Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've installed and setup Ssshguard on a FreeBSD machine with PF. Everything seems to be working fine with Sshguard. I can see that it blocks IPs correctly and when I run pfctl -t sshguard -vTshow I can see that the blocked IPs is added to my PF table.

My question is regarding to the cleanup and unblocking of these addresses. Will Ssshguard remove old entries from this table or do I have to do the cleanup manually?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You'll have to cleanup manually, since the normal behavior of sshguard is to double the time of each failed connection try.

You can make even more secure reducing the number of tries to perm block(http://www.sshguard.net/docs/man/sshguard/) or whitelisting some lan ip's, but not automatically cleaning things.

Maybe if you create a script to clean old things?

share|improve this answer
1  
Thanks, I just created a crontab with /sbin/pfctl -q -t sshguard -T expire 86400 to clean all blocks older than 24h. –  Daniel Johansson Mar 25 '13 at 7:40
    
That will make the magic :) –  nwildner Mar 25 '13 at 13:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.