Page 1 of 1

Disable SSH login alert emails

Posted: 16 Aug 2019, 01:53
by c0m
Hi,

Receiving a ton of SSH login alert emails for genuine and approved logins - how can I turn off these login alerts completely, or add a list of IP addresses that won't trigger these alert emails:

lfd on example.com: SSH login alert for user root from 1.1.1.1

Tried changing LF_SSH_EMAIL_ALERT to ="0" in csf.conf - but that has no effect. RESTRICT_SYSLOG is also set to ="0", so not sure if this affects the first option?

I also tried adding the IPs to csf.ignore - which also doesn't stop the emails for SSH logins.

Any ideas?

Re: Disable SSH login alert emails

Posted: 16 Aug 2019, 03:10
by c0m
Changing the LF_ALERT_TO email address in csf.conf doesn't work either, it still sends to the default address... strange?

Re: Disable SSH login alert emails

Posted: 16 Aug 2019, 03:23
by c0m
OK, so after none of the configurations were taking effect even after using csf -r I found out that lfd would need to be restarted with a separate command service lfd restart in order for the new config to take effect.

Then I also had to set IGNORE_ALLOW to 1 in csf.conf so that IPs in csf.allow and csf.ignore will actually be used.

So that works now - problem solved.