Re: [Sshguard-users] sshguard working but not blocking, functioning in debug mode

[Mij <mi...@bi...>]

On Jul 21, 2009, at 21:17 , Peter Beckman wrote:

> On Tue, 21 Jul 2009, Mij wrote:
>
>> Naturally the same machinery is used for blocking with or without - 
>> d, so
>> if in the latter case it works, is sshguard run as root from the  
>> syslog
>> instance?
>
> syslogd is running as root, and since I've tested it in the past and  
> it
> has worked, and I haven't updated anything, I was surprised to see the
> failure.

2 things:
1) you show that with -d the address is visible in the PF table after  
blocking.
What about the normal run?

2) sshguard always logs debug messages (filtering/dispatching left up to
syslogd). Have a look at your debug.log or all.log for debug messages.
There you find whether/why the actual blocking command fails.