Verifiable updates
Release metadata binds version, package name and cryptographic digest to a pinned signing key.
The latest hardened DataHouse CSF/LFD release
DCSFThe latest and most hardened DataHouse CSF/LFD release
A production-ready, CSF/LFD-compatible firewall distribution with 51 verified security fixes for cPanel, DirectAdmin, CyberPanel, CWP, InterWorx, VestaCP, Webmin and panel-free Linux.
51verified bug and exploit remediations
54/54verified release gates
8panel and Linux deployment paths
RSA-3072pinned update signatures
DCSF
A hardened CSF/LFD firewall for hosting infrastructure
DCSF preserves the familiar CSF and LFD workflow while closing exploit classes around root execution, untrusted parsers, remote updates, panel authorisation and firewall state.
Safer privileged work
Shell-free execution and explicit validation reduce ambiguity where firewall administration crosses privilege boundaries.
Bounded input handling
Network, file and log inputs are processed with size, time and structure limits.
Operational continuity
Changes are designed for staged validation, deterministic failure and recoverable firewall state.
DCSF / CSF / LFD
Familiar CSF controls, substantially stronger boundaries
Administrators retain the recognisable CSF/LFD interface and operational model. DCSF adds signed distribution, strict validation, bounded processing and transactional recovery underneath it.
- IPv4 and IPv6 policy
- iptables and nftables operation
- LFD login and process monitoring
- Alerts, blocklists and authenticated clustering
DCSF
One security layer across established control panels
DCSF targets the panel adapters already present in the CSF/LFD codebase, plus a generic Linux mode for direct administration.
cPanel & WHM
Preserves the familiar WHM firewall workflow and provides a tested, backup-first migration path from the cpanel-csf RPM.
DirectAdmin
Uses the established DirectAdmin adapter with hardened argument validation, identity transitions and shell-free privileged execution.
CyberPanel
Retains the CyberPanel integration while restricting privileged mutations to authenticated, CSRF-protected POST actions.
CWP
Supports the existing Control Web Panel administration path with the same signed package, parser limits and firewall-state safeguards.
InterWorx
Integrates with NodeWorx and enforces native FIREWALL authority, blocking secondary accounts that do not hold that permission.
VestaCP
Keeps the VestaCP CSF/LFD integration path while applying the common DCSF release, input-validation and recovery controls.
Webmin
Supports CSF/LFD administration through Webmin with the same hardened backend and signed update channel.
Generic Linux
Provides direct operation on supported RHEL- and Debian-family servers without requiring a hosting control panel.
DCSF
Threat data is useful only when it is trustworthy
The DataHouse Threat Feed is continuously refreshed through a controlled pipeline designed to reject malformed, stale and duplicate records.
Collect
Receive indicators from curated operational and research sources.
Validate
Confirm syntax, address scope, provenance and transport integrity.
Normalise
Canonicalise records and eliminate duplicate or conflicting entries.
Age
Expire indicators whose confidence or operational relevance has decayed.
Released
DH20.01 is published
The first signed DataHouse release is public. All 51 security remediations and all three operational controls passed the complete 54-gate release matrix.
The signed public package and installer are available.
DCSF
Questions operators ask
Key information about the first production release.
Is DCSF the latest hardened CSF/LFD release from DataHouse?
Yes. DH20.01 is the latest and most hardened release in the DCSF line. It maps to signed technical package 15.10.4 and includes 51 verified security fixes plus three operational controls.
Which control panels does DCSF support?
DCSF supports cPanel & WHM, DirectAdmin, CyberPanel, CWP, InterWorx, VestaCP and Webmin, plus a generic mode for supported RHEL- and Debian-family Linux servers.
What bugs and exploit classes were fixed?
The public register covers command and argument injection, ReDoS and resource exhaustion, file races, update-chain substitution, web-panel abuse, cluster spoofing and replay, process identity bypasses, DNS trust errors and firewall-state loss.
Can I download DCSF today?
Yes. DH20.01 is public and maps to the signed DCSF 15.10.4 package. The bootstrap verifies every trust-bearing artifact before installation.