Tune LFD login failure blocking and email alerts in CSF

LFD (Login Failure Daemon) is the half of CSF that reads log files and reacts. Out of the box it can be too strict for an office full of mail users, or too noisy with alert emails. A few settings in csf.conf balance protection against annoyance.

Before you start

• Root access and CSF installed. See install and configure CSF.
• Open WHM → Plugins → ConfigServer Security & Firewall → Firewall Configuration, or edit /etc/csf/csf.conf.

Set login failure triggers

Each service has an LF_ value: the number of failures within LF_INTERVAL seconds (default 3600) before the IP is blocked. Set a value to 0 to disable that check.

Mail protocols deserve higher values because one phone with an old password retries constantly.

Choose block durations

• LF_SSHD_PERM, LF_CPANEL_PERM and similar: set to 1 for a permanent block or a number of seconds, such as 3600, for a temporary one. Temporary blocks are kinder to customers.
• LF_PERMBLOCK = "1" with LF_PERMBLOCK_COUNT = "4" turns an IP that was temporarily blocked four times into a permanent block.
• LF_NETBLOCK can block a whole /24 when many IPs from it attack. Use it carefully: it can catch innocent users on the same ISP.

Reduce alert noise

• Set LF_ALERT_TO to the mailbox that should receive alerts.
• Turn off alerts you do not act on: LF_EMAIL_ALERT = "0" stops an email for every block; LF_PERMBLOCK_ALERT and LF_NETBLOCK_ALERT cover the bigger events.
• Process tracking (PT_USERPROC, PT_LIMIT) warns about long-running or high-memory processes. Raise PT_LIMIT or add trusted binaries to /etc/csf/csf.pignore, for example:
  Copy

  exe:/usr/local/bin/node

• LF_DIRWATCH reports suspicious files in /tmp; keep it, it often catches malware early.

Apply and verify

1. Click Change and Restart csf+lfd, or run:
   Copy

   csf -ra

2. Watch the log while you test with a wrong password from a spare IP:
   Copy

   tail -f /var/log/lfd.log

Next steps

• Unblock an IP in WHM CSF
• Allow, deny and temporary bans in CSF
• fail2ban for servers without CSF