I have been trying, unsuccessfully, to get bruteforceblocker to run on
my firewall. If I call it it downloads a list of IP addresses so it at
least appears to be set up OK. If I run it in the background I can see
it in a ps ax, but after a while it is not there. I have a "duplicate"
entry for it in syslogd.conf, syslogd is running with -s -c, there is
a properly named table in /var/db and that table is loaded by pf.
auth.log has tons of login attempts but I seen none if the addresses
being added to /var/db/ssh-bruteforce. Just what am I supposed to be
seeing when things are running properly?