I've enabled the PF(4) firewall and blacklistd(8). Although IP addresses are being added to to blacklist, I can still see multiple failed attempts from a single IP address. Yet when I test it myself, my IP address gets blacklisted properly: it's added to the blacklist and I can't initiate any more connections from it.




# adr/mask:port type    proto   owner           name    nfail   disable
ssh             stream  *       *               *       1       365d
# Extra lines removed


UseBlacklist Yes


set skip on { lo0, em0 }

# Packet normalization
scrub in

# Integrate blacklistd to protect sshd
anchor "blacklistd/*" in on $intf


# Default firewall rules
block in
pass out
# Allow inbound SSH on the default port (22)
pass in on $intf proto tcp to ($intf) port 22
# Allow basic ICMP functionality
pass in on $intf inet proto icmp to ($intf) icmp-type { unreach, redir, timex, echoreq }

grep sshd /var/log/messages | tail -20

Mar  2 00:21:11 [...] illegal user admin from
Mar  2 00:21:30 [...] illegal user alix from
Mar  2 00:21:51 [...] illegal user gotubego from
Mar  2 00:23:35 [...] illegal user tsbot from
Mar  2 00:23:40 [...] illegal user spravce from
Mar  2 00:25:34 [...] root from
Mar  2 00:25:57 [...] illegal user admin from
Mar  2 00:27:29 [...] illegal user admin from
Mar  2 00:29:13 [...] root from
Mar  2 00:30:06 [...] root from
Mar  2 00:33:09 [...] illegal user admin from
Mar  2 00:33:23 [...] illegal user admin from
Mar  2 00:34:15 [...] illegal user bogalfb from
Mar  2 00:35:34 [...] root from
Mar  2 00:35:59 [...] illegal user admin from
Mar  3 13:35:35 [...] illegal user user from
Mar  4 19:47:59 [...] root from
Mar  5 02:09:39 [...] illegal user user from host2.awolphoto.com
Mar  5 16:02:33 [...] illegal user user from
Mar  7 04:43:38 [...] illegal user user from server28.pixeled.net

I've truncated the lines for readability. The entire first lines reads as:

Mar  2 00:21:11 phoenix sshd[94473]: error: PAM: authentication error for illegal user admin from

I've deleted the unuseful bits.

sudo blacklistctl dump -br   OK      2/1     1y3d22h45m57s   OK      2/1     1y3d29h16m55s   OK      40/1    20d2h19m32s   OK      2/1     22d42h8m58s   OK      2/1     2d12h1m40s   OK      2/1     7d34h39m45s   OK      62/1    9d11h56m22s

The list contains 1069 entries but not the IP address


  1. Some IP addresses time out in (more) a year (as they should) while others time out in only a couple of days (e.g. 2 days).
  2. Some IP addresses (e.g. are not added to the list while they clearly should be.
  3. Some addresses could execute as much as 62 attempts before being blocked in the list.

What am I missing in my configuration to make it work as desired?

  • From reading blacklistd.conf(5), it looks like the first field on the line in the blacklistd.conf file should be prefixed by : if it's to be taken as a port. I'm not on FreeBSD so I can't test this though. You may want to test with :ssh or wlan0:ssh. – Kusalananda Mar 8 at 10:32
  • I could give that a try. I copied it from Absolute FreeBSD, 3rd edition without the colon and it appears to work most of the time. It's adding IP addresses to the blocked list and when I test it, it blocks me correctly. – Tommiie Mar 8 at 11:07
  • Yeah, it's the only thing that stood out for me. I can't say anything more really. – Kusalananda Mar 8 at 11:20

My configuration is pretty much the same and I can't see any sshd "... illegal user ..." in /var/log/messages

The only differences are in my rc.conf


and in pf.conf. Instead of

pass in on $intf proto tcp to ($intf) port 22

you might consider this one

pass in on $intf proto tcp from any to any port ssh flags S/SA synproxy state

FWIW. To make the configuration reproducible I use my Ansible role


  • Entry " OK 62/1 9d11h56m22s" looks suspicious. Should have been blacklisted after 1st failure. How did it manage to fail 62 times?

  • Entry " OK 40/1 20d2h19m32s" dtto

  • You configured to disable for "365d", but the entries above show remaining times in couple of days. Have these entries really been blacklisted over 11 months?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.