Background
ConfigServer Firewall on WHM is incredibly noisy. To the point that you have to set up so many email rules just to be on top of the situation it’s almost better just to turn off some of these notifications. Especially if you’re never going to get around to looking at them.
To configure “blocked” and “blocked permanently” follow the advice below:
Firewall settings
Settings
pt_usertime
Example
Account: mongod
Resource: Process Time
Exceeded: 962038 > 1800 (seconds)
Make it 0
pt_limit
Suspicious process
Make it 0
Blocked
Here you will see the following parameters:
- LF_EMAIL_ALERT – sends an email alert if an IP address is blocked by one of the triggers.
- LF_PERMBLOCK_ALERT – sends an email alert if an IP address is permanently blocked. This happens if the IP address has been temporarily blocked more than a few times (to configure, use LF_PERMBLOCK_COUNT).
Reference
https://www.namecheap.com/support/knowledgebase/article.aspx/10093/30/csflfd-security-notifications/