Why am I receiving Permanent Block notifications when LFD blocks an IP address?

Please note that Way to the Web Ltd. (the company behind ConfigServer) has announced it will close permanently on August 31, 2025. However, their free scripts will remain available under the GPLv3 license. For more details, see:

ConfigServer Services Announcement

Question

Why am I receiving Permanent Block notifications when LFD blocks an IP address?

Example:

lfd on example.hostname.tld: blocked IPAddress (CountryCode/Country/-)

Answer

These notifications are generated by 3rd-party software, ConfigServer LFD (Login Failure Daemon). You can enable or disable this notification by modifying the LF_PERMBLOCK_ALERT setting in WHM at "Home  / ConfigServer Security & Firewall / Firewall Configuration".

Optionally, you can disable the notification via SSH as the root user by changing LF_PERMBLOCK_ALERT = "1" to LF_PERMBLOCK_ALERT = "0" in /etc/csf/csf.conf and then restart CSF:

systemctl restart csf.service

For support with LFD, you will need to contact ConfigServer directly:

ConfigServer Support