2

I am using CSF/LFD on my CentOS 7 server, and would like to use it to temporarily block IP addresses that have multiple failed Postfix AUTH attempts. You know the one, I get line after line of:

lost connection after AUTH from host.example.com[123.123.123.123]

Once perhaps 6 of these have happened, I would like to block the IP for a while. I know this can be done with fail2ban but I am using CSF. I have looked around for info but can't figure out how it can be achieved. Is it possible?

  • Maybe this can help you. CSF Cheat Sheet – OscarAkaElvis Dec 15 '16 at 23:53
  • Thanks. It doesn't show how to do what I need but useful to know about. – Nigel B. Peck Dec 16 '16 at 1:08
  • It shows how to add temporary ips to a whitelist/blacklist and how to remove them. Is not what you need? Of course you'll need a script to check logs for the failed attempts before launch the CSF command, but that's all. Maybe your question is more related to how to do a bash script. – OscarAkaElvis Dec 16 '16 at 1:10
  • LFD scans log files regularly as a daemon process. I want to know how to configure LFD to pick up on these entries too, and then set up a temporary ban. Writing a script would mean it had to run every few seconds as a cron job which is precisely what LFD is designed to avoid being necessary. So that wouldn't work. Thanks though. – Nigel B. Peck Dec 16 '16 at 1:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.