one,Download and install
01.cd /usr/local/src
02.wget http://www.configserver.com/free/csf.tgz
03.tar -zxvf csf.tgz
04.cd csf
05../install.sh
two,CSF configuration
To HypeVm and normal use of lxadmin,Need to add 777 *,888*5558 port and support
1,配置端口(/etc/csf/csf.conf)
Increase TCP port supports (HypeVm and Lxadmin required):7776,7777,7778,7779,8886,8887,8888,8889,5558
# Allow incoming TCP ports
TCP_IN = “20,21,22,25,53,80,110,143,443,465,587,993,995,7776,7777,7778,7779,8886,8887,8888,8889,5558”
# Allow outgoing TCP ports
TCP_OUT = “20,21,22,25,53,80,110,113,443,7776,7777,7778,7779,8886,8887,8888,8889,5558”
2,打开MONOLITHIC_KERNEL支持(/etc/csf/csf.conf)
01.# One example is if the ip_conntrack and ip_conntrack_ftp iptables kernel
02.# modules are not available. If this happens, FTP passive mode (PASV) won’t
03.# work. In such circumstances you will have to open a hole in your firewall and
04.# configure the FTP daemon to use that same hole. For example, with pure-ftpd
05.# you could add the port range 30000:35000 to TCP_IN and add the following line
06.# to /etc/pure-ftpd.conf (without the leading #):
07.# PassivePortRange 30000 35000
08.# Then restart pure-ftpd and csf and passive FTP should then work
09.MONOLITHIC_KERNEL = “1”
3,If you want to be able to ping the server with your HyperVm,Need to set (/etc/csf/csf.conf):
01.# Allow incoming PING
02.ICMP_IN = “1”.
4,If you are using virtualization technology OpenVz,You need to add the following statement to your file /etc/csf/csfpre.sh:
01.iptables -A INPUT -i venet0 -j ACCEPT
02.iptables -A OUTPUT -o venet0 -j ACCEPT
03.iptables -A FORWARD -j ACCEPT -p all -s 0/0 -i venet0
04.iptables -A FORWARD -j ACCEPT -p all -s 0/0 -o venet0
Note 1:/etc / csf / csfpre.sh may not exist,You need to create it。Each time you run the CSF will execute this file。
three,CSF test
01.service csf start
If the words,Turn off the test function (Configuration /etc/csf/csf.conf)
01.# Testing flag – enables a CRON job that clears iptables incase of
02.# configuration problems when you start csf. This should be enabled until you
03.# are sure that the firewall works – i.e. incase you get locked out of your
04.# server! Then do remember to set it to 0 and restart csf when you’re sure
05.# everything is OK. Stopping csf will remove the line from /etc/crontab
06.TESTING = “0”
four、Restart CSF
01.service csf restart
Fives、Advanced configuration (/etc/csf/csf.conf)
You can turn off the tracking process and the user process。
01.PT_USERTIME = “0”
02.PT_LIMIT = “0”
03.PT_USERPROC = “0”