How to Install ConfigServer & Firewall on a Virtualmin Box

by Charles Oropallo | Jun 12, 2024 | Technical Help, Web Hosting

Enhancing Your Virtualmin Security with ConfigServer & Firewall on Virtualmin

Server management security scenario depiction In the world of server security, to install ConfigServer Security & Firewall (CSF) in Virtualmin stands out as a superior choice over the traditional tools like Fail2Ban and FirewallD Virtualmin comes standard with. CSF integrates seamlessly with Virtualmin, offering a comprehensive and user-friendly interface that simplifies the management of your server’s security. Unlike the piecemeal approach of using Fail2Ban for intrusion detection and FirewallD for firewall management, CSF provides an all-in-one solution, making it easier to configure, monitor, and maintain robust security settings. This not only enhances your server’s protection but also streamlines your administrative tasks, giving you more control and peace of mind.

Follow these steps to install ConfigServer & Firewall (CSF) on a Virtualmin server and remove Fail2Ban and FirewallD

Prerequisites

Minimal Debian 12.5 Installation:

- - Ensure your Debian 12 system is fully updated by running this at your console or via PuTTY:
```
apt-get update && apt-get upgrade
```
  - Ensure your Virtualmin control panel has been installed and is working

Step-by-Step Instructions

1. 1. Install wget (after a fresh installation of Debian 12, I discovered that wget was not present):
```
apt-get install wget
```
  2. Download and Extract CSF (this process will bring the file into the directory you are in – which should be root’s home directory at this point) – and then the tar command will extract its contents to a csf directory):
```
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
```
  3. Install bind9-host (this was to prevent a warning I got while initially installing CSF in the following step):
```
apt-get update
apt-get install bind9-host
```
  4. Install CSF (change directory to the newly created csf directory where we can run the installation):
```
cd csf
sh install.sh
```
  1. Edit the csf.conf file (this will address warnings and other issues that were present at the end of the installation output when I did this):
    - - Open the configuration file:
        nano /etc/csf/csf.conf
        
        Modify the Testing flag – it enables a CRON job that clears iptables incase of configuration problems when you start CSF. This should be enabled until you are sure that the firewall works. Otherwise you can get locked out of your server! Set it to 0 prior to restarting CSF:
        TESTING = "0"
        
        I got a warning that indicated RESTRICT_SYSLOG is disabled. Syslog and rsyslog allow end-users to add fake log entries, making it hard to distinguish real logs from fake ones. This can cause false alerts and potentially block innocent IP addresses. Some CSF/LFD features rely on these logs, making them vulnerable to exploitation. To prevent this, you can enable the RESTRICT_SYSLOG option, which disables these vulnerable features. However, doing so may reduce protection against certain exploits. There are excruciating details in the file you need to edit this setting in. Here is how I set mine:
        RESTRICT_SYSLOG = "3"
        
        Modify the TCP_IN and TCP_OUT lines to include your custom SSH port (I have non-standard port 2222 shown here as an example) and remove port 22. You also may need to add the range 35000:35999 so your backups will work using FTP should you need that:
        TCP_IN = "20,21,25,53,80,110,143,443,2222,35000:35999" TCP_OUT = "20,21,25,53,80,110,113,443,2222"
        
        I used the same settings for IPv6 TCP ports, again with my 2222 example and set up to allow FTP to work from this box:
        TCP6_IN = "20,21,25,53,80,110,143,443,2222,35000:35999" TCP6_OUT = "20,21,25,53,80,110,113,443,2222"
        
        I also got a warning after installing CSF that the binary location for [HOST] [/usr/bin/host] in /etc/csf/csf.conf is either incorrect, is not installed or is not executable. Mine looked like this in the OS Specific Settings section:
        HOST = "/usr/bin/host"
        
        Now we just need to restart CSF and LFD to ensure all our settings changes are put into effect:
        csf -r systemctl restart lfd
Integration into Webmin

Now we are ready to actually integrate ConfigServer & Firewall (CSF) into the Webmin interface. This will make access easy for controlling it from within Webmin itself. The only thing I have noticed that’s unavailable in my Webmin interface is the ability to modify the settings in the /etc/csf/csf.conf file. I still have to modify any settings in there using nano (my favorite Linux text editor). I will explore this later and see if there is a solution or if I have missed a setting someplace.
1. 1. Integrate CSF with Webmin:
    - Log in to Webmin.
    - Navigate to Webmin Configuration -> Webmin Modules.
    - Select From local file and enter the path /usr/local/csf/csfwebmin.tgz.
    - Click Install Module.
  2. Remove Fail2Ban:
```
apt-get purge fail2ban
rm -rf /etc/fail2ban
```
  3. Remove FirewallD:
```
apt-get purge firewalld
rm -rf /etc/firewalld
```
  4. Restart Webmin:
```
systemctl restart webmin
```
  5. Verify and Configure CSF in Webmin:
    - Log in to Webmin.
    - Navigate to System -> ConfigServer Security & Firewall.
    - Check it can be viewed through there.
  6. Remove FirewallD and Fail2Ban in Webmin:
    - Log in to Webmin.
    - Navigate to Webmin -> Webmin Configuration > Webmin Modules > Delete.
    - Select the following by clicking on them and holding down your CTRL key:
      Fail2Ban Intrusion Detector
      FirewallD
      Linux Firewall
      Linux IPv6 Firewall
    - Click on the Delete Selected Modules.
Following the steps steps above should have helped you to have ConfigServer & Firewall (CSF) installed and properly configured on your Virtualmin box, with Fail2Ban and FirewallD (as well as Linux Firewall and Linux IPv6 Firewall entries) removed to avoid conflicts.

To learn more about the Virtualmin web server control panel, check out their website at this address:
https://www.virtualmin.com/

And to learn more specifically about ConfigServer & Security (CSF) web server security software at this address:
https://configserver.com/configserver-security-and-firewall/