CSF

CSF

In csf, when if someone proceed nmap port scan (nmap <ip>), csf blocking that server automatically .
its in /etc/csf/csf.deny , we can delete that auto added line or
(we can see in the var/log/messages )
if you need to ignore (like known host) /etc/csf/csf.igore
-----------------------------------
csf.log file defines places where put logs.

------------------------
how restart
csf -x
csf -e

--------------
ssh logs
var/log/secure
---------------
csf logs
var/logs/lfd
---------------