FIFO Delay on Ubuntu 10.04 / sshdfilter issues

[workmaster2n]

Hi,

I am trying to set up sshdfilter on my new linux box and can't get the expected functionality. I couldn't get IP's to be blocked no matter how many bad passwords I put in. I have sshdfilter set up to read from a fifo (/var/log/sshd.fifo, which has been chmod'd to 600), but when I run sudo tail -f /var/log/sshd.fifo, I don't see any output as I attempt to SSH into the machine, though /var/log/auth.log is correctly logging the login attempts. However, when I run sudo reboot -h now, the entries from /var/log/auth.log appear in the FIFO. I'm wondering if I don't have a misconfiguration somewhere that isn't allowing my auth.log to pipe to my FIFO (I am running a virtual bridge).

Any ideas?

I can provide more system specific information if anybody is curious (no, I won't give you my IP so you can brute force my sshdfilter-less computer. Nice try though)

Thanks!

[JosePF]

Hello,
i dont have a solution, i have a doubt...why do you use file /var/log/sshd.fifo?

Regards

[workmaster2n]

sshdfilter requires a FIFO pipe when not reading from STDIN. /var/log/sshd.fifo is the name of the FIFO pipe that I created for that purpose.

[JosePF]

sorry again
I have not explained well.
I meant which is the need of use that file.

Regards
and sorry again