Login Failure Daemon(LFD) is a daemon process which runs on VPS or Dedicated servers that uses Config Server Firewall(CSF) for server security. LFD scans the server logs and sends notifications every time when the process uses more memory or takes more time than the value assigned in your CSF configuration file. LFD considers recent failed login attempts as ‘Brute Force Attacks’ and blocks those IPs using CSF. CSF is a firewall configuration script commonly used in cPanel.
You can access the CSF configuration in WHM by using the following steps.
- Login to your WHM
- Go to Home >> select Plugins
- Click ‘ConfigServer Security & Firewall’
- Choose ‘Firewall Configuration’
LFD excessive resource usage alert
LFD service sends excessive resource usage alerts to the email address which is assigned to it, normally to root user account. This notification points out a particular process or service using excessive server resources. This helps in identifying the resource eating process/service. We can either kill/stop the process/service to free the resource or allocate more resource to it, if necessary.
Example email alert from LFD when memory is exceeded
Time: Mon Nov 14 19:41:10 2016 +0530
Account: xxxxxx
Resource: Virtual Memory Size
Exceeded: 205 > 200 (MB)
Executable: /usr/bin/php
Command Line: /usr/bin/php /home/xxxxxx/public_html/index.php
PID: 26953 (Parent PID:24974)
Killed: No
This alert is sent by LFD when a process uses more memory resources than defined in the CSF configuration file.
Example email alert from LFD when the time is exceeded
Time: Mon Nov 14 19:41:10 2016 +0530
Account: xxxxxx
Resource: Virtual Memory Size
Exceeded: 125389 > 1800 (seconds)
Executable: /usr/bin/php
Command Line: /usr/bin/php /home/xxxxxx/public_html/index.php
PID: 28429 (Parent PID:26561)
Killed: No
This alert is sent by LFD when a process takes more time to execute than defined in the CSF configuration file.
Disabling Alerts
Method 1: Permanently Disable
This method will permanently disable the LFD excessive resource usage alert. Performing this method will pose a security issue.
- Login to your WHM
- Open the CSF Firewall configuration
- Modify the value of directives PT_USERMEM and PT_USERTIME to 0.
PT_USERMEM = 0PT_USERTIME = 0
Save the settings.
Method 2:Increase the threshold
In this method, we will increase the values of both memory and time to disable the LFD alerts. This method is a temporary one. If any process/service uses more resources than defined, you will continue to receive the LFD alerts.
- Login to your WHM
- Open the CSF Firewall configuration
- Modify the value of directives PT_USERMEM and PT_USERTIME to desired.
PT_USERMEM = 500PT_USERTIME = 150000
- Save the settings
Method 3: The pignore of CSF
This method is a standard technique to disable the LFD alerts. In this method, we will include the particular process/service in pignore of CSF. The pignore of CSF will ignore the particular process/service included in it and hence disables the LFD alerts.
- Login to your server as root user.
- Using your favorite editor open pignore of CSF. The common location of pignore is /etc/csf/csf.pignore.
- Add the command line path specified in the alert to the pignore of CSF.
- Save changes.
By the time, you complete performing these methods the LFD excessive resource usage alert will be disabled.
If you need any further assistance please contact our support department.
