BFD Lockout

[beesfan]

How do i change the number of tries given to a host before BFD blocks them? At the moment it seems stupidly high at 27.

Thanks

[Ron]

It is set at 27 because it takes log(n) tries to break in, and that is a minimum of 28 attempts.

LOL Just kidding.

27 seems like a strange number.

[thisisit3]

My rules use the following defaults:

# grep TRIG *
apache: TRIG="15"
apache-exploits:        TRIG="1"
exim:   TRIG="10"
imapd:  TRIG="15"
pop3d:  TRIG="15"
pure-ftpd:      TRIG="15" 
sshd:   TRIG="1"

All exploits have trigger set to 1 because they are very sensitive, while failed login attempts are higher in order to avoid false positives (legitimate user who can't remember his password).