How to Disable CSF Blocked IP Email Alerts and Reduce Notification Noise

On busy production web servers running ConfigServer Security & Firewall (CSF) with Login Failure Daemon (LFD), automated brute-force attempts can trigger dozens of automated alert emails per hour. Even after disabling LF_PERMBLOCK_ALERT and LF_NETBLOCK_ALERT in /etc/csf/csf.conf, CSF often continues sending notification messages.

The Culprit: LF_EMAIL_ALERT acts as a global master override that dispatches email notifications regardless of individual sub-alert flags.

Configuration Solution

Open /etc/csf/csf.conf and ensure all three alert directives are disabled:

# Disable automated IP block email notifications
LF_PERMBLOCK_ALERT = "0"
LF_NETBLOCK_ALERT = "0"
LF_EMAIL_ALERT = "0"

Reload CSF and LFD for the settings to take effect:

csf -r
service lfd restart