How to Disable CSF Blocked IP Email Alerts and Reduce Notification Noise

On busy production web servers running ConfigServer Security & Firewall (CSF) with Login Failure Daemon (LFD), automated brute-force attempts can trigger dozens of automated alert emails per hour. Even after disabling LF_PERMBLOCK_ALERT and LF_NETBLOCK_ALERT in /etc/csf/csf.conf, CSF often continues sending notification messages.

The Culprit: LF_EMAIL_ALERT acts as a global master override that dispatches email notifications regardless of individual sub-alert flags.

Configuration Solution

Open /etc/csf/csf.conf and ensure all three alert directives are disabled:

# Disable automated IP block email notifications
LF_PERMBLOCK_ALERT = "0"
LF_NETBLOCK_ALERT = "0"
LF_EMAIL_ALERT = "0"

Reload CSF and LFD for the settings to take effect:

csf -r
service lfd restart

How to Transparently Route All Traffic Through a SOCKS/SSH Proxy on Linux and macOS (sshuttle)

Standard application-level SOCKS or HTTP proxy settings in Linux desktop environments (GNOME/KDE) frequently fail for stubborn proprietary applications (such as TeamViewer, VoIP tools, or CLI utilities) that ignore desktop proxy environment variables. sshuttle acts as a transparent, poor-man's VPN over standard SSH, routing all TCP traffic (and optionally DNS queries) without requiring root administrator privileges or TUN/TAP kernel modules on the remote host.

Advantages: No remote root required • Auto-routes TCP connections • Completely transparent to all running applications

1. Installation

# On Ubuntu / Debian:
sudo apt-get install sshuttle -y

# On macOS (Homebrew):
brew install sshuttle

# Or via Python pip:
sudo pip install sshuttle

2. Routing Global Traffic

To forward all client internet traffic (excluding your local LAN subnets) through your remote SSH server:

# Transparently route all default IPv4 subnets and DNS:
sshuttle --dns -r username@remote-server-ip:22 0/0 -x 192.168.0.0/16 -x 10.0.0.0/8

Every running program on your workstation—including apps with broken native proxy settings—will instantly route traffic through the encrypted SSH tunnel.