How to know when a certain IP is blocked due to login failures in linux?
by Sanju[ Edit ] 2008-09-02 11:30:35
When there is a login failure for FTP, Cpanel, Email Client, POP3, htpasswd etc., more than a number of times a certain IP will be blocked due to login failures.
The
blocked IP is in,
vi /etc/csf/csf.deny
To
unblock the IP address just run,
./csf.pl -dr IP
To
block the IP address just run,
./csf.pl -d IP
which is in
cd /etc/csf/
We can also enable login failure detections of cpanel, webmail, whm connections etc., by putting an entry in,
vi /etc/csf/csf.conf
For example:
# [*]Enable login failure detection of cpanel, webmail and whm connections
LF_CPANEL = "10"
LF_CPANEL_PERM = "1"
When there is login failure of more than 10 times the certain IP will be blocked.
