CSF Command Line Options

Home · Start Here · Reference Map

At a glance

• Primary CSF configuration files and their purposes.
• How comments, rotation, and do not delete protection work.
• Include-based config composition for maintainable setups.
• CLI vs file-edit syntax differences.

When to use this page

Your intent	Go to
Config file reference, Include support, comment rules (you're here)	This page
Quick syntax lookup for CLI commands	Cheatsheet: Commands
Step-by-step workflow with context and warnings	CLI Guide

Getting started with the CLI

Before configuring CSF for the first time, validate your system supports the required netfilter modules:

perl /etc/csf/csftest.pl

For full command help:

man csf
csf -h

For a compact command reference, see Cheatsheet: Commands. For workflow-oriented guidance, see CLI Guide.

Core config files

File	Purpose
/etc/csf/csf.conf	Main behavior and feature toggles — the primary config file with inline documentation
/etc/csf/csf.allow	Permanent allow entries (IPs and CIDRs that always pass the firewall)
/etc/csf/csf.deny	Permanent deny entries (IPs and CIDRs that are always blocked)
/etc/csf/csf.ignore	Entries LFD should not auto-block (exempts from login failure detection)
/etc/csf/csf.*ignore	Feature-specific ignore files — see each file for its purpose and syntax

If you modify any of these files directly, you must restart CSF and LFD (csf -ra) for changes to take effect. CLI commands (csf -a, csf -d, etc.) handle the restart automatically.

Comment and rotation behavior

File-edit comment syntax

In csf.allow and csf.deny, keep comments on the same line as the IP using <space>#<space>:

11.22.33.44 # Added because I don't like them

Important: Comments on a separate line will be lost during csf.deny rotation cleanup.

CLI comment syntax

When using CLI commands, do not use # — pass the comment as plain text:

csf -d 11.22.33.44 Added because I don't like them

CLI-added comments are automatically timestamped. LFD-triggered blocks also include a descriptive comment with timestamp.

Protecting entries from rotation

csf.deny has a line limit (DENY_IP_LIMIT). When the limit is reached, older entries are rotated out. To protect a specific entry from rotation, include do not delete in the comment:

11.22.33.44 # Added because I don't like them. do not delete

Recommended change workflow

1. Run csftest.pl before first enablement and after major kernel/network changes.
2. Edit the target config files.
3. Keep comments on the same line as the IP/rule.
4. Reload with csf -ra so changes apply to both CSF and LFD.
5. Verify behavior in /var/log/lfd.log.

For a more detailed safe change workflow with pitfall prevention, see CLI Guide → Safe change workflow.

Include statement support

Use Include /full/path/file in supported files to split policy by environment, team, or automation layer.

Example in csf.allow:

Include /etc/csf/csf.alsoallow

Rules:

• Include paths must be absolute.
• Do not append trailing comments to an Include line — this invalidates the line.
• CSF add/remove commands apply to the primary file only, not Include files (Include files are treated as read-only by the CLI).

Files that support Include

Config file	Purpose
/etc/csf/csf.allow	Permanent allow list
/etc/csf/csf.blocklists	External block list sources
/etc/csf/csf.cloudflare	Cloudflare integration config
/etc/csf/csf.deny	Permanent deny list
/etc/csf/csf.dirwatch	Directory watch paths
/etc/csf/csf.dyndns	Dynamic DNS hostnames
/etc/csf/csf.fignore	File integrity check ignores
/etc/csf/csf.ignore	LFD ignore list
/etc/csf/csf.logfiles	Custom log files for LFD monitoring
/etc/csf/csf.logignore	Log scanner ignore patterns
/etc/csf/csf.mignore	Messenger ignore list
/etc/csf/csf.pignore	Process tracking ignores
/etc/csf/csf.rblconf	RBL lookup configuration
/etc/csf/csf.redirect	Port/IP redirection rules
/etc/csf/csf.rignore	Resource usage ignore list
/etc/csf/csf.signore	Script tracking ignores
/etc/csf/csf.sips	Server IP addresses
/etc/csf/csf.smtpauth	SMTP auth restriction list
/etc/csf/csf.suignore	Superuser tracking ignores
/etc/csf/csf.syslogs	Syslog source files
/etc/csf/csf.syslogusers	Syslog user list
/etc/csf/csf.uidignore	User ID tracking ignores

Last reviewed: 2026-02-25

---

← Previous: lfd Principles · Next: lfd Command Line Options