Re: [SSHGuard-users] Thank you for the help. Blacklist permanent; Can it be commented out?

[Christos C. <ch...@cr...>]

> On 17 Mar 2021, at 05:49, 8187--- via sshguard-users <ssh...@li...> wrote:
> 
> -Can the blacklist db be "commented out" to release ip's?  It's ordered by unix time on Debian 9, earliest on top, latest on bottom.   If so I might try a script that checks blacklist once a month, and either removes or comments out entries over 30 days old.

The database has this format:

1615489161|100|4|123.123.123.123

The first "column" is the unix timestamp so you can write a script to check if the entries are older than 30 days and remove them (for example using sed). Then you have to restart sshguard or you can also remove these IPs directly from your firewall to avoid a sshguard restart.