Re: [gentoo-user] Re: Why isn't sshd blocking repeated failed login attempts?

[Paul Hartman <paul.hartman+gentoo@gmail.com>]

On Thu, Jan 22, 2009 at 10:06 AM, Nikos Chantziaras <realnc@arcor.de> wrote:
> Paul Hartman wrote:
>>
>> On Wed, Jan 21, 2009 at 11:53 AM, Nikos Chantziaras <realnc@arcor.de>
>> wrote:
>>>
>>> Can you check the logs to see the timespan in which those hundreds of
>>> attempts took place?  Also, what's the time interval Denyhosts checks for
>>> login attempts?
>>
>> The most recently denied host from this afternoon made over 200 login
>> attempts in a span of 17 minutes before denyhosts caught it. In my
>> denyhosts.conf I have these:
>>
>> DENY_THRESHOLD_INVALID = 3
>> DENY_THRESHOLD_VALID = 3
>> DENY_THRESHOLD_ROOT = 1
>> DENY_THRESHOLD_RESTRICTED = 1
>
> What is the value of DAEMON_SLEEP?

#######################################################################
#
# DAEMON_SLEEP: when DenyHosts is run in daemon mode (--daemon flag)
# this is the amount of time DenyHosts will sleep between polling
# the SECURE_LOG.  See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to:    http://denyhosts.sourceforge.net/faq.html#timespec
#
#
DAEMON_SLEEP = 30s