search

msimerson / sentry

Bruteforce attack blocker (ssh, FTP, SMTP, and more)
64 stars 20 forks source link

entries in hosts.deny can be duplicated #2

Closed sn3ak closed 11 years ago

sn3ak commented 11 years ago

I haven't attempted to look in the database, but due to issue #1 and entries not being removed from hosts.deny. I can verify, manual or automatic blacklist will add another entry into hosts.deny.

I suspect it would be wise to verify if an ip is already listed in the file, or with a working cleanup, make sure all copies of the ip is removed.

msimerson commented 11 years ago

The database is keyed off the IP, so duplication is not possible. Because of how IPs are removed from hosts.deny, all matches in the hosts.deny are removed when delisting.

I would accept a patch that optionally checks for the existence of an IP before adding it to hosts.deny, but I won't write it. In the odd case where an IP gets listed multiple times (because of a DB/tcpd file mismatch), it doesn't hurt anything. The amount of resources needed to parse the file before every write would greatly exceed the cost of having a few duplicated IPs.