This depends on how you have configured ASL. By default an IP is blocked for 600 seconds. If you want to block attackers for longer, even permanently, simply adjust these two settings in ASL:
https://www.atomicorp.com/wiki/index.php/ASL_Configuration#OSSEC_SHUN_TIME
And if you want blocks to be permanent just disable this setting:
https://www.atomicorp.com/wiki/index.php/ASL_Configuration#OSSEC_SHUN_ENABLE_TIMEOUT
Comments
0 comments
Please sign in to leave a comment.