lfd – Login Failure Daemon

lfd – Login Failure Daemon

Login Failure Daemon идет в связке с ConfigServer Firewall (csf)
http://configserver.com/cp/csf.html
Login Failure Daemon (lfd)
 
To complement the ConfigServer Firewall (csf), we have developed a Login Failure Daemon (lfd) process that runs all the time and periodically (every X seconds) scans the latest log file entries for login attempts against your server that continually fail within a short period of time. Such attempts are often called “Brute-force attacks” and the daemon process responds very quickly to such patterns and blocks offending IP’s quickly. Other similar products run every x minutes via cron and as such often miss break-in attempts until after they’ve finished, our daemon eliminates such long waits and makes it much more effective at performing its task.

Login tracking is an extension of lfd, it keeps track of POP3 and IMAP logins and limits them to X connections per hour per account per IP address.
ну и местами эта хрень валит серванты. как пример, ***_Чей_Хост
при ручном тушении спамит
+++++
The service ‘lfd’ on server ***_Чей_Хост is currently down
++++++
т.к. заIPало, ( думаю не только меня), то

/etc/init.d/lfd stop
/etc/init.d/lfd status
chmod 0 /usr/sbin/lfd

прибил и чмоднул в нах
+

update-rc.d -f lfd remove

ушибил из стартовых скриптов
+

joe /usr/local/directadmin/data/admin/services.status

а эта отвечает за те самые алерты

directadmin=ON
dovecot=ON
exim=OFF
httpd=ON
lfd=ON
mysqld=ON
named=ON
proftpd=ON
sshd=ON

lfd=ON – ремувнуть_нах

/etc/init.d/directadmin restart

а вот потом, когда сервантик расчехлится, можно будет ковырять схерали оно такикакается, потому-как временами и ConfigServer Firewall (csf) и Login Failure Daemon (lfd) – очень даже прикольные приблуды

© Анатолий Панченко. © madrat