What is lfd?
CSF (ConfigServer Security and Firewall) is a firewall tool. A firewall is a gate that blocks bad traffic. lfd (Login Failure Daemon) is its helper. It reads your server logs and blocks anyone who fails to log in too many times. A daemon is a program that runs quietly in the background.
CSF is a third-party tool. Ask Hostvento support if it is part of your plan.
Steps
- Log in to your server over SSH as root.
- Try to start lfd and read the answer.
systemctl restart lfd
systemctl status lfdThe first line tries to start it. The second shows if it works and prints the last error.
- Read the lfd log for a clear reason.
tail -n 50 /var/log/lfd.logThis shows the last fifty lines of the log.
Common causes and fixes
Testing mode is on
While CSF is in testing mode, lfd will not run. Open /etc/csf/csf.conf. Back it up first. Find the line TESTING = "1". Change it to TESTING = "0". Save the file. Then run csf -r to reload the rules.
A stale lock file
A leftover process file may block the start. Check that lfd is really not running with ps aux | grep lfd. If not, remove the old file and start again.
rm -f /var/run/lfd.pid
systemctl start lfdMissing Perl parts
lfd is written in Perl, a scripting language. It needs some Perl modules. Run the CSF test script.
perl /usr/local/csf/bin/csftest.plThis checks whether your server has what CSF needs. It tells you if anything is missing. Install what it lists with your package tool.
Wrong settings in csf.conf
A typo in the settings can stop it. Check the lfd log for the line that complains. Restore your backup copy if you are unsure.
Not enough memory
On a small server, a full memory can kill the program. Check with free -m.
/etc/csf/csf.conf first so you keep your settings.Quick recap
- lfd blocks hackers by watching login failures.
- Read the output of systemctl status lfd and /var/log/lfd.log.
- Turn TESTING to 0, remove a stale pid file, or fix Perl modules.
- Ask Hostvento support if it still fails.