[BlueOnyx:15922] Re: apf too picky

[Meaulnes Legler @ MailList]

On 08.09.14 22:53, Michael Aronoff wrote : schrieb : a écrit : ha scritto : escribó :
> Look at /usr/local/bfd/rules/sshd
> My Trigger was already set at 5. (TRIG)
> See what your is and edit.
> M Aronoff Out

yes I have the same setting; nothing to be changed here ...

On 08.09.14 23:46, Ken Marcus wrote : schrieb : a écrit : ha scritto : escribó :
> On my systems, the BFD brute force detection will block you.
> It adds the lines to your APF deny file.
> cat  /etc/apf/deny_hosts.rules  might show something like
> # added 94.102.52.186 on 09/08/14 14:09:01 with comment: {bfd.sendmail}
> 94.102.52.186
> ...
> Ken

but this helped me to figure out where to dig: dFixblock2

cat  /etc/apf/deny_hosts.rules:
# added 85.153.41.34 on 09/07/14 03:57:27 with comment: dFixblock2
85.153.41.34

So it's not sendmail, but DFix2, the firewall from Compass / Solarspeed. There was a post two months ago, but it proposed the same as Michael Aronoff suggested: to add the IP at /etc/hosts.allow (which doesn't make much sense if one has dynamic IPs). I looked at the script /usr/bin/dfix2.sh without seeing the possibility to edit the false logins trigger (from my humble understanding).

How can I increase the number of allowed false logins? I think mine is set at solely one.

Thank you and best regards

Meaulnes Legler
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
~ http://www.WaveWeb.ch ~
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
~  Zurich, Switzerland  ~
~  +41\0 44 260 16 60   ~
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~