Have you installed CSF in your server?
There is a daemon called lfd bundled with csf.
Login Failure Daemon (lfd) is a process that runs all the time and periodically (every X seconds) scans the latest log file entries for login attempts against your server that continually fail within a short period of time. Such attempts are often called "Brute-force attacks" and the daemon process responds very quickly to such patterns and blocks offending IP's quickly.
There is a daemon called lfd bundled with csf.
Login Failure Daemon (lfd) is a process that runs all the time and periodically (every X seconds) scans the latest log file entries for login attempts against your server that continually fail within a short period of time. Such attempts are often called "Brute-force attacks" and the daemon process responds very quickly to such patterns and blocks offending IP's quickly.
To check why lfd has failed look at the end of /var/log/lfd.log
Support for csf+lfd is over here - http://forum.configserver.com
Support for csf+lfd is over here - http://forum.configserver.com
| Thread starter | Similar threads | Forum | Replies | Date |
|---|---|---|---|---|
| S | Lots of FAILED: lfd and RECOVERED: lfd e-mails. | Security | 8 | |
| E | lfd /bin/passwd: FAILED | Security | 6 | |
| S | lfd on server.customer.com status: failed | Security | 3 | |
| L | lfd on server.mydomain.com failed | Security | 3 | |
| M | lfd/csf logs - can i see what the (failed) password attempt was? | Security | 2 |