Securing your server using CSF (ConfigServer Security & Firewall) goes far beyond just RESTRICT_SYSLOG. Below is a comprehensive, security-hardened configuration guide for your WHM server running CSF v14.24, including:
-
Must-change core firewall settings
-
Brute-force protection (LFD)
-
Process tracking
-
Port security
-
Email alerts
-
Bonus hardening settings
🔐 1. Log Access Protection
✅ Set:
✅ Optional:
🔐 2. Brute Force Protection (LFD)
These settings help defend against login attacks for SSH, cPanel, WHM, email, etc.
✅ Basic brute force protection
✅ Permanent block for known bad behavior:
🧠 3. Process Tracking (Anti-Exploit)
Detect and kill suspicious or excessive processes (common in shell injection attacks).
✅ Enable process tracking
🔐 4. Port Security
✅ Block unused ports (very important)
-
Edit this section:
⚠️ Only open what you use! Close FTP if unused (
20,21), or SMTP if using remote mail.
📡 5. Connection Tracking
Protects against DoS or too many concurrent connections.
✅ Recommended:
📧 6. Email Alerts
✅ Enable admin notifications:
Set your email at:
👁 7. Directory Watching & Suspicious File Alert
✅ Recommended:
🧱 8. Firewall Rate Limiting
Mitigate port scanning and malicious scanning tools.
✅ SYN flood protection:
🚫 9. Disable Ping (optional)
You can block ping requests (ICMP):
⚠️ Note: If you monitor uptime externally (e.g. Pingdom), keep this enabled.
🧹 10. Clean Up and Audit
✅ Block users from compiling code (useful in shared hosting):
✅ Disable IP spoofing and fragment attacks:
📤 Backup Configuration
After applying all settings:
-
Scroll to the bottom
-
Click “Change” and then “Restart csf+lfd”
-
Go back to the main CSF page
-
Use “Backup firewall configuration” to export your setup
🧪 Final Tips
-
Use csf -r from SSH if WHM GUI hangs.
-
Regularly check /var/log/lfd.log for alerts and tune as needed.
-
Pair CSF with ModSecurity and ClamAV for full-stack protection.
