Posted: 04 Apr 2010, 17:33
Yes, the date changes as expected. If you check the csf.deny after removing a line and saving, it actually scrambles the remaining lines a bit. For example, if the csf.deny has this in it with no space betwen the two lines:
And I remove the second line completely and save changes. When I check the file again, both lines are there, but now there is a space in between them.
One line was added automatically by CSF, the other manually as noted when added.
But, if there are several lines that were auto added, take the example above with one added line like this:
and I edit the 2nd line out (the manually added by...) and save, when I check csf.deny again, it looks like this:
You'll notice partial line left from the 2nd, 3rd line snipped a bit when it saved.
I hope that makes some sense. Note that in my example I did reuse a line with a different IP at the front end of the line for example purposes only, hence the same mesage on tail end of line.
Code: Select all
5.17.159.141 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010
211.192.213.10 # #maually added by Infopro - Sun Apr 4 12:24:26 2010
One line was added automatically by CSF, the other manually as noted when added.
But, if there are several lines that were auto added, take the example above with one added line like this:
Code: Select all
5.17.159.141 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010
211.192.213.10 # #manually added by Infopro - Sun Apr 4 12:24:26 2010
11.192.213.10 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010Code: Select all
5.17.159.141 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010
.192.213.10 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010I hope that makes some sense. Note that in my example I did reuse a line with a different IP at the front end of the line for example purposes only, hence the same mesage on tail end of line.