Script Email Alerts

Home · Start Here · Reference Map

At a glance

• How LFD detects script-driven mail abuse.
• Required Exim logging options for script attribution.
• How to auto-disable abusive paths safely.
• cPanel/WHM servers only (depends on Exim logging via log_selector).

Related guide: Security-Features-Guide

Quick reference

Setting	Purpose
LF_SCRIPT_LIMIT	Threshold — number of cwd= lines from the same path within one hour before an alert fires
LF_SCRIPT_ALERT	When enabled, LFD auto-disables the offending path (chattr +i + chmod 000)

File	Purpose
/usr/local/csf/tpl/scriptalert.txt	Email template for script alerts
/etc/csf/csf.signore	Paths to ignore (false-positive suppression)

How it works

cPanel installations only.

LFD scans for emails being sent through Exim from scripts on the server.

When more than LF_SCRIPT_LIMIT log lines appear with the same cwd= path within an hour, an alert is sent. This is useful for identifying spamming scripts — especially PHP scripts running under the nobody account. The alert includes the Exim log lines and an attempt to find scripts that send email in the flagged path.

Prerequisites

You must add extended email logging in WHM > Exim Configuration Manager > Advanced Editor. Search for log_selector and ensure the following are included:

log_selector = +arguments +subject +received_recipients

Without this setting, LFD cannot attribute mail sends to script paths.

Key settings

Auto-disable behavior (LF_SCRIPT_ALERT)

When enabled, LFD disables the offending path using:

chattr +i /path/to/offending/dir
chmod 000 /path/to/offending/dir

The alert email includes the commands needed to re-enable the path if it was a false positive.

Ignoring false positives

Add false-positive paths to /etc/csf/csf.signore — LFD will skip those listed scripts on subsequent scans.

Safe workflow

1. Confirm Exim log_selector includes required options.
2. Set LF_SCRIPT_LIMIT to a reasonable threshold (too low = false positives on legitimate bulk senders).
3. Initially keep LF_SCRIPT_ALERT disabled — review alerts manually first.
4. Reload CSF: csf -ra
5. Monitor /var/log/lfd.log for script alert events.
6. Once confident in threshold accuracy, optionally enable LF_SCRIPT_ALERT for auto-disable.

Common pitfalls

• Missing log_selector options — the feature silently does nothing without extended Exim logging.
• LF_SCRIPT_ALERT locks paths aggressively — chattr +i prevents the user from fixing the issue; the admin must intervene.
• Legitimate bulk-mail scripts — mailing lists or cron-driven newsletters can trip the threshold; add known paths to csf.signore proactively.
• WHM Exim config resets — Exim Configuration Manager changes or cPanel updates can reset log_selector; verify after updates.

See also: Process Tracking

Last reviewed: 2026-02-27

---

← Previous: Login Tracking · Next: Process Tracking