Login Failure Daemon (lfd)
Login Failure Daemon (lfd) is a process that runs all the time and periodically (every X seconds) scans the latest log file entries for login attempts against your server that continually fail within a short period of time. Such attempts are often called “Brute-force attacks” and the daemon process responds very quickly to such patterns and blocks offending IP’s quickly. Other similar products run every x minutes via cron and as such often miss break-in attempts until after they’ve finished, our daemon eliminates such long waits and makes it much more effective at performing its task.
Login tracking is an extension of lfd, it keeps track of POP3 and IMAP logins and limits them to X connections per hour per account per IP address.
When lfd started the status shows as below.
Status of lfd:lfd is stopped
When monitoring log file /var/log/lfd.log you see that it reports an error.
lfd[964936]: *Error* unable to create lfd PID file [/var/run/lfd.pid] No such file or directory, at line 155
You see that the pid file exists but with incorrect permissions.
? 1 ? ? 5 Aug 30 05:41 lfd.pid
The permissions, ownership on file shows a question mark (?) is because the file system is corrupt and requires a FSCK (File System ChecK). You will have to reboot the server with command below which will perform a FSCK when it boots.
shutdown -rF now
r represents “reboot after shutdown” & F represents perform a FSCK when it boots. Once the server boots after performing FSCK, lfd starts & shows status running. The permissions & ownership shows correct as well.
