Migrate from original CSF v15 (cPanel)

[eric418hk]

I see new options being added to the new releases now.

So, if I want to migrate to your v15.04, what is the proper installation step? Is this correct?

1. backup the current conf
2. uninstall the current CSF
3. do fresh installation of your new version
4. restore the conf file

And the new config options will be defaulting back to the restored conf file automatically?

Or should I just do an update directly?

Thanks a lot for keeping CSF running!

[Aetherinox]

Your old config from v15 will work out of box with 15.04. I've made sure that all previous configs are backwards compatible.

You don't have to uninstall. My version will install as an update over-top of the existing version. I provide instructions at:

• https://docs.configserver.dev/install/download/

The easiest method is going to be using wget to download it from our website

wget https://download.configserver.dev/csf.tgz 

Then extract the tgz

tar -xzf csf.tgz -C /tmp 

Then run the installer

sudo sh /tmp/csf/install.sh 

From that point forward, automatic updates are re-enabled, so you'll update CSF as you would prior, within the interface, or by using the terminal commands.

The only settings in the new config are the following. But if you don't use the web interface, then you don't need them:

# # 
#   This option controls whether login attempts to the CSF/LFD UI from the
#   server's own local IP addresses are blocked. These are the IPs bound to
#   the server’s interfaces (as discovered by getethdev), including those on
#   private ranges (e.g. 192.168.x.x, 172.16–31.x.x, 10.x.x.x) and any local
#   Docker or virtual bridge networks.
#   
#   Setting this to "1" prevents access attempts that originate from a local
#   interface address, which can help block unauthorized or loopback-style
#   access through containers, proxies, or internal networks.
#   
#   If you legitimately access the UI via a local bridge (e.g. Docker proxy
#   IP such as 172.18.0.2), you may need to set this to "0" or explicitly
#   allow the IP in csf.allow.ui.
#   
#   Keeping this set to "1" means that attempts to access the CSF web
#   interface from a local network IP will be blocked. In a browser, this
#   typically results in the error:
#   PR_CONNECT_RESET_ERROR
#   
#   Default: 1 (block local interface IPs)
# # 

UI_BLOCK_PRIVATE_NET = "1"

# #
#   Each time a user unsuccessfully logs into the web interface, a message 
#   will be shown that their login attempt failed.
#   
#   If enabled; this will tell the user exactly how many attempts they have
#   left.
#   
#   enable          1
#   disable         0
#   default         0 (don't show)
# #

UI_RETRY_SHOW_REMAINING = "0"

# #
#   Content Security Policy › Enable / Disable
#   
#   When enabled, this setting instructs browsers to only allow certain
#   types of content (scripts, styles, images, etc.) to be loaded from
#   trusted sources. This helps prevent cross-site scripting (XSS),
#   data injection, and other web-based attacks, improving overall
#   security of the CSF/LFD interface.
#   
#   1 = enabled, 0 = disabled
# #

UI_CSP_ENABLED = "0"

# #
#   Content Security Policy › Advanced Mode › Enable / Disable
#   
#   Enable this option to use a custom Content Security Policy (CSP) rule
#   instead of the default rule. When enabled, define your custom CSP in
#   the `UI_CSP_ADVANCED_RULE` setting.
#   
#   1 = enabled, 0 = disabled
# #

UI_CSP_ADVANCED_ENABLED = "0"

# #
#   Content Security Policy › Advanced Mode › Custom Rule
#       (EXPERIMENTAL)
#   
#   Define your custom Content Security Policy (CSP) rule.
#   This rule will override the default CSP used by the UI.
#   
#   Requires `UI_CSP_ADVANCED_ENABLED` is set to 1
#   
#   Supports template variables. Add one of the variables below in
#   your advanced rule to substitute it with the real data value in
#   its place.
#   
#   Leave empty ("") to use the default CSP.
#   
#   Template Vars:
#   
#   [HOSTNAME]      server host name
#   [HOSTIP]        server host ip
#   Example:        "default-src 'self'; script-src 'self' https://*.[HOSTNAME];"
#   
#   Example Usage:
#       upgrade-insecure-requests
#           Force all HTTP requests to HTTPS; Prevent mixed content
#   
#       default-src 'none'
#           Block all resource types by default; Start from zero trust
#   
#       script-src 'self'
#           Allow only same origin scripts; Prevent injected scripts
#       
#       style-src 'self' 'unsafe-inline'
#           Allow local + inline styles; Needed for inline <style> tags + CSS vars
#   
#       img-src 'self' data:
#           Allow local + data URI images; Covers logos and embedded SVGs
#   
#       font-src 'self' data:
#           Allow local + data font URIs; For embedded fonts
#                                           
#       connect-src 'self'
#           Limit AJAX/WebSocket endpoints; Prevent data exfiltration
#       
#       form-action 'self'
#           Restrict form submissions; Stops form hijacking
#   
#       frame-ancestors 'self'
#           Prevent embedding in iframes; Stops clickjacking
#   
#       base-uri 'self'
#           Disallow changing the base URL; Avoids URL manipulation attacks
#   
#   WARNING
#   While CSF's template system is being re-written; you must have a MINIMUM of
#   the following for your advanced rule:
#       default-src 'none';
#       img-src 'self' data:; 
#       script-src 'self' 'unsafe-inline';
#       style-src 'self' 'unsafe-inline';
#   
#   Some pages are using fonts.googleapis.com / google fonts; which we want to
#   replace with local assets for security.
#   
#   Additional settings may be required if running this integrated 
#   with cpanel, cyberpanel, etc.
#   
#   Only advanced users should modify this.
# #

UI_CSP_ADVANCED_RULE = "default-src 'none'; img-src 'self' data: https://*.[HOSTNAME] https://*.[HOSTIP]; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; form-action 'self'; font-src 'self' https://fonts.gstatic.com;"

# #
#   Number of seconds between automatic log refreshes.
#   Controls how frequently the log display updates.
# #

UI_LOGS_REFRESH_TIME = "6"

# #
#   Determines whether the log timer starts paused when the page loads.
#   1 = start paused, 0 = start running immediately.
# #

UI_LOGS_START_PAUSED = "0"

[eric418hk]

So, this means it will check and keep all my current CSF settings, including csf.conf, csf.deny, csf.allow, etc. And then add those new settings to csf.conf automatically?

If this is the case, then it is amazing!

[Aetherinox]

Yes. You'll keep all of your settings.

However, just because it's good advice, always back up your files. No matter what. You don't want something weird happening and losing all of your configs.

But yeah, as far as your current setup, you will keep everything.

I'm currently working on a migration script, but it's not complete yet. This will do more detailed stuff. But if you need all of the settings I've added, see my post above and copy those 5-6 settings. That'll get you caught up.

[eric418hk]

I just did it, and it works perfectly! Thanks a lot!

However, I just compare the csf.conf with my backup, they are identical.

So, what about the new settings like UI_CSP_ADVANCED_RULE, UI_LOGS_REFRESH_TIME or UI_LOGS_START_PAUSED? Do I need to add them back to csf.conf manually?

[Aetherinox]

I just did it, and it works perfectly! Thanks a lot!

However, I just compare the csf.conf with my backup, they are identical.

So, what about the new settings like UI_CSP_ADVANCED_RULE, UI_LOGS_REFRESH_TIME or UI_LOGS_START_PAUSED? Do I need to add them back to csf.conf manually?

Maybe I misunderstood you.

I meant that no, you won't lose your existing config settings.

No, it will not take all of the comments from the new config and inject them into yours. I'm currently working on a migration tool to do something like that, but it's not done yet. And it needs to be tested to ensure it doesn't screw anything up.

So, what about the new settings like UI_CSP_ADVANCED_RULE, UI_LOGS_REFRESH_TIME or UI_LOGS_START_PAUSED? Do I need to add them back to csf.conf manually?

Look at my comment up above, I copied all the new settings I've added. You can just copy that entire box, and drop it in your config.

Just find the line in your existing config UI_PASS = "password" (or whatever your password is), and paste the list I wrote above after that setting, and you'll be caught up.

[eric418hk]

Cool, just copied everything to conf, and I can see the new settings via UI now.

But I found a bug.

This is in csf.conf

UI_CSP_ADVANCED_RULE = "default-src 'none'; img-src 'self' data: https://.[HOSTNAME] https://.[HOSTIP]; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; form-action 'self'; font-src 'self' https://fonts.gstatic.com;"

But it shows "default-src " in UI.

[eric418hk]

Confirm it is fixed in v15.05!

Thanks again for keeping CSF alive! Much appreciated!

[Aetherinox]

Nice. Glad to hear. You're welcome.