Size deny.host

BerArt · Unread post by **BerArt** » Fri Apr 18, 2008 3:34 am

Hi,

Maybe a stupid question but how big (kb) can the deny.host be before “it” gets slow?
On some server I see a lot of IP’s (40-60 per day) being blocked in the deny.host.
At least I think it is a lot

on other servers there are 3-4 IP's blocked per per week.

Thx!

Unread post by **scott** » Fri Apr 18, 2008 8:29 am

Good question, I have about 6000 entries in mine.

BerArt · Unread post by **BerArt** » Fri Apr 18, 2008 8:36 am

How much is that in kiloBytes?
How long is that running now?
And are you experience any delay because of the 6000 entries?
40-60 per day will be a lot more than 6000 in a year

Unread post by **scott** » Fri Apr 18, 2008 4:13 pm

I have mine set to expire them after 4 weeks, in size its around 300K. Havent experienced any delays with it.

BerArt · Unread post by **BerArt** » Fri Apr 18, 2008 4:15 pm

Is this an ASL setting somewehre in the .conf?

Unread post by **scott** » Sat Apr 19, 2008 8:19 am

You can set that with:

DENYHOSTS_SHUN_TIME="4w"
OSSEC_SHUN_TIME="259200"

Both systems update hosts.deny.

BerArt · Unread post by **BerArt** » Sat Apr 19, 2008 8:31 am

Ah thx!

I changed the settings