--- title: 'Tracking Settings' url: 'https://docs.danami.com/juggernaut/settings/login-failure-daemon/tracking-settings' markdown: 'https://docs.danami.com/juggernaut/settings/login-failure-daemon/tracking-settings.md' date: '2026-09-22' description: 'Distributed Attack Tracking Distributed attack tracking - LF_DISTATTACK Enable the tracking of login failures from distributed IP addresses to a specific application account. If the number of failures matches the application trigger then all of the IP addresses involved in the attack will be blocke…' taxonomy: category: - docs tag: - tracking --- [](#) [ Basics ](https://docs.danami.com/juggernaut/) [ Settings Reference ](https://docs.danami.com/juggernaut/settings) [ Login Failure Daemon ](https://docs.danami.com/juggernaut/settings/login-failure-daemon) Tracking Settings # Tracking Settings ## Distributed Attack Tracking **Distributed attack tracking** - `LF_DISTATTACK` Enable the tracking of login failures from distributed IP addresses to a specific application account. If the number of failures matches the application trigger then all of the IP addresses involved in the attack will be blocked. Tracking applies to LF\_SSHD, LF\_FTPD, LF\_SMTPAUTH, LF\_POP3D, LF\_IMAPD, LF\_HTACCESS. Default: 0 Range: 0-1 **Distributed attack trigger** - `LF_DISTATTACK_UNIQ` The minimum number of unique IP addresses that trigger LF\_DISTATTACK. Default: 2 Range: 2-20 **Distributed tracking interval** - `LF_DIST_INTERVAL` The interval in seconds during which a distributed FTP is measured. Default: 300 Range: 60-86400 **Distributed tracking event script** - `LF_DIST_ACTION` The path to a script that will run when a distributed FTP login event is triggered. Default: empty ##### Distributed FTP Tracking **Distributed FTP limit** - `LF_DISTFTP` Keep track of successful FTP logins. If the number of successful logins to an individual account is at least LF\_DISTFTP in LF\_INTERVAL from at least LF\_DISTFTP\_UNIQ IP addresses then all of the IP addresses will be blocked. To disable this option set to 0. Default: 0 Range: 0-20 **Distributed FTP trigger** - `LF_DISTFTP_UNIQ` The minimum number of unique IP addresses that trigger LF\_DISTFTP. LF\_DISTFTP\_UNIQ must be less than or equal to LF\_DISTFTP for this to function properly. Default: 3 Range: 2-20 **Distributed FTP block time** - `LF_DISTFTP_PERM` Enable permanent or temporary blocking (1 = Permanent or any value greater than 1 equal to the number of seconds to temporarily block for). Default: 1 Range: 0-604800 ##### Distributed SMTP Tracking **Distributed SMTP limit** - `LF_DISTSMTP` Keep track of successful SMTP logins (Postfix only). If the number of successful logins to an individual account is at least LF\_DISTSMTP in LF\_DIST\_INTERVAL from at least LF\_DISTSMTP\_UNIQ IP addresses, then all of the IP addresses will be blocked. To disable this option set to 0. This option can help mitigate the common SMTP account compromise attacks that use a distributed network of zombies to send spam. A sensible setting for this might be 5, depending on how many different IP addresses you expect to an individual SMTP account within LF\_DIST\_INTERVAL. Default: 0 Range: 0-20 **Distributed SMTP trigger** - `LF_DISTSMTP_UNIQ` The minimum number of unique IP addresses that trigger LF\_DISTSMTP. LF\_DISTSMTP\_UNIQ must be less than or equal to LF\_DISTSMTP for this to function properly. Default: 3 Range: 2-20 **Distributed SMTP block time** - `LF_DISTSMTP_PERM` Enable permanent or temporary blocking (1 = Permanent or any value greater than 1 equal to the number of seconds to temporarily block for). Default: 1 Range: 0-604800 ## Login Tracking **Login tracking POP3 limit** - `LT_POP3D` Block POP3 logins if greater than LT\_POP3D times per hour per account per IP address. This is a temporary block for the rest of the hour, then the IP address is unblocked. To disable this option set to 0. Default: 0 Range: 0-180 **Login tracking IMAP limit** - `LT_IMAPD` Block IMAP logins if greater than LT\_IMAPD times per hour per account per IP address. This is a temporary block for the rest of the hour, then the IP address is unblocked. To disable this option set to 0. Default: 0 Range: 0-180 **Skip permanent blocking for login tracking** - `LT_SKIPPERMBLOCK` Do not Permanently block IP addresses blocked via LT\_POP3D or LT\_IMAPD tracking. Default: 0 Range: 0-1 ## Connection Tracking **Connection tracking limit** - `CT_LIMIT` Enable the tracking of all connections from IP addresses to the server. If the total number of connections is greater than this option then the offending IP address is blocked. This can help stop some types of DOS attack. To disable this option set to 0. Warning: Do not set this number too low. A recommended setting would be around 500. Default: 0 Range: 0|10-1000 **Connection tracking subnet limit** - `CT_SUBNET_LIMIT` If the total number of connections from a class C subnet is greater than this value then the offending subnet is blocked according to the other CT\_\* settings. This option can be used to help prevent some types of DOS attack where a range of IPs between x.y.z.1-255 has connected to the server. If you use a reverse proxy service such as Cloudflare you should not enable this option, or should exclude the ports that you have proxied in CT\_PORTS To disable this feature, set this to 0. Warning: Do not set this number too low. Default: 0 **Connection tracking interval** - `CT_INTERVAL` The number of seconds between connection tracking scans. Default: 30 Range: 10-3600 **Connection tracking permanent blocking** - `CT_PERMANENT` Enable permanent blocking for an IP address when blocked due to connection tracking. Default: 0 Range: 0-1 **Connection tracking block time** - `CT_BLOCK_TIME` The interval in seconds that the IP will remained blocked for. Default: 1800 Range: 300-86400 **Skip TIME\_WAIT state** - `CT_SKIP_TIME_WAIT` Do not count the TIME\_WAIT state against the connection count. Default: 0 Range: 0-1 **Connection tracking states** - `CT_STATES` Only count specific states (e.g. SYN\_RECV,TIME\_WAIT) for connection tracking. An empty value will count all states against CT\_LIMIT. Default: empty **Connection tracking ports** - `CT_PORTS` Only count specific ports (e.g. 80,443) for connection tracking. An empty value will count all ports against CT\_LIMIT. Default: empty ## Process Tracking **Process tracking limit** - `PT_LIMIT` Enable the tracking of processes and examine them for suspicious executables or open network ports. If a suspicious process is found an alert email is sent. This option is the number of seconds a process has to be active before it is inspected. To disable this option set to 0. Default: 0 Range: 0-3600 **Process tracking interval** - `PT_INTERVAL` The interval in seconds for how frequently processes are checked. Default: 60 Range: 10-3600 **Skip tracking of HTTP scripts** - `PT_SKIP_HTTP` Do not enable process tracking to highlight php or perl scripts that are run. Default: 0 Range: 0-1 **Track all user accounts** - `PT_ALL_USERS` Enable the tracking of all linux accounts on the server. This is recommended to improve security from compromised accounts. Default: 0 Range: 0-1 **Skip deleted processes** - `PT_DELETED` Report deleted binary processes. Default: 0 Range: 0-1 **Deleted process event script** - `PT_DELETED_ACTION` The full path to a script that is run when a PT\_DELETED event is triggered. The action script must have the execute bit and its interpreter set. Default: empty **User process limit** - `PT_USERPROC` Track the number of processes any given account is running at one time. If the number of processes exceeds the value of the following setting an email alert is sent with details of those processes. To disable this option set to 0. Default: 10 Range: 0-100 **User process memory limit** - `PT_USERMEM` Send an alert if any user process exceeds the memory usage set (MB). To disable this option set to 0. Default: 512 Range: 0-1024 **User process RSS memory limit** - `PT_USERRSS` Send an alert if any user process exceeds the RSS memory usage set (MB) - RAM used, not virtual. To ignore specific processes or users use Process Tracking Ignore. Default: 256 Range: 0-1024 **User process time limit** - `PT_USERTIME` Sends an alert if any user process exceeds the time usage set (in seconds). To disable this option set to 0. Default: 1800 Range: 0-86400 **User process killing** - `PT_USERKILL` Enable the killing of processes detected by PT\_USERMEM, PT\_USERTIME or PT\_USERPROC. (not recommended) Default: 0 Range: 0-1 **User process event script** - `PT_USER_ACTION` The full path to a script that is run when a PT\_USERKILL event is triggered. The action script must have the execute bit and its interpreter set. Default: empty **Load level checking interval** - `PT_LOAD` Check the PT\_LOAD\_AVG minute Load Average on the server every PT\_LOAD seconds. If the load average is greater than or equal to PT\_LOAD\_LEVEL then an email alert is sent. The login falure deamon does not report high load events until PT\_LOAD\_SKIP seconds has passed to prevent email floods. To disable this option set to 0. Default: 30 Range: 0-3600 **Load level average** - `PT_LOAD_AVG` The process tracking load average. Default: 5 Range: 1|5|15 **Load level alert limit** - `PT_LOAD_LEVEL` The process tracking load level. Default: 6 Range: 2-20 **Skip load level alert interval** - `PT_LOAD_SKIP` The login failure daemon does not report subsequent high load events until PT\_LOAD\_SKIP seconds has passed to prevent email floods. Default: 3600 Range: 1800-86400 **Apache server status URL** - `PT_APACHESTATUS` The Apache Server Status URL used in the load average email alert. The Apache mod\_status module is required. Default: http://localhost:7080/server-status **Load level event script** - `PT_LOAD_ACTION` The full path to a script that is run when a PT\_LOAD event is triggered. The action script must have the execute bit and its interpreter set. Default: empty **Forkbomb limit** - `PT_FORKBOMB`Check the number of processes with the same session id and if greater than the value set, the whole session tree is terminated and an alert sent. Default: 0 Range: 0|100-1000 **Terminate blocked IP SSHD sessions** - `PT_SSHDKILL` Terminate hung SSHD sessions. When under an SSHD login attack, SSHD processes are often left hung after their connecting IP addresses have been blocked. This option will terminate the SSH processes created by the blocked IP. This option is preferred over PT\_SSHDHUNG. Default: 0 Range: 0-1 **Terminate hung SSHD sessions** - `PT_SSHDHUNG` Terminate hung SSHD sessions. When under an SSHD login attack, SSHD processes are often left hung after their connecting IP addresses have been blocked. This option will terminate all processes with the cmdline of "sshd: unknown \[net\]" or "sshd: unknown \[priv\]" if they have been running for more than 60 seconds. Note: It is possible that enabling this option may have adverse effects on valid SSHD processes. If this is the case, this option should be disabled. Default: 0 Range: 0-1 ## Port Scan Tracking **Port scan tracking interval** - `PS_INTERVAL` If an IP address generates a port block that is logged more than PS\_LIMIT within PS\_INTERVAL seconds, the IP address will be blocked. To disable this option set to 0. Default: 0 Range: 0|60-3600 **Port scan tracking limit** - `PS_LIMIT` If an IP address generates a port block that is logged more than PS\_LIMIT within PS\_INTERVAL seconds, the IP address will be blocked. Default: 10 Range: 2-20 **Port scan tracking ports** - `PS_PORTS` The ports / port ranges that should be tracked by the Port Scan Tracking feature. Default: 0:65535,ICMP **Port scan tracking diversity** - `PS_DIVERSITY` How many different ports qualifies as a port scan. Raising this value above 1 means that persistent attempts to attack a specific closed port will not be detected and blocked. Default: 1 Range: 1-100 **Port scan tracking permanent blocking** - `PS_PERMANENT` Make port scan tracking blocks Permanent. Default: 0 Range: 0-1 **Port scan tracking block time** - `PS_BLOCK_TIME` The port scan tracking temporary block time in seconds. Default: 3600 Range: 300-86400 ## User ID Tracking **User ID tracking interval** - `UID_INTERVAL` Enable user ID tracking. Track UID blocks logged by iptables to syslog. If a UID generates a port block that is logged more than UID\_LIMIT times within UID\_INTERVAL seconds, an alert will be sent. Default: 0 Range: 0|60-86400 **User ID tracking limit** - `UID_LIMIT` The number of times within UID\_INTERVAL before an alert will be sent. Default: 10 Range: 1-100 **User ID tracking port range** - `UID_PORTS` The port or port ranges that should be tracked by the User ID tracking feature. The default setting of 0:65535,ICMP covers all ports. Default: 0:65535,ICMP ## Account Tracking **Account tracking** - `AT_ALERT` Enable the tracking of modifications to the accounts on a server. If account tracking options are triggered then an alert email is sent. Default: 2 Range: 0-2 **Account tracking interval** - `AT_INTERVAL` The interval in seconds between account tracking checking. Default: 60 Range: 10-3600 ## Related Pages - [Process Tracking](https://docs.danami.com/juggernaut/user-guide/process-tracking "Process Tracking") - [Login Tracking](https://docs.danami.com/juggernaut/user-guide/login-tracking "Login Tracking") [ ](https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-tracking-userid) --- ## Navigation - Parent: [Login-failure-daemon](https://docs.danami.com/juggernaut/settings/login-failure-daemon.md) - Previous: [Directory Watching](https://docs.danami.com/juggernaut/settings/login-failure-daemon/directory-watching.md) - Next: [Messenger Service](https://docs.danami.com/juggernaut/settings/login-failure-daemon/messenger-service.md)