CSF block force attacks on Exim

1. Backup /etc/csf/csf.conf 2. Make sure this exist in /etc/csf/csf.conf

LF_DAEMON = "1"

LF_CSF = "1"

SMTP_BLOCK = "1"

SMTPAUTH_LOG = "/var/log/exim/reject.log" SMTPRELAY_LOG = "/var/log/exim_mainlog" POP3D_LOG = "/var/log/maillog" IMAPD_LOG = "/var/log/maillog" SCRIPT_LOG = "/var/log/exim_mainlog"

If reject.log not exist replace with log file with "Incorrect authentication data" messages 3. Restart LFD

csf --lfd restart

4. Restart csf

csf -r

Output in /etc/csf/csf.deny

212.129.11.11 # lfd: (smtpauth) Failed SMTP AUTH login from 212.129.11.11<br />(FR/France/212-129-63-54.example.com): 5 in the last 3600 secs - Mon Jun 26 08:10:47 2017