ConfigServer Security & Firewall – disable email alerts from blocked IP addresses

Problem

You get an email every time CSF / lfd blocks an IP address from your web server which may look similar to this.

IP: xxx.xxx.xxx.xxx (Country Code/Country/hostname)
Failures: 5 ( sshd, smtpauth, etc)
Interval: 3600 seconds
Blocked: Permanent Block

Log entries:

[Date] refused connect from [IP address]

Cause

As the documentation states:

LF_EMAIL_ALERT:

Send an email alert if an IP address is blocked by one of the [*] triggers

This setting needs to be disabled.

Solution

1. Open the CSF config file in your web admin panel (if you have one) or by manually editing the file that is usually located here:
   /etc/csf/csf.conf
2. Change the “LF_EMAIL_ALERT” setting to 0.
3. Save changes.
4. Restart the csf and lfd processes.