kinder to users who mistype a password. Leave LF_TRIGGER at 0, or one shared count replaces all the per-service limits.

Connection limits. CT_LIMIT, CONNLIMIT and PORTFLOOD slow down connection floods from a few IPs. Start with generous values and tighten slowly, because many real visitors can share one IP address. Safe starting values and the limits of what CSF can stop are in mitigating DDoS attacks using CSF. Leave SYNFLOOD off unless you are under a SYN flood.

Blocklists. /etc/csf/csf.blocklists contains commented-out examples of public IP blocklists. Enable only lists whose terms allow your use, and turn on LF_IPSET = "1" so large lists don't slow the firewall down.

Country rules. CC_DENY and CC_ALLOW need a GeoIP data source, chosen with CC_SRC; the MaxMind option needs a free licence key. Blocking whole countries also blocks your own customers and staff when they travel, so use it sparingly.

File and process alerts. LF_DIRWATCH is an interval in seconds for checking temporary folders for suspicious files, not a list of folders. To be alerted when specific files change, list them in LF_DIRWATCH_FILE. Process tracking (PT_USERMEM, PT_USERTIME) warns about processes that use too much memory or run too long.

8. Everyday commands and logs

csf -a 203.0.113.10 "office"   # always allow an IP
csf -d 198.51.100.7 "abuse"    # block an IP permanently
csf -dr 198.51.100.7           # remove a permanent block
csf -td 198.51.100.7 3600      # block for one hour
csf -tr 198.51.100.7           # remove a temporary block
csf -g 198.51.100.7            # which rule matches this IP?
csf -ra                        # restart csf and lfd after a config change

Blocks and their reasons are written to /var/log/lfd.log; read it after every change. If you lock yourself out, use your provider's console and run csf -x to disable CSF, fix the setting, then csf -e to enable it again.

Before a big change, back up the folder with cp -a /etc/csf /root/csf-backup-$(date +%F). If your version's updates have stopped, plan a move to a maintained firewall.

9. Running this on Domain India

On Domain India shared hosting, the firewall is already managed for every account on the server. Measured on 20 September 2026, our cPanel and DirectAdmin servers run CSF alongside Imunify360, and the cPanel servers also have Imunify360's denial-of-service protection switched on. There is nothing for you to install. If you are blocked, follow how to diagnose and resolve CSF IP blocks.

A Domain India VPS is self-managed with full root access, so you choose and run the firewall: CSF from a maintained source, firewalld, ufw or nftables. cPanel is not offered on a VPS. The card shows the Domain India list price on 19 September 2026, excluding 18% GST.

Frequently asked questions

Ready to run your own firewall? Compare VPS plans, read the VPS security checklist, or open a support ticket with your public IP address if you are blocked from a Domain India server.