Re: [Sshguard-users] sshguard not blocking proftpd & dovecot bruteforces

[Mij <mi...@bi...>]

On Jul 31, 2009, at 02:57 , Tobias Lott wrote:

> Dovecot looks fine:
> Jul 31 02:45:28 hostname dovecot: imap-login: Aborted login (auth
> failed, 1 attempts): user=<lala@lala>, method=PLAIN, rip=CC.CC.CC.CC,
> lip=SS.SS.SS.SS
> Jul 31 02:45:28 hostname sshguard[71965]: Blocking CC.CC.CC.CC:4 for
>> 300secs: 1 failures over 0 seconds.
>
> # pfctl -t sshguard -T show
>  CC.CC.CC.CC
>
>
> Proftpd doesn't look that fine:
> Jul 31 02:47:49 hostname proftpd[72114]: hostname
> (clienthostname[::ffff:CC.CC.CC.CC]) - USER mysql (Login
> failed): Limit access denies login
> Jul 31 02:47:49 hostname sshguard[71965]:
> Blocking ::ffff:CC.CC.CC.CC:6 for >300secs: 1 failures over 0
> seconds.
> Jul 31 02:47:49 hostname proftpd[72114]: hostname
> (clienthostname[::ffff:CC.CC.CC.CC]) - FTP session closed.
> Jul 31 02:48:05 hostname proftpd[72148]: hostname
> (clienthostname[::ffff:CC.CC.CC.CC]) - FTP session opened.
> Jul 31 02:48:05 hostname proftpd[72148]: hostname
> (clienthostname[::ffff:CC.CC.CC.CC]) - USER mysql (Login
> failed): Limit access denies login
> Jul 31 02:48:05 hostname sshguard[71965]:
> Blocking ::ffff:CC.CC.CC.CC:6 for >600secs: 1 failures over 0
> seconds.
> Jul 31 02:48:05 hostname sshguard[71965]: Offender
> '::ffff:CC.CC.CC.CC:6' seen 2 times.
>
> # pfctl -t sshguard -T show
>  ::ffff:CC.CC.CC.CC

looks good, what's wrong?