Cheatsheet Example Configs

Home · Cheatsheet: Home

At a glance

• Starter csf.conf templates for common deployment shapes.
• Designed for first-pass rollout, not final hardening.
• Prioritizes safe onboarding with TESTING="1".

Important scope note

These examples are illustrative baselines only. Final values must match your actual services, threat model, and operational requirements.

Profile A: Minimal web node

TESTING = "1"

TCP_IN = "22,80,443"
TCP_OUT = "22,53,80,443"

UDP_IN = "53"
UDP_OUT = "53,123"

DENY_IP_LIMIT = "200"
DENY_TEMP_IP_LIMIT = "200"

CT_LIMIT = "0"

UI = "0"
UI_BLOCK_PRIVATE_NET = "1"

Use when the server only needs SSH + web ingress and basic DNS/NTP egress.

Profile B: Web + mail node

TESTING = "1"

TCP_IN = "22,25,53,80,110,143,443,465,587,993,995"
TCP_OUT = "22,25,53,80,110,143,443,465,587,993,995"

UDP_IN = "53"
UDP_OUT = "53,123"

DENY_IP_LIMIT = "200"
DENY_TEMP_IP_LIMIT = "200"

CT_LIMIT = "0"

UI = "0"
UI_BLOCK_PRIVATE_NET = "1"

Use when the host provides web + SMTP/IMAP/POP services directly.

Profile C: Managed UI-enabled admin node

TESTING = "1"

TCP_IN = "22,443,8750"
TCP_OUT = "22,53,80,443"

UDP_IN = "53"
UDP_OUT = "53,123"

UI = "1"
UI_PORT = "8750"
UI_IP = ""
UI_BLOCK_PRIVATE_NET = "1"

If you enable UI, also maintain /etc/csf/ui/ui.allow strictly.

See: Integrated User Interface Feature

Profile D: Database server (no web)

TESTING = "1"

TCP_IN = "22,3306"
TCP_OUT = "22,53,80,443"

UDP_IN = ""
UDP_OUT = "53,123"

DENY_IP_LIMIT = "200"
DENY_TEMP_IP_LIMIT = "200"

CT_LIMIT = "0"

UI = "0"
UI_BLOCK_PRIVATE_NET = "1"

Use when the server runs MySQL/MariaDB only. Consider restricting port 3306 further with advanced allow filters to specific application server IPs.

See: Advanced Allow/Deny Filters

Apply safely

1. Keep TESTING="1" while validating.
2. Run:

perl /etc/csf/csftest.pl
csf -ra

3. Verify trusted management access.
4. Review /var/log/lfd.log.
5. Only then set TESTING="0" and csf -ra again.

Common pitfalls

• Copy/paste policy drift: opening ports for services that are not installed.
• Disabling TESTING too early: validate from external client paths first.
• Enabling UI without allowlist controls: always pair with ui.allow and safe porting.
• Ignoring outbound policy: restrictive TCP_OUT/UDP_OUT can break updates/DNS/mail unexpectedly.

Deployment runbook mapping

These example profiles correspond to the scenario-specific deployment runbooks:

Profile	Matching runbook
Profile A: Minimal web node	Runbook 1: Single VPS (Web Only)
Profile B: Web + mail node	Runbook 2: Web + Mail Server
Profile C: UI-enabled admin node	— (no dedicated runbook; see Integrated UI)
Profile D: Database server	Runbook 5: Database Server Hardening

For full step-by-step walkthroughs including prerequisites, validation checklists, and rollback procedures, see Deployment Runbooks.

See also

• Configuration Guide
• Integrated User Interface Feature
• Troubleshooting & Recovery

Last reviewed: 2026-02-27

---

← Previous: Cheatsheet: Commands · Back to Cheatsheet: Home