[SSHGuard-users] BLACKLIST_FILE

[Doug N. <dn...@uc...>]

Hi Folks,

Thanks for your help getting SSHGuard working for me last weekend in MacOS Sierra, it’s working well.

I do see the following in the .conf file, which I’ve uncommented:

# Colon-separated blacklist threshold and full path to blacklist file.
# (optional, no default)
BLACKLIST_FILE=90:/usr/local/etc/blacklist

However, on all of our machines, the blacklist remains empty and  untouched. Am I missing a step to make this work? These machines get hammered pretty hard, and even in my testing with SSH Brute Enforcer (https://github.com/R4stl1n/SSH-Brute-Forcer) I don’t see any changes to this file.

Also: if I manually add an IP or range to the blacklist, will this also be sent to PF somehow?

Yes, these are newbie questions but I appreciate your help!

Doug