CSF PUREFTPD_DISABLED='y' leaves passive FTP ports in CSF and causes duplication

• CentOS Version: AlmaLinux 9.8
• Centmin Mod Version Installed: 140.00beta01.b348
• Nginx Version Installed: 1.31.1
• PHP Version Installed: 8.3.31
• MariaDB MySQL Version Installed: 10.11.18
• Updated Centmin Mod code base: Today
• Persistent Config:
  
  Code (Text):

  PUREFTPD_DISABLED=y
  

Hi George,

I wanted to report a small bug regarding how CM interacts with the CSF firewall configuration when Pure-FTPd is completely disabled via the custom configuration file. I also noticed a few open ports that might be worth reviewing for security hardening.

Pure-FTPd Disabled Port Duplication

When setting PUREFTPD_DISABLED='y' in custom_config.inc, CM leaves the passive FTP ports (30001:50011) opened inside /etc/csf/csf.conf under TCP_IN and TCP6_IN.

---

If I manually remove 30001:50011 from /etc/csf/csf.conf, subsequent CM updates or routine cronjobs appear to trigger an automated port-check routine. It appends a string of duplicate ports to the end of the line alongside the passive FTP ports again:

Code (Text):

TCP_IN = "25,53,853,80,110,143,443,465,587,993,995,222,1110,1186,1194,81,9418,1110,1186,1194,81,9418,1110,1186,1194,81,9418,30001:50011"

TCP6_IN = "25,53,853,80,110,143,443,465,587,993,995,222,1110,1186,1194,81,9418,1110,1186,1194,81,9418,1110,1186,1194,81,9418,30001:50011"

(Notice how ports like 1110,1186,1194,81,9418 loop repeatedly right before the passive FTP range is re-inserted).

Expected Behaviour

1. If PUREFTPD_DISABLED='y', CM's CSF setup routine should omit 30001:50011 from both TCP_IN and TCP6_IN completely.
2. The port verification regex/script should check for exact matches or use a cleaner array structure to prevent appending duplicate strings when it detects missing ports.

Separately, PORTFLOOD = "21;tcp;20;300" can also be changed to PORTFLOOD = "" when Pure-FTPd is disabled.

Unnecessary Default Ports (UDP 20, 21, 80) & Security Hardening

While reviewing the CSF configuration files, I also noticed that UDP_IN and UDP_OUT include ports 20, 21 and 80 (UDP_IN) by default. As I understand it these open UDP ports are unnecessary for standard operations.

Given the recent rise in severe exploits can I suggest it might be a good time to do a general review of the default open ports in CM's CSF template to ensure only strictly required ports are left open by default?

 

Yeah the update fixed my existing CSF config too, thank you!