I observed when csf is updated via cron [1] that the rules csfpost.sh should generate are not present, I suspect the path to the binaries invoked are not available. [1] cat /etc/cron.d/csf_update SHELL=/bin/sh 27 4 * * * root /usr/sbin/csf -u