Secure your server with CSF

By stingray454 // 8 years ago

Clone

This recipe installs CSF - ConfigServer Security & Firewall ( see http://configserver.com/cp/csf.html ). CSF adds firewall and numerous security settings to your server, and is recommended to install on any fresh Forge server to keep it safe. For a full list of changes made, please refer to the CSF site above. This recipe must be run as root. Change the ADMIN_IP variable to the IP of a server administrator (used for whitelisting).

# Your IP.
# NOTE! CHANGE THIS VARIABLE TO THE IP OF THE SERVER ADMIN
ADMIN_IP="111.111.111.111"

# Install needed components
echo ">> Installing perl components"
apt-get --assume-yes install libwww-perl liblwp-protocol-https-perl

# Install CSF
echo ">> Installing CSF"
cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
cd /etc/csf/

# Disable testing mode
echo ">> CSF CONFIG: Disabling testing mode"
sed -i '/TESTING /s/= .*/= "0"/' csf.conf

# Restrict syslog
echo ">> CSF CONFIG: Restricting syslog"
sed -i '/RESTRICT_SYSLOG /s/= .*/= "3"/' csf.conf

# Add admin IP to whitelist
echo ">> Whitelisting admin IP"
echo "$ADMIN_IP # IP of server admin, added by CSF Installation Forge Recipe" >> csf.allow

# Whitelist common forge processes
echo ">> Whitelisting common Forge processes"
echo "exe:/usr/sbin/php5-fpm" >> csf.pignore
echo "exe:/usr/sbin/nginx" >> csf.pignore
echo "exe:/usr/bin/redis-server" >> csf.pignore
echo "exe:/usr/sbin/mysqld" >> csf.pignore
echo "exe:/usr/bin/beanstalkd" >> csf.pignore
echo "exe:/usr/bin/memcached" >> csf.pignore
echo "exe:/usr/sbin/atd" >> csf.pignore
echo "exe:/usr/sbin/rsyslogd" >> csf.pignore
echo "exe:/usr/local/bin/composer" >> csf.pignore
echo "exe:/bin/bash" >> csf.pignore
echo "pexe:/usr/lib/postgresql/.*/bin/postgres" >> csf.pignore
echo "pexe:/usr/lib/postfix/.*" >> csf.pignore
echo "user:postfix" >> csf.pignore

# Restart
echo ">> Restarting CSF"
csf -r
echo ">> Restarting LFD"
service lfd restart

# Done
echo "Installation completed!"

Site maintained by Vince Mitchell.

Inspired by original by David Hemphill, Tanner Hearne, & Matt Stauffer.