How-To install and configure Brute Force Detection (BFD)

[eWebtricity]

BFD is a modular shell script for parsing applicable logs and checking for authentication failures. There is not much complexity or detail to BFD yet and likewise it is very straight-forward in its installation, configuration and usage. The reason behind BFD is very simple; the fact there is little to no authentication and brute force auditing programs in the linux community that work in conjunction with a firewall or real-time facility to place bans.

Step 1:

download, uncompress, and install BFD from http://www.rfxnetworks.com/bfd.php


[root@u15171818 src]# wget http://www.rfxnetworks.com/downloads/bfd-current.tar.gz
[root@u15171818 src]# tar -zxvf bfd-current.tar.gz
[root@u15171818 bfd-0.9]# ./install.sh
.: BFD installed
Install path: /usr/local/bfd
Config path: /usr/local/bfd/conf.bfd
Executable path: /usr/local/sbin/bfd
[root@u15171818 bfd-0.9]#


Step 2:

Configure BFD by editing the /usr/local/bfd/conf.bfd


# Enable/disable user alerts [0 = off; 1 = on]
ALERT_USR="1"

# User alert email address
EMAIL_USR="youremail@domain.com"


Edit the ignore.hosts file and add your IP address(s) to prevent BFD from locking you out


vi /usr/local/bfd/ignore.hosts


Step 3:

Start BFD


[root@u15171818 bfd-0.9]# bfd -s