CSF
CSF (Config Server Firewall) is an iptables management script and logging daemon.
Command Line Options
csf -h - get help for CSF command line options
csf -g IP_Address - Look (grep) for an IP address to see if it's blocked
csf -a IP_Address - permanently allows the specified IP address
csf -d IP_Address "Your comment goes here" - Blocks the specified IP address, comment tells why
csf -dr IP_Address - Removes a blocked IP from being blocked
csf -ra - Restart CSF and LFD (leave off the a to restart just CSF)
Configuration Files
CSF and LFD settings are stored in:
/etc/csf
csf.conf - main CSF configuration file
Logs
See Log Locations
LFD (the logging daemon component of CSF) by default sends e-mails to root. If you want to send the e-mails somewhere else, you have two options:
- Specify an e-mail address in LF_ALERT_TO = in csf.conf
- Setup a forwarder in WHM>>Server Contacts>>Edit System Mail Preferences (this is the preferred method for cPanel servers.)
There is a third option.
LFD stores all the alert templates in: /etc/csf/alerts
If the LF_ALERT_TO = setting in csf.conf is blank, LFD will use the settings in the templates.
You can change the "from" and "to" settings in these templates to change where the e-mails for each are delivered, but you have to modify each template (as opposed to changing them all at once in csf.conf)
This does give you the option to specify a different e-mail address for each alert.