The sshguard rc-script supplied with the FreeBSD port always sets the commandline parameter for blacklisting. This means that any blacklist configuration in sshguard.conf will never be used. So, if you want to tweak the blacklisting, you need to do that in rc.conf, and since you anyway need to edit sshguard.conf to set the backend, it means that you have to configure sshguard in two places. I find that inconvenient. I therefore propose that the port removes the default setting of sshguard_blacklist from the rc.d script, and changes the default in sshguard.conf instead! (As this is a simple change, I didn't attach a patch - I would be happy to create one if needed!)
The intent in doing that was to make upgrading easier, because then we could just keep the same rc.conf option. Clearly we messed up because you have to set the backend in sshguard.conf anyway. Would you prefer both options to be set in rc.conf or sshguard.conf?
Thanks for looking at this! I have no real preference, other than making the configuration in just one place.
Please make a patch.
Ping
Created attachment 222508 [details] Patch I've attached a patch with the requested changes. More detail is in the patch body, which is reproduced below: The sshguard_blacklist rcvar always overrides the setting in sshguard.conf. Since the rc.d script sets sshguard_blacklist, the blacklist option in sshguard.conf is never used. This patch removes the default rcvar setting, and instead enables blacklisting in the example sshguard.conf. (Note that this is a traditional FreeBSD ports default, not an upstream default.) New users (with no existing sshguard.conf) will see no change. Users with existing sshguard.conf will have blacklisting turned off until they update their sshguard.conf. Though, I want to ask those CC'd on the patch here, what do you think about leaving blacklisting off by default?
(In reply to Kevin Zheng from comment #5) IMO at least UPDATING entry is needed here as it's a breaking change.