Results 1 to 7 of 7
  1. #1
    Join Date
    Jul 2001
    Location
    Somewhere you're not
    Posts
    229

    LFD SSH Login Notifications, Ignore by IP?

    I'm using CSF/LFD, and I'd like to suppress LFD's SSH login email notifications for the times I login from my own trusted IP addresses.

    I have added these IP addresses to csf.ignore, but it hasn't made a difference. Is there something else I could try, or something I may have overlooked?

  2. #2
    Join Date
    May 2013
    Location
    India
    Posts
    748
    As per their forum, listing IPs in csf.ignore should be ignored from SSH login. Have you restarted LFD after adding your IPs?

  3. #3
    Join Date
    Jul 2001
    Location
    Somewhere you're not
    Posts
    229
    Ah, I see the issue - it's working properly, but the alerts I see are triggered when I change to other accounts using su. There's no IP address listed in those reports, I presume because it's all happening on the local machine.

    Is there a way to disable those notifications? 127.0.0.1 is listed in csf.ignore.

  4. #4
    Join Date
    Jul 2005
    Posts
    489
    Quote Originally Posted by Lancia View Post
    Ah, I see the issue - it's working properly, but the alerts I see are triggered when I change to other accounts using su. There's no IP address listed in those reports, I presume because it's all happening on the local machine.

    Is there a way to disable those notifications? 127.0.0.1 is listed in csf.ignore.
    Set "LF_SU_EMAIL_ALERT" in /etc/csf/csf.conf and restart csf

  5. #5
    Join Date
    Jun 2003
    Location
    World Wide Web
    Posts
    581
    Its advised to add your IP to CSF.allow list rather than csf.ignore
    SupportExpertz.com - the name says it all!
    Managed Cloud Servers
    Server Management and Monitoring
    24x7 outsourced customer support

  6. #6
    Join Date
    Jul 2001
    Location
    Somewhere you're not
    Posts
    229
    Quote Originally Posted by LnxtecH View Post
    Set "LF_SU_EMAIL_ALERT" in /etc/csf/csf.conf and restart csf
    Thanks!
    Quote Originally Posted by supportexpertz View Post
    Its advised to add your IP to CSF.allow list rather than csf.ignore
    It's in there, too. From my understanding, a listing in csf.allow prevents an IP from being blocked, while csf.ignore prevents activity from an IP from triggering alerts. Is that correct?

  7. #7
    Join Date
    May 2013
    Location
    India
    Posts
    748
    csf.allow is used by CSF to allow IPs while creating iptables rules, where csf.ignore is used by LFD to ignore IPs while triggering an event. As said, you can use LF_SU_EMAIL_ALERT directive in csf.conf to manage "su" alerts. It is not related to any IP address events.

Similar Threads

  1. Force LFD to send notifications even if on ignored list
    By httpCORE in forum Hosting Security and Technology
    Replies: 5
    Last Post: 06-03-2013, 08:14 AM
  2. LFD notifications
    By Wes0805 in forum VPS Hosting
    Replies: 3
    Last Post: 06-06-2011, 09:07 AM
  3. lfd ignore some file? [merged]
    By z0ne in forum Hosting Security and Technology
    Replies: 7
    Last Post: 07-16-2010, 10:56 AM
  4. lfd notifications increasing dramatically.
    By grandad in forum Hosting Security and Technology
    Replies: 4
    Last Post: 02-18-2010, 12:41 PM
  5. lfd not sending SSH Login anymore ?
    By excessnet in forum Hosting Security and Technology
    Replies: 3
    Last Post: 02-08-2008, 07:37 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •