A DirectAdmin firewall after CSF

• ConfigServer stopped developing CSF and lfd on 31 August 2025. Before closing it released the code under the GPLv3, and its download and update servers went offline: don't point anything at download.configserver.com.
• DirectAdmin did not drop CSF. Since DirectAdmin 1.682 (25 August 2025) CustomBuild checks and installs CSF updates itself, with CSF's own auto-update turned off, and DirectAdmin 1.689 (12 November 2025) moved it to CSF 15.05, with log parsing for newer OpenSSH and new defaults. DirectAdmin's CSF page still documents it.
• cPanel maintains its own fork, but only for cPanel & WHM servers. Outside cPanel, community forks such as Aetherinox/csf-firewall carry CSF on, at their own pace.

So CSF keeps working on DirectAdmin, and receives fixes through CustomBuild. What has changed is that nobody develops it the way ConfigServer did, so new features are unlikely.

• Keep CSF through CustomBuild

  The right choice if you manage one or a few servers and like CSF's files and DirectAdmin's CSF screen. Keep CustomBuild up to date so CSF gets DirectAdmin's updates.

• Move to firewalld or nftables, plus fail2ban

  The distribution's own tools, maintained upstream. You lose DirectAdmin's CSF screen, and its Brute Force Monitor blocks through CSF: plan how it blocks without it.

• Add InfraFence next to either

  For agencies and teams with many servers: one live dashboard for all of them, attacks banned at the firewall, outbound traffic and file integrity watched, and fixes that are checked and undone if SSH or a site stops answering.

InfraFence is not a drop-in replacement for CSF's packet filter: it does not set your base policy (which ports are open to the world). Keep CSF, firewalld or nftables for that. InfraFence works on top of it and never opens a port that tool closed.

• It recognises DirectAdmin from /usr/local/directadmin, reads its version with directadmin v, and shows both in the dashboard.
• It reads every domain's traffic. It lists the domains from each user's domains.list and reads the per-domain access logs in /var/log/httpd/domains, so the web firewall sees the requests to every site (Web firewall).
• It leaves CustomBuild's files alone. Under a hosting panel the agent never edits the web server configuration: no ModSecurity rules, no user-agent blocks. Bots set to Block are banned at the firewall instead.
• It bans at the firewall for SSH brute force and web attacks, and can close database ports open to the internet when you ask from the dashboard (Ports and egress). Its bans, the whitelist and country blocks apply to IPv4; closed ports to IPv4 and IPv6.
• It watches what CSF does not: connections leaving the server towards known malicious addresses, DNS answers, malware in the sites and changes to system files.

The agent's release tests install CSF (the community GPLv3 fork) on the same host, run csf -r and check that the agent's chains and bans come back while SSH keeps answering and CSF's own rules stay exactly as CSF wrote them. The full list of tools is in Coexistence.

1. Run the read-only check first: the installer's --dry-run reports anything that would get in the way, and changes nothing.
2. In the dashboard, Servers › Add server creates an install token, valid for one hour.
3. Run the install command as root over SSH. Nothing in DirectAdmin or CustomBuild needs to change.

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --dry-run

DirectAdmin's supported systems, such as AlmaLinux, Rocky Linux, Debian and Ubuntu, are among the 15 distributions the agent is tested on before every release (Supported distributions).