Skip to content

Cheatsheet Structure

Jump to bottom
Heisenbug edited this page Mar 5, 2026 · 1 revision

Home · Cheatsheet: Home

At a glance

  • Quick map of CSF/LFD files and folders you will touch most.
  • Prioritizes operational paths over exhaustive internals.
  • Includes “where to edit what” shortcuts.

Core directories

  • /etc/csf/ — primary configuration and policy files
  • /etc/csf/ui/ — integrated WebUI certs and access lists
  • /var/lib/csf/ — runtime/cache/state and generated data
  • /usr/local/csf/bin/ — helper scripts (csftest.pl, loaders, uninstall)
  • /usr/local/csf/lib/ — Perl modules and internal logic
  • /usr/local/csf/tpl/ — alert/message templates
  • /usr/local/include/csf/pre.d/ — scripts run before CSF rule load
  • /usr/local/include/csf/post.d/ — scripts run after CSF rule load

High-touch files

  • /etc/csf/csf.conf — main feature flags and policy behavior
  • /etc/csf/csf.allow — permanent allow entries
  • /etc/csf/csf.deny — permanent deny entries
  • /etc/csf/csf.ignore — sources LFD should ignore
  • /etc/csf/csf.blocklists — external feed definitions
  • /etc/csf/csf.pignore — process tracking ignore rules
  • /etc/csf/csf.fignore — directory watch ignore rules
  • /etc/csf/csf.redirect — port/IP redirection rules
  • /etc/csf/ui/ui.allow — allowed WebUI source IPs/CIDRs
  • /etc/csf/ui/ui.ban — WebUI denied IPs
  • /var/log/lfd.log — primary security and operational log stream

Service and executable paths

  • /usr/sbin/csf — CSF CLI entrypoint
  • /usr/sbin/lfd — Login Failure Daemon
  • /lib/systemd/system/csf.service — CSF service unit
  • /lib/systemd/system/lfd.service — LFD service unit

Where to edit what (quick routing)

  • Open/close ports → csf.conf (TCP_IN/TCP_OUT/UDP_IN/UDP_OUT)
  • Permanent trust/block decisions → csf.allow / csf.deny
  • Noisy trusted process exclusions → csf.pignore
  • Large reputation feeds → csf.blocklists
  • Custom startup firewall logic → pre.d/ and post.d/
  • WebUI access problems → ui.allow, ui.ban, and /var/log/lfd.log

Common pitfalls

  • Editing deep internal files under /usr/local/csf/lib/ without a clear need.
  • Forgetting that pre.d and post.d run at different phases.
  • Troubleshooting UI issues without checking ui.allow first.

See also

Last reviewed: 2026-02-27

← Previous: Cheatsheet: Home · Next: Cheatsheet: Commands

CSF Docs

Core

Operations

Hardening

Integrations

Troubleshooting

Cheatsheets

Reference

Clone this wiki locally