CSF block force attacks on Exim

1. Backup /etc/csf/csf.conf

2. Make sure this exist in /etc/csf/csf.conf

LF_DAEMON = "1"

LF_CSF = "1"

SMTP_BLOCK = "1"

SMTPAUTH_LOG = "/var/log/exim/reject.log"
SMTPRELAY_LOG = "/var/log/exim_mainlog"
POP3D_LOG = "/var/log/maillog"
IMAPD_LOG = "/var/log/maillog"
SCRIPT_LOG = "/var/log/exim_mainlog"

If reject.log not exist replace with log file with "Incorrect authentication data" messages

3. Restart LFD

csf --lfd restart

4. Restart csf

csf -r


Output in /etc/csf/csf.deny

212.129.11.11 # lfd: (smtpauth) Failed SMTP AUTH login from 212.129.11.11<br />(FR/France/212-129-63-54.example.com): 5 in the last 3600 secs - Mon Jun 26 08:10:47 2017