Configure CSF & LFD with Slack & Telegram Alerts

Running a VPS or dedicated server in India means you are responsible for protecting it from attacks, brute-force attempts, and unwanted traffic. ConfigServer Security & Firewall (CSF) and its companion daemon, LFD (Login Failure Daemon), provide a powerful and manageable firewall and intrusion-prevention system for Linux servers. In this guide, we will walk you through installing CSF/LFD, tuning the most useful settings, and adding automated notifications to Slack or Telegram so you are alerted immediately when suspicious activity occurs.

1. Prerequisites and Installing CSF/LFD

CSF supports most modern Linux distributions. The installation commands differ between Debian-based systems (Ubuntu, Debian) and RHEL-based systems (AlmaLinux, Rocky Linux, RHEL). Choose the block below that matches your operating system.

For Debian / Ubuntu (apt)

These steps are for Ubuntu or Debian systems using the apt package manager.

# Update the package index to ensure you have the latest package information
sudo apt update

# Install required utilities: wget for downloading, perl for scripting, unzip for extraction
sudo apt install -y wget perl unzip

# Navigate to the source directory and download the latest CSF package
cd /usr/src
sudo wget https://download.configserver.com/csf.tgz

# Extract the archive and run the installation script
sudo tar -xzf csf.tgz
cd csf
sudo sh install.sh

For AlmaLinux / Rocky Linux / RHEL (dnf)

These steps are for AlmaLinux, Rocky Linux, or RHEL systems using the dnf package manager.

# Enable EPEL (Extra Packages for Enterprise Linux) if not already enabled, as some dependencies may require it
sudo dnf install -y epel-release

# Install required utilities: wget, perl, and unzip
sudo dnf install -y wget perl unzip

# Navigate to the source directory, download, extract, and install CSF
cd /usr/src
sudo wget https://download.configserver.com/csf.tgz
sudo tar -xzf csf.tgz
cd csf
sudo sh install.sh

Once the script finishes, CSF will be installed in the /etc/csf directory. The csf and lfd services will be enabled automatically.

2. Basic Configuration and Testing

The main configuration file is located at /etc/csf/csf.conf. Open this file with your preferred text editor and adjust the key options shown below.

Common settings for both OS families

# Allow incoming SSH connections on port 22. Change this if you use a non-standard port.
TCP_IN = "22"

# Allow outgoing connections on common service ports
TCP_OUT = "20,21,22,25,53,80,443,587,3306"

# Enable testing mode. Set this to 0 after you confirm the firewall works correctly to avoid lockouts.
TESTING = "0"

# Enable the Login Failure Daemon (LFD)
LF_DAEMON = "1"

# Email address for alerts (optional, but useful if you also want email notifications)
LF_ALERT_TO = "you@example.com"

Save the file and restart the services to apply the changes.

Restarting Services

The restart commands are the same for both Debian/Ubuntu and AlmaLinux/Rocky/RHEL systems:

# Restart the CSF service
sudo systemctl restart csf

# Restart the LFD service
sudo systemctl restart lfd

To verify that the firewall is active, run sudo csf -l. This command lists the currently allowed ports. If you accidentally lock yourself out of SSH, you can temporarily disable CSF via the console (VNC or serial) using sudo csf -x (disable) and then re-enable it with sudo csf -e once your configuration is fixed.

3. Enabling LFD Alerts for SSH Brute-Force and Other Threats

LFD monitors log files (such as /var/log/auth.log on Debian/Ubuntu or /var/log/secure on RHEL-based systems) and triggers alerts when it detects repeated failed logins, suspicious processes, or port scans. While the default alert method is email, we can configure LFD to send these alerts to Slack or Telegram using a custom script.

Step 1 – Create a custom alert script

Create a new file at /usr/local/bin/alert.sh and make it executable.

# Create the file and open it in your editor:
# sudo nano /usr/local/bin/alert.sh

#!/bin/bash
# Arguments passed by LFD:
# $1 = alert type (e.g., "LF_ALERT")
# $2 = alert subject
# $3 = alert message (multi-line)

TYPE=$1
SUBJECT=$2
MESSAGE=$3

# Choose destination: slack or telegram
DEST="slack"   # Change to "telegram" if you prefer Telegram alerts

if [ "$DEST" = "slack" ]; then
    # Slack webhook URL – retrieved from the environment variable
    WEBHOOK_URL="${SLACK_WEBHOOK_URL}"
    # Format the payload for Slack
    PAYLOAD=$(printf '{"text":"*%s*\n```%s```"}' "$SUBJECT" "$MESSAGE")
    # Send the POST request to Slack
    curl -s -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$WEBHOOK_URL"
    
elif [ "$DEST" = "telegram" ]; then
    # Telegram bot token and chat ID – retrieved from environment variables
    BOT_TOKEN="${TELEGRAM_BOT_TOKEN}"
    CHAT_ID="${TELEGRAM_CHAT_ID}"
    # Format the text for Telegram Markdown
    TEXT=$(printf "*%s*\n\`\`\`\n%s\n\`\`\`" "$SUBJECT" "$MESSAGE")
    # Send the message to Telegram
    curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
        -d chat_id="${CHAT_ID}" \
        -d parse_mode="MarkdownV2" \
        -d text="${TEXT}"
fi

Make the script executable so LFD can run it:

sudo chmod +x /usr/local/bin/alert.sh

Replace the placeholder environment variables with your actual credentials (as described in the sections below). The script receives the alert type, subject, and message from LFD, formats them, and sends them via curl to the chosen service.

Step 2 – Register the script with LFD

Edit /etc/csf/csf.conf again and set the following lines:

# Enable alerting
LF_ALERT = "1"

# Point to the custom script
LF_ALERT_SCRIPT = "/usr/local/bin/alert.sh"

Restart LFD so it picks up the new configuration:

sudo systemctl restart lfd

4. Setting Up Slack Notifications

Slack uses incoming webhooks, which are simple URLs that accept JSON payloads. Follow these steps to obtain a webhook URL.

1. In Slack, navigate to Workspace Settings → Apps → Manage → Custom Integrations → Incoming Webhooks.
2. Click "Add to Slack", select the channel where you want to receive alerts, and click "Allow".
3. Copy the generated webhook URL (it will look like https://hooks.slack.com/services/XXXXX/XXXXX/XXXXX).

For security, store the URL in an environment variable rather than hard-coding it in the script. Add the following line to the root user’s ~/.bashrc file (or to a dedicated service account if you prefer):

export SLACK_WEBHOOK_URL="https://hooks.slack.com/services/XXXXX/XXXXX/XXXXX"

After editing the file, reload the profile to apply the changes in the current session:

source ~/.bashrc

Now, whenever LFD detects a failed SSH login, a port scan, or a blocked process, the alert.sh script will forward the details to your specified Slack channel.

5. Setting Up Telegram Notifications

Telegram bots provide a straightforward API for sending messages. Create a bot and obtain a chat ID as follows:

1. Open Telegram and start a chat with @BotFather.
2. Send the command /newbot and follow the prompts to name your bot. BotFather will return a Bot Token (e.g., 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11).
3. Invite the bot to a private group or start a direct chat with it. Send any message to the bot, then retrieve the chat ID by visiting:

   https://api.telegram.org/bot<BOT_TOKEN>/getUpdates

   Look for the "chat":{"id":123456789 field in the response.

Store the token and chat ID as environment variables in ~/.bashrc:

export TELEGRAM_BOT_TOKEN="123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11"
export TELEGRAM_CHAT_ID="123456789"

Reload the profile (source ~/.bashrc), then set DEST="telegram" in /usr/local/bin/alert.sh to activate Telegram notifications.

6. Fine-Tuning LFD for Better Signal-to-Noise Ratio

Default LFD settings can generate a high volume of alerts, especially on busy servers. Adjust the following parameters in /etc/csf/csf.conf to reduce noise while maintaining security.

• LF_SSHD: The number of failed SSH attempts before an IP is blocked. The default is 5. Increase this to 10 if you have many legitimate users who make occasional typos.
• LF_SSHD_PERM: Enables permanent blocking after repeated offenses. Set to "1" to enable.
• LF_SSHD_INTERVAL: The time window (in seconds) for counting failures. The default is 300 (5 minutes). Keep this unless you have a specific need to change it.
• LF_TRIGGER: The types of events that generate alerts. You can limit this to ssh, ports, proc to focus on the most critical issues.

After making changes, restart LFD to apply the new thresholds:

sudo systemctl restart lfd

7. Verifying the End-to-End Flow

It is good practice to test the notification pipeline before relying on it in production.

1. Force a failed SSH login from a different IP address (or use ssh -p 22 wronguser@yourserver from your local machine).
2. Check your Slack channel or Telegram chat for a message similar to:

   *LF_ALERT – SSH Login Failure*
   ```[date] [IP] [username] failed login attempts: 5```

3. If you do not receive a notification, review the following:
   • Ensure the environment variables are exported for the user running LFD (usually root).
   • Verify that curl has network access to the webhook URL.
   • Check /var/log/lfd.log for any errors related to alert.sh.

Conclusion

CSF combined with LFD provides Indian VPS and dedicated-server owners with a robust, low-overhead firewall that can automatically block attacks and keep you informed in real time. By adding a simple shell script and configuring either a Slack webhook or a Telegram bot, you turn raw log entries into actionable alerts that reach you wherever you work. Remember to keep the CSF package up to date (sudo csf -u) and periodically review LFD thresholds to match your traffic patterns. With these steps in place, your server will remain secure, and you will be prepared for any sudden surge of malicious activity.