blacklistd question

[Paul Goyette <paul%whooppee.com@localhost>]

I was looking at the blacklistd (and related) man-pages, and I'm not 
sure I understand how it works.  Perhaps someone can enlighten me.

The man page references socket(s) on which blacklistd listens for 
notifications, but it doesn't seem to indicate what programs are 
(currently capable of) sending reports to the socket(s).  apropos(1) 
doesn't seem to find any references from other man pages to provide 
additional clues.

The example in blacklistd.conf(5) seems to imply that sshd will send 
notifications, but nothing in the sshd man page confirms this.  Also, 
the example uses "*" for the connection type and protocol, but it seems 
that "stream" and "tcp" would be better choices?  Is the use of "*" 
simply a means of avoiding separate IPv4 and IPv6 rules?  (And if so, 
shouldn't there be a separate parameter for address family?)

Thanks in advance.




+------------------+--------------------------+------------------------+
| Paul Goyette     | PGP Key fingerprint:     | E-mail addresses:      |
| (Retired)        | FA29 0E3B 35AF E8AE 6651 | paul at whooppee.com   |
| Kernel Developer | 0786 F758 55DE 53BA 7731 | pgoyette at netbsd.org |
+------------------+--------------------------+------------------------+