sshguard-users

[Sshguard-users] New install

[LuKreme <kr...@kr...>]

I have sshguard installed and running, but I still have a few questions.

When does it block an IP? How many failed attempts does it take, and is that configurable,. Do IPs ever expire from the block list?

Do I need to be concerned about the following?

No ALTQ support in kernel
ALTQ related functions disabled


(OS X 10.10, macports install of sshguard 1.5)

-- 
The real world was far too real to leave neat little hints. It was full
of too many things. It wasn't by eliminating the impossible that you got
at the truth, however improbable; it was by the much harder process of
eliminating the possibilities. --Feet of Clay

[Sshguard-users] New install

[LuKreme <kr...@kr...>]

I have sshguard installed and running, but I still have a few questions.

When does it block an IP? How many failed attempts does it take, and is that configurable,. Do IPs ever expire from the block list?

Do I need to be concerned about the following?

No ALTQ support in kernel
ALTQ related functions disabled


(OS X 10.10, macports install of sshguard 1.5)

-- 
The real world was far too real to leave neat little hints. It was full
of too many things. It wasn't by eliminating the impossible that you got
at the truth, however improbable; it was by the much harder process of
eliminating the possibilities. --Feet of Clay

Re: [Sshguard-users] New install

[Kevin Z. <kev...@gm...>]

On 12/14/2014 21:50, LuKreme wrote:
> When does it block an IP? How many failed attempts does it take, and
> is that configurable,. Do IPs ever expire from the block list?

Using the default settings, it takes 4 failed attempts. Each failed
attempt adds 10 "points", and after 40 "points" the offending IP is
blocked. You can configure this threshold.

> Do I need to be concerned about the following?
> 
> No ALTQ support in kernel ALTQ related functions disabled

No, this is a message indicating that ATLQ was not compiled into your
firewall. ALTQ is pf's traffic shaping module.

Best,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

Re: [Sshguard-users] New install

[LuKreme <kr...@kr...>]

> On Dec 14, 2014, at 20:55, Kevin Zheng <kev...@gm...> wrote:
> 
> Using the default settings, it takes 4 failed attempts. Each failed
> attempt adds 10 "points", and after 40 "points" the offending IP is
> blocked. You can configure this threshold.

Thanks. I haven't found instructions on how to configure that stuff yet (there's nothing in the default pf.log for example), but at least I know the defaults are sensible.

-- 

Re: [Sshguard-users] New install

[Kevin Z. <kev...@gm...>]

On 12/15/2014 00:39, LuKreme wrote:
>> Using the default settings, it takes 4 failed attempts. Each
>> failed attempt adds 10 "points", and after 40 "points" the
>> offending IP is blocked. You can configure this threshold.
> 
> Thanks. I haven't found instructions on how to configure that stuff
> yet (there's nothing in the default pf.log for example), but at least
> I know the defaults are sensible.

You can configure SSHGuard by passing it options from the command line;
type `sshguard -h` for a list of options.

Depending on your operating system and how you run SSHGuard, you will
need to pass these command line options differently.

Blocked addresses are released after a certain amount of time, unless
you have blacklisting enabled.

Best,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090