How to determine if CSF/LFD is disabling a user's data.

Introduction

You may find that a user's directory is being disabled automatically. In this case, the directory is set to 000 permissions with the +i (immutable) attribute:

[root@server ~]# ls -ald wp-admin
d--------- 2 root root 6 Mar 1 23:24 wp-admin

[root@server ~]# lsattr | grep wp-admin
----i----------------- ./wp-admin

The LFD log file at /var/log/lfd.log will retain logs with information like this:

Sep 14 12:00:32 hostname lfd[28624]: '/home/username/public_html/wp-admin' has been disabled

Procedure

You can review the LFD logs in detail to determine why the directory is being disabled. You can check for this by searching the keyword "disabled" from the LFD log:

 grep disabled -i /var/log/lfd.log

If LFD is disabling the directory, it is recommended to review the lfd.log further to determine why and address the issue. If the core issue is not resolved, LFD may disable it again. Once the core issue has been addressed, you can remove the immutable attribute and reset the permissions manually:

How to make a file or directory no longer immutable (+i)

How do I change permissions on a file or folder?

Please keep in mind that Login Failure Deamon (LFD) by ConfigServer Firewall is third-party software that is not provided by cPanel. For direct support with CSF, you can review their support resources here:

ConfigServer Forums

ConfigServer Technical Support