CSF is one of the best opensource firewalls that using in most of the hosting servers like cPanel and Directadmin . Also it is one of the best firewall for installing Zimbra Mail server . This documentation will help you to configure the CSF firewall in a Zimbra Standalone installation server.
Before starting the installation , you may need to read the documentation available on http://wiki.zimbra.com/wiki/Ports , this will help you to get a quick understanding of ports that required to open in a Zimbra server.
Install CSF :
You can download CSF from http://configserver.com/cp/csf.html and install it . After that open the CSF configuration and enable the following ports,
TCP_IN = "22,25,53,80,110,143,443,465,587,993,995,7071" TCP_OUT = "22,25,53,80,110,113,443,465,587,993,995,7071"
Now you need to open the file /etc/csf/csf.pignore and add the following zimbra packages paths.
exe:/opt/zimbra/amavisd/sbin/amavisd exe:/opt/zimbra/clamav/bin/freshclam exe:/opt/zimbra/clamav/sbin/clamd exe:/opt/zimbra/cyrus-sasl/sbin/saslauthd exe:/opt/zimbra/httpd-2.4.3/bin/httpd exe:/opt/zimbra/httpd/bin/rotatelogs exe:/opt/zimbra/java/bin/java exe:/opt/zimbra/libexec/logswatch exe:/opt/zimbra/libexec/zmmailboxdmgr exe:/opt/zimbra/mysql/bin/mysqld exe:/opt/zimbra/opendkim/sbin/opendkim exe:/opt/zimbra/openldap/sbin/slapd exe:/opt/zimbra/postfix/libexec/master
This will help to white list these binaries in CSF
Now you can start the CSF as follows and test it.
# /etc/init.d/csf start
You may need to test the mail server and its functionalities . After that you can disable the testing mode in csf.conf and reload CSF. You can also perform other generic CSF tweaks after that.
Syslint Technologies provide all sort of Zimbra Technical Support and management services.
Hi Syslint,
It’s very helpful to configure CSF+LFD on a Zimbra server, Thank you.
By the way since the CSF has a new relase V6.20 I get thousends of alert emails from lfd. I’m trying to extendm my csf.pignore list with exe: and cmd: , hopefully will work.
thank you so much for this tutorial.
but the problem is, on zimbra 8.7 or 8.8, the binary locations has been changed due to new directory structure of zimbra.
can u please fix the “/etc/csf/csf.pignore” part and update?
Thanks.
Here are the updated paths for the ones i could locate.
nano /etc/csf/csf.pignore
exe:/opt/zimbra/common/sbin/amavisdamavisd
exe:/opt/zimbra/common/bin/freshclam
exe:/opt/zimbra/common/sbin/clamd
exe:/opt/zimbra/common/sbin/saslauthd
exe:/opt/zimbra/common/bin/httpd
exe:/opt/zimbra/common/bin/rotatelogs
exe:/opt/zimbra/common/lib/jvm/java/bin/java
exe:/opt/zimbra/common/sbin/mysqld
exe:/opt/zimbra/common/sbin/opendkim
exe:/opt/zimbra/common/libexec/slapd
exe:/opt/zimbra/common/libexec/master
These executables no longer exist from what i can tell even in the new paths.
exe:/opt/zimbra/httpd/bin/rotatelogs
exe:/opt/zimbra/libexec/logswatch
exe:/opt/zimbra/libexec/zmmailboxdmgr