the site can be accessed normally. Nginx+php7, itself is testing the performance of the website and found that after refreshing ip (each web page), it will appear from time to time after 403 forbidden,10 seconds (about), and the page can be accessed normally again. I have installed the csf firewall. I wonder if the rules of the csf firewall are misconfigured. Please have a look, where should I modify it?
the content of the ps: configuration file exceeds the sf limit. Post the previous part
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp SECTION:Initial Settings
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp Testing flag - enables a CRON job that clears iptables incase of
-sharp configuration problems when you start csf. This should be enabled until you
-sharp are sure that the firewall works - i.e. incase you get locked out of your
-sharp server! Then do remember to set it to 0 and restart csf when you"re sure
-sharp everything is OK. Stopping csf will remove the line from /etc/crontab
-sharp
-sharp lfd will not start while this is enabled
TESTING = "0"
-sharp The interval for the crontab in minutes. Since this uses the system clock the
-sharp CRON job will run at the interval past the hour and not from when you issue
-sharp the start command. Therefore an interval of 5 minutes means the firewall
-sharp will be cleared in 0-5 minutes from the firewall start
TESTING_INTERVAL = "5"
-sharp SECURITY WARNING
-sharp ================
-sharp
-sharp Unfortunately, syslog and rsyslog allow end-users to log messages to some
-sharp system logs via the same unix socket that other local services use. This
-sharp means that any log line shown in these system logs that syslog or rsyslog
-sharp maintain can be spoofed (they are exactly the same as real log lines).
-sharp
-sharp Since some of the features of lfd rely on such log lines, spoofed messages
-sharp can cause false-positive matches which can lead to confusion at best, or
-sharp blocking of any innocent IP address or making the server inaccessible at
-sharp worst.
-sharp
-sharp Any option that relies on the log entries in the files listed in
-sharp /etc/syslog.conf and /etc/rsyslog.conf should therefore be considered
-sharp vulnerable to exploitation by end-users and scripts run by end-users.
-sharp
-sharp NOTE: Not all log files are affected as they may not use syslog/rsyslog
-sharp
-sharp The option RESTRICT_SYSLOG disables all these features that rely on affected
-sharp logs. These options are:
-sharp LF_SSHD LF_FTPD LF_IMAPD LF_POP3D LF_BIND LF_SUHOSIN LF_SSH_EMAIL_ALERT
-sharp LF_SU_EMAIL_ALERT LF_CONSOLE_EMAIL_ALERT LF_DISTATTACK LF_DISTFTP
-sharp LT_POP3D LT_IMAPD PS_INTERVAL UID_INTERVAL WEBMIN_LOG LF_WEBMIN_EMAIL_ALERT
-sharp PORTKNOCKING_ALERT
-sharp
-sharp This list of options use the logs but are not disabled by RESTRICT_SYSLOG:
-sharp ST_ENABLE SYSLOG_CHECK LOGSCANNER CUSTOM*_LOG
-sharp
-sharp The following options are still enabled by default on new installations so
-sharp that, on balance, csf/lfd still provides expected levels of security:
-sharp LF_SSHD LF_FTPD LF_POP3D LF_IMAPD LF_SSH_EMAIL_ALERT LF_SU_EMAIL_ALERT
-sharp
-sharp If you set RESTRICT_SYSLOG to "0" or "2" and enable any of the options listed
-sharp above, it should be done with the knowledge that any of the those options
-sharp that are enabled could be triggered by spoofed log lines and lead to the
-sharp server being inaccessible in the worst case. If you do not want to take that
-sharp risk you should set RESTRICT_SYSLOG to "1" and those features will not work
-sharp but you will not be protected from the exploits that they normally help block
-sharp
-sharp The recommended setting for RESTRICT_SYSLOG is "3" to restrict who can access
-sharp the syslog/rsyslog unix socket.
-sharp
-sharp For further advice on how to help mitigate these issues, see
-sharp /etc/csf/readme.txt
-sharp
-sharp 0 = Allow those options listed above to be used and configured
-sharp 1 = Disable all the options listed above and prevent them from being used
-sharp 2 = Disable only alerts about this feature and do nothing else
-sharp 3 = Restrict syslog/rsyslog access to RESTRICT_SYSLOG_GROUP ** RECOMMENDED **
RESTRICT_SYSLOG = "0"
-sharp The following setting is used if RESTRICT_SYSLOG is set to 3. It restricts
-sharp write access to the syslog/rsyslog unix socket(s). The group must not already
-sharp exists in /etc/group before setting RESTRICT_SYSLOG to 3, so set the option
-sharp to a unique name for the server
-sharp
-sharp You can add users to this group by changing /etc/csf/csf.syslogusers and then
-sharp restarting lfd afterwards. This will create the system group and add the
-sharp users from csf.syslogusers if they exist to that group and will change the
-sharp permissions on the syslog/rsyslog unix socket(s). The socket(s) will be
-sharp monitored and the permissions re-applied should syslog/rsyslog be restarted
-sharp
-sharp Using this option will prevent some legitimate logging, e.g. end-user cron
-sharp job logs
-sharp
-sharp If you want to revert RESTRICT_SYSLOG to another option and disable this
-sharp feature, change the setting of RESTRICT_SYSLOG and then restart lfd and then
-sharp syslog/rsyslog and the unix sockets will be reset
RESTRICT_SYSLOG_GROUP = "mysyslog"
-sharp This options restricts the ability to modify settings within this file from
-sharp the csf UI. Should the parent control panel be compromised, these restricted
-sharp options could be used to further compromise the server. For this reason we
-sharp recommend leaving this option set to at least "1" and if any of the
-sharp restricted items need to be changed, they are done so from the root shell
-sharp
-sharp 0 = Unrestricted UI
-sharp 1 = Restricted UI
-sharp 2 = Disabled UI
RESTRICT_UI = "1"
-sharp Enabling auto updates creates a cron job called /etc/cron.d/csf_update which
-sharp runs once per day to see if there is an update to csf+lfd and upgrades if
-sharp available and restarts csf and lfd
-sharp
-sharp You should check for new version announcements at http://blog.configserver.com
AUTO_UPDATES = "1"
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp SECTION:IPv4 Port Settings
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp Lists of ports in the following comma separated lists can be added using a
-sharp colon (e.g. 30000:35000).
-sharp Some kernel/iptables setups do not perform stateful connection tracking
-sharp correctly (typically some virtual servers or custom compiled kernels), so a
-sharp SPI firewall will not function correctly. If this happens, LF_SPI can be set
-sharp to 0 to reconfigure csf as a static firewall.
-sharp
-sharp As connection tracking will not be configured, applications that rely on it
-sharp will not function unless all outgoing ports are opened. Therefore, all
-sharp outgoing connections will be allowed once all other tests have completed. So
-sharp TCP_OUT, UDP_OUT and ICMP_OUT will not have any affect.
-sharp
-sharp If you allow incoming DNS lookups you may need to use the following
-sharp directive in the options{} section of your named.conf:
-sharp
-sharp query-source port 53;
-sharp
-sharp This will force incoming DNS traffic only through port 53
-sharp
-sharp Disabling this option will break firewall functionality that relies on
-sharp stateful packet inspection (e.g. DNAT, PACKET_FILTER) and makes the firewall
-sharp less secure
-sharp
-sharp This option should be set to "1" in all other circumstances
LF_SPI = "1"
-sharp Allow incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,3306"
-sharp Allow outgoing TCP ports
TCP_OUT = "20,21,22,25,53,80,110,113,443,587,993,995,3306"
-sharp Allow incoming UDP ports
UDP_IN = "20,21,53"
-sharp Allow outgoing UDP ports
-sharp To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = "20,21,53,113,123"
-sharp Allow incoming PING. Disabling PING will likely break external uptime
-sharp monitoring
ICMP_IN = "1"
-sharp Set the per IP address incoming ICMP packet rate for PING requests. This
-sharp ratelimits PING requests which if exceeded results in silently rejected
-sharp packets. Disable or increase this value if you are seeing PING drops that you
-sharp do not want
-sharp
-sharp To disable rate limiting set to "0", otherwise set according to the iptables
-sharp documentation for the limit module. For example, "1/s" will limit to one
-sharp packet per second
ICMP_IN_RATE = "1/s"
-sharp Allow outgoing PING
-sharp
-sharp Unless there is a specific reason, this option should NOT be disabled as it
-sharp could break OS functionality
ICMP_OUT = "1"
-sharp Set the per IP address outgoing ICMP packet rate for PING requests. This
-sharp ratelimits PING requests which if exceeded results in silently rejected
-sharp packets. Disable or increase this value if you are seeing PING drops that you
-sharp do not want
-sharp
-sharp Unless there is a specific reason, this option should NOT be enabled as it
-sharp could break OS functionality
-sharp
-sharp To disable rate limiting set to "0", otherwise set according to the iptables
-sharp documentation for the limit module. For example, "1/s" will limit to one
-sharp packet per second
ICMP_OUT_RATE = "0"
-sharp For those with PCI Compliance tools that state that ICMP timestamps (type 13)
-sharp should be dropped, you can enable the following option. Otherwise, there
-sharp appears to be little evidence that it has anything to do with a security risk
-sharp and can impact network performance, so should be left disabled by everyone
-sharp else
ICMP_TIMESTAMPDROP = "0"
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp SECTION:IPv6 Port Settings
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp IPv6: (Requires ip6tables)
-sharp
-sharp Pre v2.6.20 kernels do not perform stateful connection tracking, so a static
-sharp firewall is configured as a fallback instead if IPV6_SPI is set to 0 below
-sharp
-sharp Supported:
-sharp Temporary ACCEPT/DENY, GLOBAL_DENY, GLOBAL_ALLOW, SMTP_BLOCK, LF_PERMBLOCK,
-sharp PACKET_FILTER, Advanced Allow/Deny Filters, RELAY_*, CLUSTER_*, CC6_LOOKUPS,
-sharp SYNFLOOD, LF_NETBLOCK
-sharp
-sharp Supported if CC6_LOOKUPS and CC_LOOKUPS are enabled
-sharp CC_DENY, CC_ALLOW, CC_ALLOW_FILTER, CC_IGNORE, CC_ALLOW_PORTS, CC_DENY_PORTS,
-sharp CC_ALLOW_SMTPAUTH
-sharp
-sharp Supported if ip6tables >= 1.4.3:
-sharp PORTFLOOD, CONNLIMIT
-sharp
-sharp Supported if ip6tables >= 1.4.17 and perl module IO::Socket::INET6 is
-sharp installed:
-sharp MESSENGER DOCKER SMTP_REDIRECT
-sharp
-sharp Not supported:
-sharp ICMP_IN, ICMP_OUT
-sharp
IPV6 = "1"
-sharp IPv6 uses icmpv6 packets very heavily. By default, csf will allow all icmpv6
-sharp traffic in the INPUT and OUTPUT chains. However, this could increase the risk
-sharp of icmpv6 attacks. To restrict incoming icmpv6, set to "1" but may break some
-sharp connection types
IPV6_ICMP_STRICT = "0"
-sharp Pre v2.6.20 kernel must set this option to "0" as no working state module is
-sharp present, so a static firewall is configured as a fallback
-sharp
-sharp A workaround has been added for CentOS/RedHat v5 and custom kernels that do
-sharp not support IPv6 connection tracking by opening ephemeral port range
-sharp 32768:61000. This is only applied if IPV6_SPI is not enabled. This is the
-sharp same workaround implemented by RedHat in the sample default IPv6 rules
-sharp
-sharp As connection tracking will not be configured, applications that rely on it
-sharp will not function unless all outgoing ports are opened. Therefore, all
-sharp outgoing connections will be allowed once all other tests have completed. So
-sharp TCP6_OUT, UDP6_OUT and ICMP6_OUT will not have any affect.
-sharp
-sharp If you allow incoming ipv6 DNS lookups you may need to use the following
-sharp directive in the options{} section of your named.conf:
-sharp
-sharp query-source-v6 port 53;
-sharp
-sharp This will force ipv6 incoming DNS traffic only through port 53
-sharp
-sharp These changes are not necessary if the SPI firewall is used
IPV6_SPI = "1"
-sharp Allow incoming IPv6 TCP ports
TCP6_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,3306"
-sharp Allow outgoing IPv6 TCP ports
TCP6_OUT = "20,21,22,25,53,80,110,113,443,587,993,995,3306"
-sharp Allow incoming IPv6 UDP ports
UDP6_IN = "20,21,53"
-sharp Allow outgoing IPv6 UDP ports
-sharp To allow outgoing traceroute add 33434:33523 to this list
UDP6_OUT = "20,21,53,113,123"
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp SECTION:General Settings
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp By default, csf will auto-configure iptables to filter all traffic except on
-sharp the loopback device. If you only want iptables rules applied to a specific
-sharp NIC, then list it here (e.g. eth1, or eth+)
ETH_DEVICE = ""
-sharp By adding a device to this option, ip6tables can be configured only on the
-sharp specified device. Otherwise, ETH_DEVICE and then the default setting will be
-sharp used
ETH6_DEVICE = ""
-sharp If you don"t want iptables rules applied to specific NICs, then list them in
-sharp a comma separated list (e.g "eth1,eth2")
ETH_DEVICE_SKIP = ""
-sharp This option should be enabled unless the kernel does not support the
-sharp "conntrack" module
-sharp
-sharp To use the deprecated iptables "state" module, change this to 0
USE_CONNTRACK = "1"
-sharp Enable ftp helper via the iptables CT target on supporting kernels (v2.6.34+)
-sharp instead of the current method via /proc/sys/net/netfilter/nf_conntrack_helper
-sharp This will also remove the RELATED target from the global state iptables rule
-sharp
-sharp This is not needed (and will be ignored) if LF_SPI/IPV6_SPI is disabled or
-sharp the raw tables do not exist. The USE_CONNTRACK option should be enabled
-sharp
-sharp To enable this option, set it to your FTP server listening port number
-sharp (normally 21), do NOT set it to "1"
USE_FTPHELPER = "0"
-sharp Check whether syslog is running. Many of the lfd checks require syslog to be
-sharp running correctly. This test will send a coded message to syslog every
-sharp SYSLOG_CHECK seconds. lfd will check SYSLOG_LOG log lines for the coded
-sharp message. If it fails to do so within SYSLOG_CHECK seconds an alert using
-sharp syslogalert.txt is sent
-sharp
-sharp A value of between 300 and 3600 seconds is suggested. Set to 0 to disable
SYSLOG_CHECK = "0"
-sharp Enable this option if you want lfd to ignore (i.e. don"t block) IP addresses
-sharp listed in csf.allow in addition to csf.ignore (the default). This option
-sharp should be used with caution as it would mean that IP"s allowed through the
-sharp firewall from infected PC"s could launch attacks on the server that lfd
-sharp would ignore
IGNORE_ALLOW = "1"
-sharp Enable the following option if you want to apply strict iptables rules to DNS
-sharp traffic (i.e. relying on iptables connection tracking). Enabling this option
-sharp could cause DNS resolution issues both to and from the server but could help
-sharp prevent abuse of the local DNS server
DNS_STRICT = "0"
-sharp Enable the following option if you want to apply strict iptables rules to DNS
-sharp traffic between the server and the nameservers listed in /etc/resolv.conf
-sharp Enabling this option could cause DNS resolution issues both to and from the
-sharp server but could help prevent abuse of the local DNS server
DNS_STRICT_NS = "0"
-sharp Limit the number of IP"s kept in the /etc/csf/csf.deny file
-sharp
-sharp Care should be taken when increasing this value on servers with low memory
-sharp resources or hard limits (such as Virtuozzo/OpenVZ) as too many rules (in the
-sharp thousands) can sometimes cause network slowdown
-sharp
-sharp The value set here is the maximum number of IPs/CIDRs allowed
-sharp if the limit is reached, the entries will be rotated so that the oldest
-sharp entries (i.e. the ones at the top) will be removed and the latest is added.
-sharp The limit is only checked when using csf -d (which is what lfd also uses)
-sharp Set to 0 to disable limiting
-sharp
-sharp For implementations wishing to set this value significantly higher, we
-sharp recommend using the IPSET option
DENY_IP_LIMIT = "200"
-sharp Limit the number of IP"s kept in the temprary IP ban list. If the limit is
-sharp reached the oldest IP"s in the ban list will be removed and allowed
-sharp regardless of the amount of time remaining for the block
-sharp Set to 0 to disable limiting
DENY_TEMP_IP_LIMIT = "100"
-sharp Enable login failure detection daemon (lfd). If set to 0 none of the
-sharp following settings will have any effect as the daemon won"t start.
LF_DAEMON = "1"
-sharp Check whether csf appears to have been stopped and restart if necessary,
-sharp unless TESTING is enabled above. The check is done every 300 seconds
LF_CSF = "1"
-sharp This option uses IPTABLES_SAVE, IPTABLES_RESTORE and IP6TABLES_SAVE,
-sharp IP6TABLES_RESTORE in two ways:
-sharp
-sharp 1. On a clean server reboot the entire csf iptables configuration is saved
-sharp and then restored where possible to provide a near instant firewall
-sharp startup[*]
-sharp
-sharp 2. On csf restart or lfd reloading tables, CC_* as well as SPAMHAUS, DSHIELD,
-sharp BOGON, TOR are loaded using this method in a fraction of the time than if
-sharp this setting is disabled
-sharp
-sharp [*]Not supported on all OS platforms
-sharp
-sharp Set to "0" to disable this functionality
FASTSTART = "1"
-sharp This option allows you to use ipset v6+ for the following csf options:
-sharp CC_* and /etc/csf/csf.blocklist, /etc/csf/csf.allow, /etc/csf/csf.deny,
-sharp GLOBAL_DENY, GLOBAL_ALLOW, DYNDNS, GLOBAL_DYNDNS, MESSENGER
-sharp
-sharp ipset will only be used with the above options when listing IPs and CIDRs.
-sharp Advanced Allow Filters and temporary blocks use traditional iptables
-sharp
-sharp Using ipset moves the onus of ip matching against large lists away from
-sharp iptables rules and to a purpose built and optimised database matching
-sharp utility. It also simplifies the switching in of updated lists
-sharp
-sharp To use this option you must have a fully functioning installation of ipset
-sharp installed either via rpm or source from http://ipset.netfilter.org/
-sharp
-sharp Note: Using ipset has many advantages, some disadvantages are that you will
-sharp no longer see packet and byte counts against IPs and it makes identifying
-sharp blocked/allowed IPs that little bit harder
-sharp
-sharp Note: If you mainly use IP address only entries in csf.deny, you can increase
-sharp the value of DENY_IP_LIMIT significantly if you wish
-sharp
-sharp Note: It"s highly unlikely that ipset will function on Virtuozzo/OpenVZ
-sharp containers even if it has been installed
-sharp
-sharp If you find any problems, please post on forums.configserver.com with full
-sharp details of the issue
LF_IPSET = "0"
-sharp Versions of iptables greater or equal to v1.4.20 should support the --wait
-sharp option. This forces iptables commands that use the option to wait until a
-sharp lock by any other process using iptables completes, rather than simply
-sharp failing
-sharp
-sharp Enabling this feature will add the --wait option to iptables commands
-sharp
-sharp NOTE: The disadvantage of using this option is that any iptables command that
-sharp uses it will hang until the lock is released. This could cause a cascade of
-sharp hung processes trying to issue iptables commands. To try and avoid this issue
-sharp csf uses a last ditch timeout, WAITLOCK_TIMEOUT in seconds, that will trigger
-sharp a failure if reached
WAITLOCK = "1"
WAITLOCK_TIMEOUT = "300"
-sharp The following sets the hashsize for ipset sets, which must be a power of 2.
-sharp
-sharp Note: Increasing this value will consume more memory for all sets
-sharp Default: "1024"
LF_IPSET_HASHSIZE = "1024"
-sharp The following sets the maxelem for ipset sets.
-sharp
-sharp Note: Increasing this value will consume more memory for all sets
-sharp Default: "65536"
LF_IPSET_MAXELEM = "65536"
-sharp If you enable this option then whenever a CLI request to restart csf is used
-sharp lfd will restart csf instead within LF_PARSE seconds
-sharp
-sharp This feature can be helpful for restarting configurations that cannot use
-sharp FASTSTART
LFDSTART = "0"
-sharp Enable verbose output of iptables commands
VERBOSE = "1"
-sharp Drop out of order packets and packets in an INVALID state in iptables
-sharp connection tracking
PACKET_FILTER = "1"
-sharp Perform reverse DNS lookups on IP addresses. (See also CC_LOOKUPS)
LF_LOOKUPS = "1"
-sharp Custom styling is possible in the csf UI. See the readme.txt for more
-sharp information under "UI skinning and Mobile View"
-sharp
-sharp This option enables the use of custom styling. If the styling fails to work
-sharp correctly, e.g. custom styling does not take into account a change in the
-sharp standard csf UI, then disabling this option will return the standard UI
STYLE_CUSTOM = "0"
-sharp This option disables the presence of the Mobile View in the csf UI
STYLE_MOBILE = "1"
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp SECTION:SMTP Settings
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp Block outgoing SMTP except for root, exim and mailman (forces scripts/users
-sharp to use the exim/sendmail binary instead of sockets access). This replaces the
-sharp protection as WHM > Tweak Settings > SMTP Tweaks
-sharp
-sharp This option uses the iptables ipt_owner/xt_owner module and must be loaded
-sharp for it to work. It may not be available on some VPS platforms
-sharp
-sharp Note: Run /etc/csf/csftest.pl to check whether this option will function on
-sharp this server
SMTP_BLOCK = "0"
-sharp If SMTP_BLOCK is enabled but you want to allow local connections to port 25
-sharp on the server (e.g. for webmail or web scripts) then enable this option to
-sharp allow outgoing SMTP connections to the loopback device
SMTP_ALLOWLOCAL = "1"
-sharp This option redirects outgoing SMTP connections destined for remote servers
-sharp for non-bypass users to the local SMTP server to force local relaying of
-sharp email. Such email may require authentication (SMTP AUTH)
SMTP_REDIRECT = "0"
-sharp This is a comma separated list of the ports to block. You should list all
-sharp ports that exim is configured to listen on
SMTP_PORTS = "25,465,587"
-sharp Always allow the following comma separated users and groups to bypass
-sharp SMTP_BLOCK
-sharp
-sharp Note: root (UID:0) is always allowed
SMTP_ALLOWUSER = ""
SMTP_ALLOWGROUP = "mail,mailman"
-sharp This option will only allow SMTP AUTH to be advertised to the IP addresses
-sharp listed in /etc/csf/csf.smtpauth on EXIM mail servers
-sharp
-sharp The additional option CC_ALLOW_SMTPAUTH can be used with this option to
-sharp additionally restrict access to specific countries
-sharp
-sharp This is to help limit attempts at distributed attacks against SMTP AUTH which
-sharp are difficult to achive since port 25 needs to be open to relay email
-sharp
-sharp The reason why this works is that if EXIM does not advertise SMTP AUTH on a
-sharp connection, then SMTP AUTH will not accept logins, defeating the attacks
-sharp without restricting mail relaying
-sharp
-sharp Note: csf and lfd must be restarted if /etc/csf/csf.smtpauth is modified so
-sharp that the lookup file in /etc/exim.smtpauth is regenerated from the
-sharp information from /etc/csf/csf.smtpauth plus any countries listed in
-sharp CC_ALLOW_SMTPAUTH
-sharp
-sharp NOTE: To make this option work you MUST make the modifications to exim.conf
-sharp as explained in "Exim SMTP AUTH Restriction" section in /etc/csf/readme.txt
-sharp after enabling the option here, otherwise this option will not work
-sharp
-sharp To enable this option, set to 1 and make the exim configuration changes
-sharp To disable this option, set to 0 and undo the exim configuration changes
SMTPAUTH_RESTRICT = "0"
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp SECTION:Port Flood Settings
-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp-sharp
-sharp Enable SYN Flood Protection. This option configures iptables to offer some
-sharp protection from tcp SYN packet DOS attempts. You should set the RATE so that
-sharp false-positives are kept to a minimum otherwise visitors may see connection
-sharp issues (check /var/log/messages for *SYNFLOOD Blocked*). See the iptables
-sharp man page for the correct --limit rate syntax
-sharp
-sharp Note: This option should ONLY be enabled if you know you are under a SYN
-sharp flood attack as it will slow down all new connections from any IP address to
-sharp the server if triggered
SYNFLOOD = "0"
SYNFLOOD_RATE = "100/s"
SYNFLOOD_BURST = "150"
-sharp Connection Limit Protection. This option configures iptables to offer more
-sharp protection from DOS attacks against specific ports. It can also be used as a
-sharp way to simply limit resource usage by IP address to specific server services.
-sharp This option limits the number of concurrent new connections per IP address
-sharp that can be made to specific ports
-sharp
-sharp This feature does not work on servers that do not have the iptables module
-sharp xt_connlimit loaded. Typically, this will be with MONOLITHIC kernels. VPS
-sharp server admins should check with their VPS host provider that the iptables
-sharp module is included
-sharp
-sharp For further information and syntax refer to the Connection Limit Protection
-sharp section of the csf readme.txt
-sharp
-sharp Note: Run /etc/csf/csftest.pl to check whether this option will function on
-sharp this server