0

I've installed and setup Ssshguard on a FreeBSD machine with PF. Everything seems to be working fine with Sshguard. I can see that it blocks IPs correctly and when I run pfctl -t sshguard -vTshow I can see that the blocked IPs is added to my PF table.

My question is regarding to the cleanup and unblocking of these addresses. Will Ssshguard remove old entries from this table or do I have to do the cleanup manually?

Improve this question

1 Answer 1

Reset to default
1

You'll have to cleanup manually, since the normal behavior of sshguard is to double the time of each failed connection try.

You can make even more secure reducing the number of tries to perm block(http://www.sshguard.net/docs/man/sshguard/) or whitelisting some lan ip's, but not automatically cleaning things.

Maybe if you create a script to clean old things?

Improve this answer
2
  • 1
    Thanks, I just created a crontab with /sbin/pfctl -q -t sshguard -T expire 86400 to clean all blocks older than 24h.
    – Daniel Johansson
    Commented Mar 25, 2013 at 7:40
  • That will make the magic :)
    – user122772
    Commented Mar 25, 2013 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .