Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : How to block (IP) failed logins

[LP560]

I have a personal dedicated server for family sites, but there seems to be someone or something trying to ssh into the server.
I have BFD installed and that has blocked the IP(s) after a number of attempts.
How can I change when it blocks the IP, say after 3 attempts or a certain number of attempts within a time limit, is this possible with BFD?

[david510]

You can set the trigger number at /usr/local/bfd/rules/sshd

[LP560]

Thanks set it to 2, but I tried logging in with an incorrect password but it didn't ban the IP for about 10 minutes.
So I take it its on a cron, can this be changed?

[IntraHost-Greg]

Yes, it can be changed. Check out /etc/cron.d/bfd