Security Features Guide

Home · Configuration Guide

At a glance

• CSF security controls are strongest when combined by threat type.
• Start with authentication abuse defenses, then add network and anomaly controls.
• Tune incrementally to avoid false positives and operator fatigue.

Feature map by threat scenario

1) Brute-force and auth abuse

• lfd Principles
• Login Tracking
• Regex Custom Cookbook
• Exim SMTP AUTH Restriction

Use when attackers are hammering SSH, mail auth, or panel login surfaces.

2) Process and file anomaly detection

• Process Tracking
• Directory Watching

Use when you need detection for suspicious binaries, process spikes, or sensitive file changes.

3) Network abuse controls

• Port Flood Protection
• Port Knocking
• Connection Limit Protection
• Port/IP address Redirection
• IPv6 Deployment & Hardening

Use for traffic shaping, hardening exposed services, and reducing automated scanning impact.

4) Threat intelligence + upstream enforcement

• IP Block Lists
• CloudFlare
• LFD Clustering

Use when local-only controls are not enough (large feeds, multi-node estates, reverse-proxy topologies).

5) Logging integrity and spoofing risk

• Mitigating issues with syslog/rsyslog logs (RESTRICT_SYSLOG)

Use when log-derived detections may be influenced by local user-space log injection.

6) External automation hooks

• Block Reporting
• External Pre- and Post- Scripts

Use to integrate with SIEM, webhook workflows, or custom firewall orchestration.

Recommended rollout order

1. Establish baseline policy and stable access.
2. Enable auth protections.
3. Add network abuse controls and finalize IPv6 policy (see IPv6 Deployment & Hardening).
4. Add blocklists/IPSET as needed (see IPSET rollout for large feeds).
5. Validate performance impact and optimize rule/detection overhead (see Performance & Scale Tuning).
6. Add advanced hooks and clustering last.

Common pitfalls

• Enabling too many detectors at once.
• Aggressive thresholds without baseline traffic observation.
• Treating one noisy signal as definitive evidence.
• Importing large blocklists without capacity planning.

Operator shortcut

After each security tuning step:

csf -ra
tail -n 100 /var/log/lfd.log

Then verify that trusted admin paths still work.

Last reviewed: 2026-02-25

---

← CLI Guide · Integrations Guide