ACZoom  ·  Archive-2016

It does update the records if a remote site continues to attack, but there are a number of issues here.

1: If you are using iptables to block all traffic, then once blocked, the IP address will never make it to the applications (like SSHD), so there will be no log messages to count.

2: If you do see log messages (when not using iptables mode), then it will cause updates. For example, the /etc/hosts.allow will show updated times for that address:

#bh: ip:      10.66.66.2 :   1 : 1349179994.9 # 2012-10-02 08:13:14 EDT

But this is only if the log message is one of the strings being scanned - see /etc/blockhosts.cfg for all the patterns.

3: The example you posted - "refused connect" is not a pattern in the default /etc/blockhosts.cfg so if you see only that, and none of the other expected messages (Failed password, Invalid user, etc), then it will not cause any updates to the IP address.

4: If you wish to block on that line, will need to a new pattern for that. This might work (not tested)

    "sshd-refused":
        r'{LOG_PREFIX{sshd}} refused connect from {HOST_IP}',

Note that adding that to blockhosts.cfg requires careful attention to line indents and spaces - it is a Python file.

It is quite possible that SSHD is printing that "refused connect" based on the hosts.allow blocking - in which case, blockhosts.cfg should contain the above line. Will add it to the next release of blockhosts.

Even without that - if the IP address continues to probe your site after it is removed from the block list, it will be blocked again once its probing count reaches the trigger limit.