Solved BFM not always blocks IPs

[Zhenyapan]

Hello,

Brute force monitor not always blocks IPs, How can I find out why? And how can I configure it to block IP after for example 20 failed attempts during 24h.
Thanks!

 

[zEitEr]

Hello,

Try this:

ip_brutecount=20
user_brutecount=20
clear_brute_log_time=24

More information: https://www.directadmin.com/features.php?id=1227

 

[Zhenyapan]

so it not only for notifications limit, but for blocking too?

 

[zEitEr]

set

bruteforce=1

IP blacklist file for excessive login attempts (SKINS)

www.directadmin.com

 

[Richard G]

Try this:

Can that be done? Because I read this:

ip_brutecount=100
or a user account received x number of attempts from any IP:
user_brutecount=100

So it's not or? It's in fact and/or?

 

[Zhenyapan]

it's about emailing, it sent email in both cases, if IP or if username with failed limits fixed in logs more than xxx times. you can change them separatelly. I increased notification for user up to 800, because I receive a lot of notifications and ips different, and not always blocked.

 

[zEitEr]

I increased notification for user up to 800, because I receive a lot of notifications

Set

/usr/local/directadmin/directadmin set hide_brute_force_notifications 1 restart

to suppress BFM messages