3 ms·
No, once an IP had failed authentication a configured number of times, the IP is blocked (for a configurable amount of time.)
by plz-remove-card 3y ago
No, once an IP had failed authentication a configured number of times, the IP is blocked (for a configurable amount of time.)
- sedatk 3y agoWhat does it mean for an IP to fail “authentication” in that context? As I understand, they only check for failed connection attempts, not failed authentications?
- plz-remove-card 3y agoThe first thing it was integrated into was sshd, there's a small patch in sshd that sends a notification to the blacklist daemon when a connection has failed authentication.
- sedatk 3y agoGot it, thanks. It was surprisingly hard to find details about it except for the man page.
- plz-remove-card 3y agoIf you're interested in an overview, I'd recommend this vid from the author: https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s
- sedatk 3y agoThanks for that too!