A couple more things to watch for

diff --git a/examples/blockad.conf b/examples/blockad.conf
index b288576..191a4a9 100644 (file)
--- a/examples/blockad.conf
+++ b/examples/blockad.conf
@@ -4,11 +4,13 @@
 
 # File(s) to watch
 watch /var/log/auth.log
+watch /var/log/secure.log
 
 # Logfile patterns look out for
 address 'Invalid user [^[:space:]]+ from ([^[:space:]]+)' 1
 address 'Failed password for [^[:space:]]+ from ([^[:space:]]+)' 1
 address 'Failed password for invalid user [^[:space:]]+ from ([^[:space:]]+)' 1
+address 'Failed keyboard-interactive/pam for invalid user [^[:space:]]+ from ([^[:space:]]+)' 1
 
 # Address patterns to exempt
 exempt 127.0.0.1