BFD - some advice please

[trout21]

I installed bfd lately as I am having more than my fair share of hacker attempts -

Aug 25 10:42:18 ***** sshd[23203]: Illegal user test from ::ffff:209.235.23.215
Aug 25 10:42:21 ***** sshd[23203]: Failed password for illegal user test from
::ffff:209.235.23.215 port 4815 ssh2


etc, etc.

However, when bfd is to put the ip into the apf deny_hosts it enters ffff - ? Should this not be the IP?

Also is there a way to lower the attempts to say 3 wrong attempts and then it puts the IP in ? as I notice several times that the same IP can hack away for 10-12 attempts and still not get entered.

Thanks for any advice.

trout

[picoyak]

Take a look at this thread at rfxnetworks forums.

seems like a similar issue.

[trout21]

thanx.... giving that a whirl...

[SarcNBit]

Make sure you are using the latest version of APF and BFD (v0.9.4r5 and v0.4r2 respectively as of this writing)