<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi Will.<br><div><br><div><div>On 22 Apr 2014, at 3:01 am, Will Nordmeyer, WnA Consulting Services <<a href="mailto:will@wnahosting.com">will@wnahosting.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div class="rcmBody"><p>On my server, it seems that one mistake entering the admin password (and maybe site admin passwords) blocks the offending IP. Since I have a rather complex admin password, I'd like to tweak dfix/dfix2 to give me a slightly wider allowance.</p><p>I've reviewed dfix2.sh but that just has a start/stop process - the start process makes sure the iptables lists exist, and sets up a list of trusted IPs from the ifconfig & resolv.conf file.</p><p>dfix.sh appears to do all the work but I haven't managed to track exactly where the limit for bad password is set.</p><p>I'd also like to improve the logging so that when it blocks an IP, it gives the reason behind it.</p>
</div></blockquote></div><br></div><div>Initially, have a look at /var/log/sec to see details of a reason for block. There are rule names like <span style="font-family: Menlo; font-size: 11px;">ssh-b1... Let me know which one is hitting your log file in this situation, and I can tell you how to tweak.</span></div><div><span style="font-family: Menlo; font-size: 11px;"><br></span></div><div><span style="font-family: Menlo; font-size: 11px;">Note: I am away travelling, but I'll get you a response asap.</span></div><div><span style="font-family: Menlo; font-size: 11px;"><br></span></div><div><span style="font-family: Menlo; font-size: 11px;">Greg.</span></div></body></html>