Integrated User Interface Feature

Home · Start Here · Reference Map

At a glance

• CSF can expose an integrated HTTPS admin UI managed by LFD.
• Successful UI login grants high privilege; treat as a sensitive admin surface.
• Correct SSL files, allowlisting, and port selection are required for reliable access.

Related guide: Integrations-Guide

Security model (read first)

The integrated UI runs in the CSF/LFD stack and is intended for administrative use.

Because this interface can provide root-level control after authentication, keep exposure minimal:

• bind narrowly where possible
• allowlist only trusted source IPs
• avoid broad internet exposure without extra controls (VPN/reverse proxy/tunnel)

Required components

• openssl
• Perl SSL modules (for example Net::SSLeay, IO::Socket::SSL)
• UI certificate and key files
• Explicit client allowlist entries

Key files

• /etc/csf/csf.conf (UI settings)
• /etc/csf/ui/server.key
• /etc/csf/ui/server.crt
• /etc/csf/ui/ui.allow
• /etc/csf/ui/ui.ban
• /var/log/lfd.log

Recommended setup workflow

1. Enable/configure UI settings in csf.conf:

UI = "1"
UI_PORT = "8750"
UI_IP = ""
UI_USER = "<strong-admin-user>"
UI_PASS = "<strong-admin-password>"

2. Add trusted client IPs to /etc/csf/ui/ui.allow (one per line):

127.0.0.1
203.0.113.10

3. Reload services:

csf -ra

4. Open the UI:

https://<server-or-domain>:8750

Port choice matters

The historical default port 6666 is commonly treated as restricted/unsafe by modern browsers (for example ERR_UNSAFE_PORT or “This address is restricted”).

Use a different high, unprivileged port (for example 8750) to avoid browser-level blocking.

Verification and diagnostics

Check service state:

systemctl status lfd 2>/dev/null || service lfd status
systemctl status csf 2>/dev/null || service csf status

Check logs while attempting login:

tail -n 100 /var/log/lfd.log

Typical deny message:

UI: Access attempt from an IP not in /etc/csf/ui/ui.allow - denied [x.x.x.x]

Common pitfalls

• Using default credentials: set strong non-default UI_USER / UI_PASS.
• Wrong source IP allowlisted: especially when behind NAT, proxies, or tunnels.
• Browser-blocked port: switch away from 6666.
• Missing SSL dependencies/files: verify modules and cert/key paths.
• Overexposed listen scope: keep UI_IP, firewall rules, and ingress controls tight.

Hardening checklist

• Use a dedicated admin-only ingress path.
• Keep ui.allow short and audited.
• Rotate credentials periodically.
• Review /var/log/lfd.log after each policy change.

See also: UI Skinning and Mobile View

Last reviewed: 2026-02-25

---

← Previous: Port/IP address Redirection · Next: IP Block Lists