Pendahuluan
CSF merupakan firewall pihak ketiga yang biasa digunakan untuk melakukan proteksi pada server linux. Firewall ini berbasis iptables, namun CSF menyederhanakan kompleksitas konfigurasi iptables dengan perintah-perintah yang ada dimilikinya.
CSF memberikan tampilan GUI apabila diintegrasikan dengan web panel seperti cPanel, DirectAdmin, InterWorx, CentOS Web Panel (CWP), VestaCP and Webmin. Dengan tampilan GUI tersebut, membuat manajamen dan konfigurasi CSF menjadi lebih mudah.
Salah satu fitur penting pada CSF adalah Login Failure Daemon (LFD). Daemon ini bertugas untuk melakukan deteksi apabila terjadi kegagalan akses login pada server dan akan melakukan blok (mirip seperti fail2ban). Pada server yang menggunakan panel seperti cPanel, LFD dapat mengirimkan notifikasi apabila terjadi kegagalan login baik itu login akses ssh maupun akses email server seperti autentikasi smtp dan imap/pop.
Apabila CSF diinstal pada server yang menggunakan cPanel, kita dapat menerima notifikasi apabila ada kegagalan pada service LFD. Berikut salah satu contoh notifikasi saat service LFD tidak berjalan.
Penyebab Error
Salah satu penyebab service LFD gagal aktif adalah adanya permasalahan pada service CSF. Oleh karena itu, cek terlebih dahulu status dari service csf dan lfd.
[root@serv ~]# systemctl status {csf,lfd} -l
● csf.service - ConfigServer Firewall & Security - csf
Loaded: loaded (/usr/lib/systemd/system/csf.service; enabled; vendor preset: disabled)
Active: active (exited) since Fri 2024-12-06 06:01:55 WIB; 3 months 27 days ago
Main PID: 267233 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/csf.service
Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Fri 2025-04-04 03:59:21 WIB; 32s ago
Process: 13355 ExecStart=/usr/sbin/lfd (code=exited, status=1/FAILURE)
Main PID: 4789 (code=killed, signal=KILL)
Apr 04 03:59:21 serv.diaryconfig.com systemd[1]: Starting ConfigServer Firewall & Security - lfd...
Apr 04 03:59:21 serv.diaryconfig.com lfd[13355]: Error: You have an unresolved error when starting csf. You need to restart csf successfully before starting lfd (see /etc/csf/csf.error)
Apr 04 03:59:21 serv.diaryconfig.com systemd[1]: lfd.service: control process exited, code=exited status=1
Apr 04 03:59:21 serv.diaryconfig.com[1]: Failed to start ConfigServer Firewall & Security - lfd.
Apr 04 03:59:21 serv.diaryconfig.com[1]: Unit lfd.service entered failed state.
Apr 04 03:59:21 serv.diaryconfig.com[1]: lfd.service failed.Dari hasil pengecekan di atas, terlihat bahwa service csf masih aktif sedangkan service lfd mengalami down. Salah satu pesan yang tampil adalah,
Error: You have an unresolved error when starting csf. You need to restart csf successfully before starting lfd (see /etc/csf/csf.error)Pada saat service csf direstart, sekarang service csf juga menjadi tidak aktif.
[root@serv ~]# systemctl restart {csf,lfd}
Job for csf.service failed because the control process exited with error code. See "systemctl status csf.service" and "journalctl -xe" for details.
Job for lfd.service failed because the control process exited with error code. See "systemctl status lfd.service" and "journalctl -xe" for details.Ketika dilakukan pengecekan status csf, terdapat pesan seperti berikut:
root@serv ~]# systemctl status csf -l
● csf.service - ConfigServer Firewall & Security - csf
Loaded: loaded (/usr/lib/systemd/system/csf.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Fri 2025-04-04 04:00:07 WIB; 2min 53s ago
Process: 14594 ExecStop=/usr/sbin/csf --initdown (code=exited, status=1/FAILURE)
Process: 14626 ExecStart=/usr/sbin/csf --initup (code=exited, status=1/FAILURE)
Main PID: 14626 (code=exited, status=1/FAILURE)
Apr 04 04:00:07 serv.diaryconfig.com systemd[1]: Starting ConfigServer Firewall & Security - csf...
Apr 04 04:00:07 serv.diaryconfig.com csf[14626]: You have an unresolved error when starting csf:
Apr 04 04:00:07 serv.diaryconfig.com csf[14626]: Error: FASTSTART: (Packet Filter IPv4) [] [iptables-restore: line 2 failed]. Try restarting csf with FASTSTART disabled, at line 5790 in /usr/sbin/csfgrep -ir 'FASTSTART = "1"' /etc/csf/*/etc/csf/csf.conf:FASTSTART = "1"
/etc/csf/csf.conf.i360bak:FASTSTART = "1"Solusi
FASTSTART=1, lalu ubah nilainya menjadi 0.# This option uses IPTABLES_SAVE, IPTABLES_RESTORE and IP6TABLES_SAVE,
# IP6TABLES_RESTORE in two ways:
#
# 1. On a clean server reboot the entire csf iptables configuration is saved
# and then restored where possible to provide a near instant firewall
# startup[*]
#
# 2. On csf restart or lfd reloading tables, CC_* as well as SPAMHAUS, DSHIELD,
# BOGON, TOR are loaded using this method in a fraction of the time than if
# this setting is disabled
#
# [*]Not supported on all OS platforms
#
# Set to "0" to disable this functionality
#FASTSTART = "1"
FASTSTART = "0"csf -r. Tunggu proses hingga selesai.[root@serv ~]# systemctl status -l {csf,lfd}
● csf.service - ConfigServer Firewall & Security - csf
Loaded: loaded (/usr/lib/systemd/system/csf.service; enabled; vendor preset: disabled)
Active: active (exited) since Fri 2025-04-04 04:22:15 WIB; 9s ago
Process: 6235 ExecStop=/usr/sbin/csf --stop (code=exited, status=0/SUCCESS)
Process: 6206 ExecStop=/usr/sbin/csf --initdown (code=exited, status=0/SUCCESS)
Process: 6279 ExecStart=/usr/sbin/csf --initup (code=exited, status=0/SUCCESS)
Main PID: 6279 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/csf.service
Apr 04 04:22:14 serv.diaryconfig.com systemd[1]: Starting ConfigServer Firewall & Security - csf...
Apr 04 04:22:15 serv.diaryconfig.com csf[6279]: (restoring iptables) (restoring ip6tables)
Apr 04 04:22:15 serv.diaryconfig.com systemd[1]: Started ConfigServer Firewall & Security - csf.
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2025-04-04 04:22:16 WIB; 9s ago
Process: 6329 ExecStart=/usr/sbin/lfd (code=exited, status=0/SUCCESS)
Main PID: 6346 (lfd - sleeping)
CGroup: /system.slice/lfd.service
├─6346 lfd - sleepin
├─6359 lfd - checking system integrit
└─6360 /usr/bin/md5sum --check /var/lib/csf/csf.tempint
Apr 04 04:22:15 serv.diaryconfig.com[1]: Starting ConfigServer Firewall & Security - lfd...
Apr 04 04:22:16 serv.diaryconfig.com[1]: Started ConfigServer Firewall & Security - lfd.systemctl start csf.service
systemctl start lfd.service