From 36bc71dcc816b3813f8bde0687f484acb74854fd Mon Sep 17 00:00:00 2001
From: swaits <devnull@localhost>
Date: Sun, 12 Mar 2006 18:21:14 +0000
Subject: [PATCH] lower max failures, speed up loop

---
 sshbruted.rb | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/sshbruted.rb b/sshbruted.rb
index b224f27..c35cfeb 100644
--- a/sshbruted.rb
+++ b/sshbruted.rb
@@ -5,7 +5,7 @@ require 'thread'
 
 LOG_COMMAND  = "/usr/bin/tail -F /var/log/auth.log"
 BLACKLIST    = "/etc/hosts.blacklist"
-MAX_FAILURES = 3
+MAX_FAILURES = 2
 TIME_LIMIT   = 30 * 60  # 30 minutes
 
 class Blacklister	
@@ -27,7 +27,7 @@ class Blacklister
 			@iplog.reject! { |ip,times| stale_entry(times)  }
 		
 			# create our blacklist
-			@iplog.each { |ip,times| badlist << ip if fresh_count(times) > MAX_FAILURES }
+			@iplog.each { |ip,times| badlist << ip if fresh_count(times) >= MAX_FAILURES }
 		end
 		badlist.sort
 	end
@@ -65,7 +65,7 @@ end
 output_thread = Thread.new do
 	list = []
 	loop do
-		sleep 2
+		sleep 1
 		new_list = blacklister.list.join("\n")
 		if new_list != list
 			File.open(BLACKLIST,"w") { |f| f.puts(new_list) }
@@ -78,4 +78,3 @@ end
 
 input_thread.join
 
-