Re: [Sshguard-users] Blocks that never go away

[Richard J. <rjt...@sa...>]

On Fri, Feb 14, 2014 at 10:40:42AM -0500, Jeff Wieland wrote:
> Has any else seen this - sshguard will indicate that the blocking
> is ">0secs", and the block doesn't go away until sshguard is
> restarted?  The log line looks like:
> 
> Feb 14 01:22:40 mymachine.purdue.edu sshguard[8951]: [ID 702911 
> auth.notice] Blocking nnn.nnn.nnn.nnn:4 for >0secs: 60 danger in 2 
> attacks over 2 seconds (all: 120d in 2 abuses over 85461s).

This is the intended final behavior for abusers who keep coming back after
their previous entries expire.  Your logs will show earlier blocks of
increasing duration for the abusers.


Richard