Login Tracking

Home · Start Here · Reference Map

At a glance

• How POP3/IMAP login tracking thresholds work.
• How temporary login blocks are applied and cleared.
• SSH login tracking prerequisites to avoid false results.

Related guide: Security-Features-Guide

What login tracking does

Login tracking is an extension of LFD. It keeps track of POP3 and IMAP logins and limits them to X connections per hour per account per IP address. It uses iptables to block offenders to the appropriate protocol port only and flushes them every hour, starting the login count afresh.

All of these blocks are temporary and can be cleared manually by restarting CSF.

Key settings

Setting	Purpose
LT_POP3D	POP3 login limit per hour per account per IP
LT_IMAPD	IMAP login limit per hour per account per IP
LT_EMAIL_ALERT	Enable/disable email alerts on tracking blocks

IMAP tracking caution

It is generally not a good idea to set aggressive IMAP login tracking limits. Many clients login each time to perform a protocol transaction (there is no need for them to repeatedly login, but you cannot avoid bad client programming).

If you do have a need for IMAP tracking, set the limit quite high to avoid false positives.

Custom login failure tracking

You can add your own login failure tracking using regular expression matching. See Regex Custom Cookbook for a production-safe pattern and rollout workflow.

SSH login tracking prerequisite

To enable successful SSHD login tracking, ensure that UseDNS in /etc/ssh/sshd_config is disabled:

UseDNS no

Then restart sshd:

systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null || service sshd restart || service ssh restart

Without this, reverse-DNS lookups can cause tracking mismatches and false results.

Common pitfalls

• Aggressive IMAP limits causing false positives from chatty mail clients.
• Forgetting UseDNS no for SSH tracking accuracy.
• Not checking /var/log/lfd.log after adjusting thresholds.

See also: Exim SMTP AUTH Restriction

Last reviewed: 2026-02-25

---

← Previous: lfd Command Line Options · Next: Script Email Alerts