Emailblock : Block time problem

Support section for FREESCO v0.4.x 3rd Party Packages

Emailblock : Block time problem

Postby Island » Fri Apr 11, 2014 7:26 am

Though using email block with the BLOCKTIME set to 5000 (and the comment line in emailblock.cfg suggests that the units for BLOCKTIME are minutes), Emailblock seems to be blocking for only 75 minutes, not the 5000 we've set. This is on FREESCO 0.4.4, and which is regularly rebooted, including just a couple of days ago. The cfg file was last changed back in 2013.

Here's a recent log entry:

Code: Select all
Wed Apr  9 12:25:15 BST 2014: Email blocked   5.79.65.105
Wed Apr  9 13:40:23 BST 2014: Email un-blocked   5.79.65.105

which shows that IP remaining blocked for only 75 minutes (and a few seconds).

I wondered, even, whether the BLOCKTIME was - actually - seconds, but 5000 / 60 is 83.33 (ie 5000 seconds is around 83 minutes) which is, anyway, inconsistent with the 75 minute block shown in the log.

The reason for asking is that many of these hostile login attempts go on to repeat for hours and days, so we would like to be able to block them for a longer time.

I think I'd set the 5000 by editing the cfg file directly (using mc).

Are other users of the package able to set quite long block times?

regards, Island
User avatar
Island
Junior Advanced Member
 
Posts: 117
Joined: Sat Jan 22, 2005 12:48 pm

Re: Emailblock : Block time problem

Postby Lightning » Fri Apr 11, 2014 7:21 pm

I think I'd set the 5000 by editing the cfg file directly (using mc).

Double check the /pkg/etc/emailblock.cfg file and make certain the value is what you think it is. I have used reasonably long times for the system and did not have any issues. But of course there are always limits to which I am unsure and I have never used any number greater than 1440.

The actual mechanism that does the checking for time works as follows. When an IP is block it is stored with a value of "date +%s". Which is the date in seconds since Jan 1 1970. Then every 13 seconds the system checks all of the blocked IP address and uses the same date format minus the "block time * 60" and any value that is less than that value is unblocked. So the system actually works in seconds, but the configuration is in minutes to make it simpler.
If you are afraid that you might make a mistake. The chances are high that you will never learn anything.
User avatar
Lightning
FREESCO GOD !!
 
Posts: 12079
Joined: Wed Nov 14, 2001 6:50 am
Location: Oregon, USA

Re: Emailblock : Block time problem

Postby Island » Sat Apr 12, 2014 5:32 am

Tst. /pkg/etc/emailblock.cfg:

Code: Select all
# Number in minutes. 0=block forever.
BLOCKTIME=75


So I'll change this, instead. I wonder what I'd changed before - because whatever it was, it survived countless reboots, and existed in /etc.

Never mind,

regards, Island
User avatar
Island
Junior Advanced Member
 
Posts: 117
Joined: Sat Jan 22, 2005 12:48 pm

Re: Emailblock : Block time problem

Postby Lightning » Sat Apr 12, 2014 12:03 pm

There is a symlink to this file that does live in /etc. But it the same file as it is just a link. Once you make the changes just use

rc_emailblock restart

This will re-read the configuration.
If you are afraid that you might make a mistake. The chances are high that you will never learn anything.
User avatar
Lightning
FREESCO GOD !!
 
Posts: 12079
Joined: Wed Nov 14, 2001 6:50 am
Location: Oregon, USA


Return to 3rd Party Package Support for FREESCO v0.4.x

Who is online

Users browsing this forum: No registered users and 3 guests

cron