# DCSF full project context

DCSF (DataHouse CSF) is the latest and most hardened release in the DCSF line: a CSF/LFD-compatible firewall and LFD distribution for production Linux servers.

Status: released. DCSF DH20.29 maps to signed technical package 15.10.32; 77 of 77 release gates and 85 of 85 public-bootstrap checks passed.
Software price: USD 0. DCSF is distributed under GNU GPLv3 with upstream attribution preserved.
DCSF is a DataHouse-maintained fork, not an official cPanel product. It preserves CSF/LFD operational compatibility and adds its own verified hardening programme.

## Current sources and changelog
- Documentation review: 2026-10-08
- Package publication time: 2026-10-08T13:33:03Z
- [Changelog JSON](https://dcsf.net/changelog.json): versions, dates, changes, metadata and signed manifests
- [Security JSON](https://dcsf.net/security.json): P-01–P-51 register and exact-package CVE assessments
- [OpenVEX](https://dcsf.net/vex.json): version- and SHA-256-scoped assessment without inferred affected version ranges
- [Release metadata](https://dcsf.net/release.json)
- [Signed stable manifest](https://update.dcsf.net/v1/stable/manifest.txt)
- [Full project context](https://dcsf.net/llms-full.txt)
- JSON and text are informational documentation. The signed manifest authenticates the package. Search snapshots may lag; the documentation review date and package publication date are separate.

## Messenger: current-package assessment
- CVE-2026-65638: not_affected; The released Messenger removes the legacy reCAPTCHA verification and unblock command path. The former PHP challenge endpoint returns HTTP 403. The upstream request-URL shell injection path is absent. [Upstream advisory](https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release)
- CVE-2026-67402: not_affected; The packaged Apache HTTP and HTTPS templates do not map /usr/bin through ScriptAlias. They serve static GET/HEAD content, disable executable handlers and .htaccess overrides, and deny script extensions. [Upstream advisory](https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026)
- Method: static inspection of the original package after signature and SHA-256 verification. No new live production exploit test was performed.
- Earlier releases are outside this assessment. A first-fixed DCSF release has not been established. The 51 P-01–P-51 remediations are not 51 CVEs.
- [Evidence and assessment scope](https://dcsf.net/security/messenger-assessment.json)

## Verified release changelog (12)

### DH20.29 / 15.10.32
Published: 2026-10-08T13:33:03Z; current release
- Validated WHM session context: The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
- Bounded LFD process-state compaction: LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
- Permissions limited to public cPanel META modules: The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
- Reliable reseller-file repair: DH20.29 safely repairs a missing final LF in csf.resellers and corrects the shell error found on the canary. DH20.28 / 15.10.31 is superseded because its reseller repair path was faulty.
- Equivalent nftables policy comparison: The comparison accepts a different listing order for independent chains while preserving rule order inside each chain and the remaining policy checks. Reordering independent chains alone no longer causes a false policy mismatch.
- 77/77 Linux tests and a completed canary: Maintainer qualification passed all 77 Linux test files. The autossltest2 canary update completed with CSF/LFD active and configuration preserved. The separately checked production host has passed dry-run only; this is not a production-upgrade claim.
- [Signed manifest](https://update.dcsf.net/releases/15.10.32/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.32/release.json)

### DH20.28 / 15.10.31
Published: 2026-10-08T13:17:05Z; historical release
- Validated WHM session context: The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
- Bounded LFD process-state compaction: LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
- Permissions limited to public cPanel META modules: The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
- Superseded reseller repair: DH20.28 introduced a missing-LF repair for csf.resellers, but canary testing found a shell error in that path. Use DH20.29 / 15.10.32, which replaces this release.
- [Signed manifest](https://update.dcsf.net/releases/15.10.31/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.31/release.json)

### DH20.27 / 15.10.30
Published: 2026-09-29T12:49:14Z; historical release
- Native WHM Jupiter interface restored: DH20.27 fixed the cPanel regression where a standalone DCSF HTML document replaced the WHM page. DCSF renders through csf.tmpl and the native master_templates/master.tmpl, retaining panel navigation and responsive layout.
- Taint-mode CGI and bounded template helper: The main CGI retains perl -T, request validation and same-origin responses. A fixed root:root 0700 helper uses cPanel private Perl and Cpanel::Template::process_template through list-form IPC::Open2. It clears interpreter-control environment variables, fixes PATH, accepts no path or template arguments and limits stdin to 32 MiB.
- Verified release without firewall-policy changes: Release qualification passed 1,533 assertions in 77 Linux test files. Canary and production upgrades preserved selected operator configuration and normalized IPv4/IPv6 policies; CSF/LFD remained active and enabled. Authenticated WHM and Playwright checks covered desktop 1440 and mobile 390 pixel viewports. WebGuard remains disabled by default.
- [Signed manifest](https://update.dcsf.net/releases/15.10.30/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.30/release.json)

### DH20.26 / 15.10.29
Published: 2026-09-29T11:23:47Z; historical release
- nginx is the client-address authority: For the verified cPanel EA-Nginx topology, SERVER="auto" selects nginx on public ports 80/443. Its structured edge access feed supplies the real client address. WebGuard does not trust arbitrary X-Forwarded-For values or infer clients from an ordinary Apache backend log.
- Apache reports load, not a client to block: Apache listens on private ports 81/444. Its server-status and optional backend-role feed contribute overload evidence only. The local nginx peer 127.0.0.1 cannot become a blocking candidate. Unsupported or unverified proxy layouts are not assumed to have the same trust boundary.
- One trusted library tree during diagnostics: A diagnostic run of an extracted signed package beside older cPanel CSF keeps the selected package libraries first. An exact legacy prepend of /usr/local/csf/lib reasserts the trusted source root and leaves installed libraries as fallback only. Normal installed execution is unchanged.
- [Signed manifest](https://update.dcsf.net/releases/15.10.29/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.29/release.json)

### DH20.25 / 15.10.28
Published: 2026-09-29T10:56:31Z; historical release
- Verified cPanel EA-Nginx proxy detection: WebGuard recognizes a bounded, root-owned cPanel EA-Nginx configuration with nginx on public ports 80/443 and Apache on private ports 81/444. Automatic request authority selects the nginx edge feed.
- Private Apache status and backend-only evidence: The protected Apache status broker prefers the private Apache listener. Apache server-status and an optional backend feed supply saturation evidence, not client identity; the local proxy peer cannot become a firewall candidate.
- [Signed manifest](https://update.dcsf.net/releases/15.10.28/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.28/release.json)

### DH20.24 / 15.10.27
Published: 2026-09-28T14:30:09Z; historical release
- Native snapshot before migration: When iptables-save cannot export a known incompatible iptables-nft table, the cpanel-csf migration saves the complete nft list ruleset and exporter diagnostics with SHA-256 checksums. It proceeds only after proving the parallel legacy backend is inert and securing the exact RPM rollback package.
- Bounded rebuild through trusted CSF: The bootstrap rebuilds only the incompatible standard filter, nat, mangle, raw and security tables in the ip and ip6 families through the already installed, trusted csf -r. Unrelated native tables are not selected for normalization.
- Canonical policy check and automatic rollback: Canonical IPv4/IPv6 policies are compared before and after the rebuild. A missing table, semantic mismatch, interruption or later installation failure triggers restoration. Tests covered all ten standard tables, including a forced mismatch that restored the original policy and configuration.
- [Signed manifest](https://update.dcsf.net/releases/15.10.27/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.27/release.json)

### DH20.23 / 15.10.26
Published: 2026-09-27T16:29:48Z; historical release
- Populated private AI state directories: The installer checks owner, group and permissions of private AI state directories without requiring a directory link count of one. Existing subdirectories on ext filesystems no longer cause a false installation refusal; unsafe ownership or permissions still stop installation.
- [Signed manifest](https://update.dcsf.net/releases/15.10.26/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.26/release.json)

### DH20.22 / 15.10.25
Published: 2026-09-16T10:32:19Z; historical release
- Optional AI System Scan: AI System Scan adds quick and deep assessments to the DCSF administration interface. It is disabled by default and requires the administrator to configure a personal OpenAI API key and select a model.
- Bounded evidence and private credentials: A single background scan collects a bounded local security snapshot, with limits on reads, processes, data size and execution time. The API key is kept in a separate root-only file and is never rendered back into the interface.
- Findings tied to supplied evidence: OpenAI Responses API requests use store=false, no tools and strict structured output. Findings and recommendations must cite valid evidence IDs from the submitted snapshot. Results are advisory and do not automatically execute repairs.
- [Signed manifest](https://update.dcsf.net/releases/15.10.25/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.25/release.json)

### DH20.21 / 15.10.24
Published: 2026-09-14T12:20:40Z; historical release
- Exporter warnings stop migration: The migration bootstrap refuses to continue when iptables-save returns exit code 0 but its diagnostics report an incompatible nft table. A successful exit status alone is not accepted as proof of a complete firewall export.
- Mixed and omitted firewall state is refused: Migration is refused when legacy and nft rules coexist, or when an active standard nftables table is omitted from the export. An incomplete snapshot cannot silently become the rollback baseline.
- Complete, checksum-bound migration evidence: The migration backup saves the full nft list ruleset output and exporter diagnostics. These files are included in the backup SHA-256 checksums so the captured rules and export evidence can be verified together.
- [Signed manifest](https://update.dcsf.net/releases/15.10.24/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.24/release.json)

### DH20.20 / 15.10.23
Published: 2026-09-13T20:38:12Z; historical release
- LFD active after production updates: After a successful production-profile update (TESTING=0), the installer restarts LFD and checks the result, including active service state on systemd. The new daemon code takes effect immediately; TESTING=1 installations are not started.
- [Signed manifest](https://update.dcsf.net/releases/15.10.23/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.23/release.json)

### DH20.19 / 15.10.22
Published: 2026-09-13T20:05:57Z; historical release
- Separate procfs context budget: Contextual identity checks have a separate, bounded procfs scan budget. Hosts with many processes no longer generate false excessive usage alerts from this budget collision; ordinary process, per-UID and global limits are not relaxed.
- [Signed manifest](https://update.dcsf.net/releases/15.10.22/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.22/release.json)

### DH20.18 / 15.10.21
Published: 2026-09-13T07:47:43Z; historical release
- Accurate systemd Apache detection for Zimbra: Systemd service state is authoritative for Apache and ModSecurity log checks. A private Zimbra httpd process does not make an inactive system Apache appear active. The legacy init process fallback is retained.
- [Signed manifest](https://update.dcsf.net/releases/15.10.21/manifest.txt)
- [Release metadata](https://update.dcsf.net/releases/15.10.21/release.json)


## DH20.29: WHM, LFD and installer repairs
- Validated WHM session context: The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
- Bounded LFD process-state compaction: LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
- Permissions limited to public cPanel META modules: The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
- Reliable reseller-file repair: DH20.29 safely repairs a missing final LF in csf.resellers and corrects the shell error found on the canary. DH20.28 / 15.10.31 is superseded because its reseller repair path was faulty.
- Equivalent nftables policy comparison: The comparison accepts a different listing order for independent chains while preserving rule order inside each chain and the remaining policy checks. Reordering independent chains alone no longer causes a false policy mismatch.
- 77/77 Linux tests and a completed canary: Maintainer qualification passed all 77 Linux test files. The autossltest2 canary update completed with CSF/LFD active and configuration preserved. The separately checked production host has passed dry-run only; this is not a production-upgrade claim.

### AI System Scan (retained capability)
- Model choices in this release: gpt-5-mini, gpt-5.4-mini, gpt-5.6-terra. Availability depends on the OpenAI API account.
- Selected local security diagnostics are sent to OpenAI after activation. Recognised secret values are redacted, but this is not an anonymity guarantee. store=false is not a Zero Data Retention guarantee; the API account and provider data policies still apply. Optional API usage is billed separately from the free DCSF software. Findings need administrator review and do not guarantee that every security issue is detected.
- [OpenAI API data controls](https://developers.openai.com/api/docs/guides/your-data)

### Retained earlier fixes
- Native WHM Jupiter interface restored: DH20.27 fixed the cPanel regression where a standalone DCSF HTML document replaced the WHM page. DCSF renders through csf.tmpl and the native master_templates/master.tmpl, retaining panel navigation and responsive layout.
- Taint-mode CGI and bounded template helper: The main CGI retains perl -T, request validation and same-origin responses. A fixed root:root 0700 helper uses cPanel private Perl and Cpanel::Template::process_template through list-form IPC::Open2. It clears interpreter-control environment variables, fixes PATH, accepts no path or template arguments and limits stdin to 32 MiB.
- nginx is the client-address authority: For the verified cPanel EA-Nginx topology, SERVER="auto" selects nginx on public ports 80/443. Its structured edge access feed supplies the real client address. WebGuard does not trust arbitrary X-Forwarded-For values or infer clients from an ordinary Apache backend log.
- Apache reports load, not a client to block: Apache listens on private ports 81/444. Its server-status and optional backend-role feed contribute overload evidence only. The local nginx peer 127.0.0.1 cannot become a blocking candidate. Unsupported or unverified proxy layouts are not assumed to have the same trust boundary.
- One trusted library tree during diagnostics: A diagnostic run of an extracted signed package beside older cPanel CSF keeps the selected package libraries first. An exact legacy prepend of /usr/local/csf/lib reasserts the trusted source root and leaves installed libraries as fallback only. Normal installed execution is unchanged.
- Native snapshot before migration: When iptables-save cannot export a known incompatible iptables-nft table, the cpanel-csf migration saves the complete nft list ruleset and exporter diagnostics with SHA-256 checksums. It proceeds only after proving the parallel legacy backend is inert and securing the exact RPM rollback package.
- Bounded rebuild through trusted CSF: The bootstrap rebuilds only the incompatible standard filter, nat, mangle, raw and security tables in the ip and ip6 families through the already installed, trusted csf -r. Unrelated native tables are not selected for normalization.
- Canonical policy check and automatic rollback: Canonical IPv4/IPv6 policies are compared before and after the rebuild. A missing table, semantic mismatch, interruption or later installation failure triggers restoration. Tests covered all ten standard tables, including a forced mismatch that restored the original policy and configuration.
- Optional AI System Scan: AI System Scan adds quick and deep assessments to the DCSF administration interface. It is disabled by default and requires the administrator to configure a personal OpenAI API key and select a model.
- Bounded evidence and private credentials: A single background scan collects a bounded local security snapshot, with limits on reads, processes, data size and execution time. The API key is kept in a separate root-only file and is never rendered back into the interface.
- Findings tied to supplied evidence: OpenAI Responses API requests use store=false, no tools and strict structured output. Findings and recommendations must cite valid evidence IDs from the submitted snapshot. Results are advisory and do not automatically execute repairs.
- Populated private AI state directories: The installer checks owner, group and permissions of private AI state directories without requiring a directory link count of one. Existing subdirectories on ext filesystems no longer cause a false installation refusal; unsafe ownership or permissions still stop installation.
- Conservative migration gates remain: An exit code 0 from an exporter is not proof of completeness. Migration still refuses unknown diagnostics or active parallel legacy policy. An active standard nftables table missing from the normalized snapshot or a changed canonical policy triggers rollback.
- Separate procfs context budget: Contextual identity checks have a separate, bounded procfs scan budget. Hosts with many processes no longer generate false excessive usage alerts from this budget collision; ordinary process, per-UID and global limits are not relaxed.
- LFD active after production updates: After a successful production-profile update (TESTING=0), the installer restarts LFD and checks the result, including active service state on systemd. The new daemon code takes effect immediately; TESTING=1 installations are not started.
- Bounded registration retry: Installation registration uses the extensionless HTTPS API with bounded retry and backoff. A transient failure can be retried without an unbounded wait; signed identity and source-address checks remain in force.
- SELinux-aware installation: The installer checks SELinux state before using chcon. Disabled SELinux no longer produces misleading relabel warnings, while enabled systems retain context handling.
- Native systemd handling: A systemd-only host no longer reports missing legacy SysV init files or tries to change ownership of files that are not installed. Legacy init remains supported.
- Accurate Apache and ModSecurity checks: Inactive Apache and default ModSecurity log paths are informational. With systemd, actual service state is authoritative: Zimbra's private /opt/zimbra/common/bin/httpd is not mistaken for the system Apache service. Legacy init retains a process fallback.
- Validated Zimbra mail transport: The canonical Zimbra sendmail symlink is recognized through the trusted-path check. This targeted compatibility repair does not make arbitrary symlinks trusted.

## Product identity
- Public release: DH20.29
- Technical package: DCSF 15.10.32
- Compatibility baseline: CSF/LFD 15.10
- Price: USD 0
- Licence: GNU GPLv3
- Maintainer: DataHouse, a brand of eTop sp. z o.o.
- Suggestions and technical reports: dat@etop.pl
- Download: https://dcsf.net/download/
- Installer: https://dcsf.net/install.sh
- Release metadata: https://dcsf.net/release.json
- Signed manifest: https://dcsf.net/v1/stable/manifest.txt
- Package source commit: 784481c2223e709ec9ab0a3e9bcc8cc41071293f
- Release tag commit: 3849ed6a3f0b58cd5f1afaca1241d0e73f6fb90a
- Release branch: fix/centos6-compat

## Security programme
- 51 verified security remediations are tracked across signed distribution, bounded parsing, privileged execution, remote input validation, filesystem races, transactional firewall state, authenticated clustering, process identity, panel authorisation and DNS trust.
- Three verified operational controls cover explicit installation profiles, CC_DENY reply direction and preservation of Docker-owned firewall policy.
- The current item-by-item status is public at https://dcsf.net/hardening/.
- The signed DH20.29 release passed all 77 qualification gates, while the focused public-bootstrap suite passed 85 of 85 checks; it maps to technical version 15.10.32.
 - Updates use a fixed origin, pinned RSA-3072 verification with SHA-256, strict HTTPS, manifest binding, archive validation and rollback checks.

## Fixed bug and exploit classes
- Root command and argument injection: P-01, P-06, P-07, P-25 and P-41 remove unsafe shell boundaries, validate privileged arguments and constrain identity transitions.
- ReDoS and parser resource exhaustion: P-09, P-19, P-33, P-43 and P-49 bound line length, allocation, regex work, output, concurrency and procfs scanning.
- Symlink, hardlink and TOCTOU races: P-03, P-22, P-32 and P-34 bind sensitive work to verified files, owners and inodes instead of reusable paths.
- Update and remote-source substitution: P-02, P-05, P-15, P-16, P-18, P-40 and P-42 authenticate releases, constrain archives and retain a last-known-good state.
- XSS, CSRF, MIME and panel-authorisation abuse: P-10, P-11, P-31, P-36, P-38 and P-51 protect rendering, state changes, templates, webroots and native panel permissions.
- Cluster spoofing, replay and resource abuse: P-20 authenticates and frames cluster traffic, detects replay and applies strict connection, message and work limits.
- Process identity and accounting bypass: P-44 through P-50 defend against PID reuse, procfs field shifting, PGID/SID confusion, pignore abuse and unsafe lock recovery.
- Firewall state loss and policy bypass: P-17, P-35, O-02 and O-03 make rule changes transactional and preserve reply traffic, rollback state and Docker-owned policy.
- DNS trust-boundary and cache confusion: P-27 through P-30 separate display data from authorisation, canonicalise PTR values and bound resolver work and caches.

## Perl dependency repair
- DH20.29 inventories the exact closed Perl module list before preflight and re-verifies it after repair.
- The list requires JSON::PP: RPM selects signed capability perl(JSON::PP), Debian selects libjson-pp-perl, cPanel uses private cpanm and system CPAN requires --allow-cpan-fallback.
- Outside cPanel, missing modules are installed from authenticated OS repositories: exact RPM capabilities with GPG or closed APT package mappings.
- The system CPAN fallback is disabled by default and requires explicit --allow-cpan-fallback; it uses a fixed HTTPS MetaCPAN mirror.
- On cPanel, DCSF always validates /usr/local/cpanel/3rdparty/bin/perl, selects matching versioned cpanm and invokes it through the same private interpreter.
- Repair attempts are bounded and must make measurable progress; module names, paths, ownership, modes and privileged environments are validated without shell eval.
- An earlier public --dryrun canary authenticated the release under test and left regular files directly below /etc/csf byte-identical.

## Integrations
- DH20.29 retains safe installation on a clean OLSPanel layout: modules is optional and does not participate in detection.
- Discovery uses a safely validated /etc/olspanel/base_dir, supported canonical roots, panel markers and the loaded cp.service.
- Before installation, the adapter only reads metadata for /etc/csf, /etc/csf/csf.conf and /etc/csf/csf.cloudflare; --dryrun performs the same checks without changes.
- Symlinks, non-regular files, non-root ownership, group/world writable metadata and protected files with more than one hard link are rejected with the exact path.
- After installation, /etc/csf is finalized as root:root 0700 while csf.conf and csf.cloudflare become root:root 0600 with one hard link; existing contents remain byte-identical.
- A missing csf.cloudflare may only be installed from the authenticated package.
- Recursive chmod or chown failure stops the generic installer and cannot lead to a false PASS.
- A missing modules directory is created only during installation as root:root 0755 with private provenance recording.
- Uninstall removes the directory only when DCSF created it and it remains empty; foreign content is preserved.
- Required JSON::PP is checked by preflight and os.pl, and after generic installation the backend must pass an isolated perl -T -c check before panel integration is published or restarted.
- The backend explicitly loads /usr/local/csf/lib/ConfigServer/panel-action-policy.json with require_trusted => 1; the complete path chain and file must be root-controlled and non-writable by others.
- The installer sends a real read-only binary request through the taint-mode backend; the response is capped at 16 MiB and must contain the DCSF interface marker.
- Protected actions use a dedicated bounded type="password" field instead of window.prompt(); Escape, cancellation and backdrop cancellation stop the operation, and the visible field is cleared immediately.
- Search System Logs and Watch System Logs accept only a one-to-twenty digit nocache value, end progress after every response and display failed-request status.
- Deduplicated navigation is deferred to the next event turn and submitted to _self, so Quick Allow, configuration save, Search for IP and Firewall Allow retain complete responses.
- The action iframe stays between 640 and 1,200 pixels, scrolls long content internally and returns to the top after every navigation.
- The production Django-to-Perl-backend path on extmail.uck.katowice.pl returned HTTP 200 in the earlier OLSPanel production check; the outer page stayed 1,000 pixels high at scroll position zero, the reauthentication modal remained visible, and log, IP-search and allow-list workflows passed.
- OLSPanel serves signed images, including csf.svg, from /usr/local/csf/lib/webmin/csf/images.

- cPanel & WHM: Preserves WHM workflows and backup-first RPM migration. Verified EA-Nginx uses nginx on 80/443 for client IP and Apache on 81/444 for backend status. Dependency repair keeps /usr/local/cpanel/3rdparty/bin/perl separate from system Perl.
- OLSPanel: Keeps the OLSPanel action iframe between 640 and 1,200 pixels with internal scrolling and top reset, so masked reauthentication, Watch System Logs, Search for IP and Firewall Allow remain visible.
- DirectAdmin: Uses the established DirectAdmin adapter with hardened argument validation, identity transitions and shell-free privileged execution.
- CyberPanel: Retains the CyberPanel integration while restricting privileged mutations to authenticated, CSRF-protected POST actions.
- CWP: Supports the existing Control Web Panel administration path with the same signed package, parser limits and firewall-state safeguards.
- InterWorx: Integrates with NodeWorx and enforces native FIREWALL authority, blocking secondary accounts that do not hold that permission.
- VestaCP: Keeps the VestaCP CSF/LFD integration path while applying the common DCSF release, input-validation and recovery controls.
- Webmin: Supports CSF/LFD administration through Webmin with the same hardened backend and signed update channel.
- Generic Linux: Provides direct operation on supported RHEL- and Debian-family servers. Missing closed-list Perl modules are repaired through GPG-verified RPM capabilities or authenticated APT package mappings.

## Published fix-count comparison
- DCSF DH20.29: 51 verified security remediations, 3 public operational controls and WebGuard; 77 of 77 release checks passed.
- cPanel CSF 16.31-1: the maintainer calls it a Targeted Security Release but does not disclose a fix count; the preceding 16.30-1 documents 4 security fixes and 5 stability or compatibility fixes.
- Aetherinox CSF 15.10: the public release summary lists 11 fix items, including 2 directly addressing XSS or untrusted-input encoding.
- Methodology: fix items, security gates and CVE identifiers are not equivalent units; unknown figures are not estimated.
- Sources: https://docs.cpanel.net/changelogs/configserver-security-firewall-csf-change-log/ and https://github.com/Aetherinox/csf-firewall/releases/tag/15.10.

## Complete verified fix register
- P-01: Isolate Messenger reCAPTCHA input from every root shell boundary [VERIFIED]
- P-02: Keep remote GLOBAL feeds data-only and unable to deliver advanced rules [VERIFIED]
- P-03: Protect Messenger files from symlink, hardlink and replacement races [VERIFIED]
- P-04: Parse CIDR /0 explicitly and permit it only through caller policy [VERIFIED]
- P-05: Require pinned RSA-3072 signatures, SHA-256-bound metadata and rollback checks for updates [VERIFIED]
- P-06: Harden the DirectAdmin privileged bridge and verify identity transitions [VERIFIED]
- P-07: Run privileged Perl entry points in taint mode with a minimal environment [VERIFIED]
- P-08: Generate a protected host-local key for the standalone interface [VERIFIED]
- P-09: Bound standalone UI workers, requests, searches, pre-authentication time and emitted output [VERIFIED]
- P-10: Add CSPRNG sessions, CSRF protection, secure headers and modern TLS to the standalone UI [VERIFIED]
- P-11: Encode untrusted output at the final rendering boundary in every UI adapter [VERIFIED]
- P-12: Classify Dovecot 2.4 success and failure variants without known false positives [VERIFIED]
- P-13: Ignore managesieve-login consistently in every applicable profile [VERIFIED]
- P-14: Restrict custom regex results to validated TCP or UDP ports from 1 to 65535 [VERIFIED]
- P-15: Enforce HTTPS with certificate and hostname verification for remote sources [VERIFIED]
- P-16: Validate download status, size and format before atomic last-good replacement [VERIFIED]
- P-17: Propagate restore failures and retain the last working firewall state [VERIFIED]
- P-18: Extract ZIP blocklists with strict limits and atomic replacement [VERIFIED]
- P-19: Bound log records before regex processing and remove catastrophic patterns [VERIFIED]
- P-20: Authenticate, frame and resource-bound all cluster traffic [VERIFIED]
- P-21: Isolate LF_DIRWATCH offenders and recover monitoring automatically [VERIFIED]
- P-22: Apply LF_SCRIPT_PERM changes only to the verified open inode [VERIFIED]
- P-23: Keep secrets out of arguments, URLs, unsafe files and diagnostic bodies [VERIFIED]
- P-24: Use one strict canonical API for IPv4, IPv6 and CIDR normalization [VERIFIED]
- P-25: Validate the final mail envelope and invoke sendmail without a shell [VERIFIED]
- P-26: Resolve exact syslog user names, including names beginning with an underscore [VERIFIED]
- P-27: Separate display DNS data from security-authorisation cache state [VERIFIED]
- P-28: Match trusted hostnames only as exact names or DNS-label suffixes [VERIFIED]
- P-29: Canonicalise PTR data before cache, logs, mail, HTML or configuration use [VERIFIED]
- P-30: Bound DNS verification and caches by time, concurrency, size and complexity [VERIFIED]
- P-31: Allow privileged CyberPanel mutations only through protected POST actions [VERIFIED]
- P-32: Remove predictable and followable temporary files from every installer [VERIFIED]
- P-33: Prevent raw-byte record readers from splitting inside multibyte characters [VERIFIED]
- P-34: Register, authorise and bound every persistent store consumed by root [VERIFIED]
- P-35: Use one unambiguous transactional grammar for temporary firewall rules [VERIFIED]
- P-36: Render alert templates once and prevent untrusted MIME structure injection [VERIFIED]
- P-37: Drop Messenger v1 privileges irreversibly and close inherited descriptors [VERIFIED]
- P-38: Contain Messenger v2 and v3 webroots and generated webserver configuration [VERIFIED]
- P-39: Verify the Messenger identity and make each instance lifecycle transactional [VERIFIED]
- P-40: Build and install releases from a closed, verified artifact inventory [VERIFIED]
- P-41: Transport authenticated panel requests without invoking a shell [VERIFIED]
- P-42: Validate and install remote Geo and ASN datasets as one last-good transaction [VERIFIED]
- P-43: Bound log-record allocation before a complete attacker-controlled line enters memory [VERIFIED]
- P-44: Bind process actions to kernel identity rather than a reusable PID or socket inode [VERIFIED]
- P-45: Ensure fork-bomb handling never treats a session ID as a process-group ID [VERIFIED]
- P-46: Remove command text and custom pignore regexes as process identity or action authority [VERIFIED]
- P-47: Prevent attacker-controlled comm bytes from shifting procfs identity fields or hiding a process [VERIFIED]
- P-48: Prevent executable exceptions from bypassing accounting across UID, service or supervisor boundaries [VERIFIED]
- P-49: Bound procfs scanning per object, per UID and globally with cross-UID fairness [VERIFIED]
- P-50: Bound lock-hang recovery and never signal a target parsed from lock-file bytes [VERIFIED]
- P-51: Block secondary InterWorx NodeWorx accounts from DCSF unless they hold native firewall authority [VERIFIED]

## Operational release controls
- O-01: Require an explicit testing or production installation profile and expose testing mode in health checks [VERIFIED]
- O-02: Preserve replies to locally initiated connections under CC_DENY without admitting new inbound traffic [VERIFIED]
- O-03: Preserve Docker-owned chains and DOCKER-USER policy through firewall restart and rollback [VERIFIED]

## WebGuard
- WebGuard is an optional per-vhost web saturation correlation service for OpenLiteSpeed, nginx and Apache.
- Safe defaults are WEBGUARD=0 and WEBGUARD_MODE=report; no firewall action occurs without explicit activation and evidence review.
- Replay is capped at 50,000 lines, 30 seconds and 2,000 audit records, and reports completeness plus the stopping reason.
- Correlation uses bounded buffers, avoids quadratic scans and handles out-of-order timestamps outside the LFD regex loop.
- A dedicated root service copies the validated OpenLiteSpeed log into a DCSF file capped at 256 MiB and rotated at 128 MiB.
- Enforce mode permits only a temporary exact-IP, inbound, configured-listener-port action.
- Allow and ignore lists, monitoring networks and trusted proxy or CDN ranges are protected; replay is always report-only.

## Threat intelligence
- DCSF includes the continuously refreshed DataHouse Threat Feed.
- Indicators are validated, normalised, deduplicated, aged and published through a controlled pipeline.
- The signed package contains the maintained DataHouse feed source configuration.

## Primary pages
- https://dcsf.net/: DCSF DH20.29: hardened CSF/LFD with WHM session fixes, bounded LFD state, safe reseller repair, nftables policy checks and signed updates.
- https://dcsf.net/security/: See how DCSF hardens CSF/LFD against command injection, ReDoS, file races, update-chain attacks, panel abuse, replay and process-accounting bypasses.
- https://dcsf.net/hardening/: Technical register of 51 verified CSF/LFD remediations in DCSF DH20.29, optional AI System Scan, hardened WebGuard and 77-of-77 release qualification.
- https://dcsf.net/integrations/: Hardened CSF/LFD for OLSPanel, cPanel & WHM, DirectAdmin, CyberPanel, CWP, InterWorx, VestaCP, Webmin and panel-free RHEL or Debian Linux servers.
- https://dcsf.net/threat-intelligence/: Learn how DCSF consumes a continuously refreshed DataHouse threat feed with validation, deduplication, ageing and fail-safe application.
- https://dcsf.net/updates/: DCSF DH20.29 / 15.10.32: WHM session context, LFD state compaction, cPanel META permissions, reseller repair and nftables equivalence checks.
- https://dcsf.net/download/: Download DCSF DH20.29, technical package 15.10.32. Verify the RSA-3072 signature, manifest, installer and SHA-256-bound closed inventory.

## Provenance
- Maintainer: DataHouse, a brand of eTop sp. z o.o.
- Project site: https://dcsf.net/
- DataHouse: https://datahouse.pl/
- Licence: GNU GPLv3; upstream copyright and licence notices are preserved.