{"id":6,"date":"2008-04-12T16:01:51","date_gmt":"2008-04-12T14:01:51","guid":{"rendered":"http:\/\/danger.rulez.sk\/?page_id=6"},"modified":"2009-11-27T13:53:52","modified_gmt":"2009-11-27T11:53:52","slug":"faq","status":"publish","type":"page","link":"https:\/\/danger.rulez.sk\/index.php\/bruteforceblocker\/faq\/","title":{"rendered":"FAQ"},"content":{"rendered":"

Q: Which kinds\/versions of SSH daemons are supported?<\/strong>
\nA: It doesn’t matter which kind or version of SSH daemon you are using. The only thing you have to care of, is that you have to log SSHd traffic via syslog and your syslog is capable to use pipes (i.e. it can redirect the output to some script). Another thing is the format of your logs, if you aren’t using latest version of OpenSSH you will probably need to change regexps used in script.<\/p>\n

Q: BruteForceBlocker is running, but IPs aren’t being blocked.<\/strong>
\nA: This is probably because of incorrect formats of regexps used in script. I have reports from users that OpenSSH v3.8 (which is default in FreeBSD 5.4) and less, uses little bit different format of warnings. You should check your logs for the format and according to that format change the Regexps. By this way, you can also use this script not only with OpenSSH, but it’s possible to use it for example with SSH Secure Shell; it’s only up to you what you consider to be harmful message.<\/p>\n

Q: How does the timeout work?<\/strong>
\nA: There are two types of timeout to consider. One thing is how long does the bruteforceblocker keep the internal count of failed login attempts in its memory. This affects the timeout setting in the bruteforceblocker.conf configuration file. This setting should be set to the amount of seconfs, after which you want to reset this count internally.
\nHowever, when the IP gets blocked by pf, this is beyond the bruteforceblocker. Here comes the second timeout type. To be able to remove an old entries from the pf table, you will need an external utility. I recommend using security\/expiretable in conjuction with a proper entry in the crontab. In this case, set up the following:<\/p>\n

First, let the blocked IP be stored in memory only, by the following setting in \/etc\/pf.conf:
\ntable <bruteforce> persist<\/code><\/p>\n

Next, set up a cronjob entry, which will handle the removal of old IPs from the pf table in \/etc\/crontable file:
\n0 4 * * * root \/usr\/local\/sbin\/expiretable -t 1d bruteforce<\/code><\/p>\n

Q: Is it possible to use BruteForceBlocker with Linux and IPTABLES?<\/strong>
\nA: This is pretty easy task. All you need is to change value of $pfctl variable to contain the path to the IPTABLES binary. Then you need change line:
\nsystem(“$pfctl -t $table -T add $IP\/32”) == 0 or die “Couldn’t add $IP to firewall”;
\nto something like:
\nsystem(“$iptables -I INPUT -s $IP -j DROP”) == 0 or die “Couldn’t add $IP to firewall”;
\nYou should also remove some unneeded variables like $table and $tablefile or, you should use them to store rules in the iptables script to keep your firewall rules.<\/p>\n

Q: I don’t have sshd logs after upgrade from 1.1<\/strong>
\nA: This is because BruteForceblocker 1.2 and later doesn’t log anymore. This way of logging was obsoleted because people weren’t able to log to remote syslog through BruteForceBlocker. If you don’t have line similar to this:<\/p>\n

auth.info;authpriv.info \/var\/log\/auth.log<\/p><\/blockquote>\n

in syslog.conf, then you should add it there, otherwise you won’t get auth.* messages logged.<\/p>\n","protected":false},"excerpt":{"rendered":"

Q: Which kinds\/versions of SSH daemons are supported? A: It doesn’t matter which kind or version of SSH daemon you are using. The only thing you have to care of, is that you have to log SSHd traffic via syslog and your syslog is capable to use pipes (i.e. it can redirect the output to […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":5,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-6","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/pages\/6","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/comments?post=6"}],"version-history":[{"count":2,"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/pages\/6\/revisions"}],"predecessor-version":[{"id":99,"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/pages\/6\/revisions\/99"}],"up":[{"embeddable":true,"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/pages\/5"}],"wp:attachment":[{"href":"https:\/\/danger.rulez.sk\/index.php\/wp-json\/wp\/v2\/media?parent=6"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}