Email Alert Setup for CSF

An wide range of settings are accessible in CSF configuration file. We have as of now talked about a lot of points related with CSF. Here I am talking about email alert setup for unapproved Login Failures and Port Scanning. In CSF predefined emails are put away under the location ‘/usr/local/csf/tpl/’.

See Also:

Enable/Disable Login Failures Email Alert

You can manage its by changing the value of the directive LF_EMAIL_ALERT in CSF configuration file.

# vim /etc/csf/csf.conf

LF_EMAIL_ALERT = 1

Enable/Disable Port Scanning Email Alert

Similarly use the directive PS_EMAIL_ALERT to manage Port scanning email alerts.

# vim /etc/csf/csf.conf

PS_EMAIL_ALERT = 1

1 – To enable
0 – To disable

After change in configuration file restart the CSF.

# csf -r

Login Failures and Port Scanning notices – Email alert setup for CSF

Some sample email templates are:

/usr/local/csf/tpl/alert.txt
/usr/local/csf/tpl/reselleralert.txt
/usr/local/csf/tpl/logalert.txt
/usr/local/csf/tpl/logfloodalert.txt
/usr/local/csf/tpl/syslogalert.txt
/usr/local/csf/tpl/integrityalert.txt
/usr/local/csf/tpl/exploitalert.txt
/usr/local/csf/tpl/queuealert.txt
/usr/local/csf/tpl/tracking.txt
/usr/local/csf/tpl/connectiontracking.txt
/usr/local/csf/tpl/processtracking.txt
/usr/local/csf/tpl/accounttracking.txt
/usr/local/csf/tpl/usertracking.txt
/usr/local/csf/tpl/sshalert.txt
/usr/local/csf/tpl/webminalert.txt
/usr/local/csf/tpl/sualert.txt
/usr/local/csf/tpl/consolealert.txt
/usr/local/csf/tpl/uialert.txt
/usr/local/csf/tpl/cpanelalert.txt
/usr/local/csf/tpl/scriptalert.txt
/usr/local/csf/tpl/relayalert.txt
/usr/local/csf/tpl/filealert.txt
/usr/local/csf/tpl/watchalert.txt
/usr/local/csf/tpl/loadalert.txt
/usr/local/csf/tpl/resalert.txt
/usr/local/csf/tpl/portscan.txt
/usr/local/csf/tpl/uidscan.txt
/usr/local/csf/tpl/permblock.txt
/usr/local/csf/tpl/netblock.txt
/usr/local/csf/tpl/portknocking.txt
/usr/local/csf/tpl/forkbombalert.txt
/usr/local/csf/tpl/x-arf.txt

Enjoy it !!