i have this message in log
kernel: pid 64493 (sshguard), uid 0: exited on signal 10 (core dumped)
ps axgwww | grep sshguard
25116 ?? Is 0:00.06 /usr/local/sbin/sshguard -a 3 -b 10:/var/db/sshguard/blacklist -w /var/db/sshguard/whitelist
Here's a backtrace of one of sshguard's coredumps:
root@online:/var/log # gdb /usr/local/sbin/sshguard /sshguard.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...(no debugging symbols found)...
Core was generated by `sshguard'.
Program terminated with signal 10, Bus error.
Reading symbols from /lib/libthr.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libthr.so.3
Reading symbols from /lib/libc.so.7...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.7
Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols found)...done.
Loaded symbols for /libexec/ld-elf.so.1
[New Thread 801007800 (LWP 107255/sshguard)]
[New Thread 801007400 (LWP 110216/sshguard)]
(gdb) bt
uname -a
FreeBSD online.xxx.ru 9.1-RELEASE-p4 FreeBSD 9.1-RELEASE-p4 #12: Thu Jun 20 18:00:14 MSK 2013 root@online.xxx.ru:/usr/obj/usr/src/sys/MYKERNEL amd64
I hope this is enough info, I can make a debug build if needed.
At first sshguard normally worked, but then started giving out in a log (core dumped)
after
/ etc/rc.d/syslogd restart
Didn't help, I didn't start working
That helped that I at first deleted /var/db/sshguard/blacklist the file
then
/ etc/rc.d/syslogd stop
/ etc/rc.d/syslogd start
Same error happening in 10.1-RELEASE amd64:
Backtrace:
Last edit: rustamabd 2015-05-24
Just to check -- is this from the 1.6.0 release? Latest version from ports?
This is sshguard-ipfw-1.6.0_1 from packages.
Let me see if I'm understanding the problem right: you're running SSHGuard from
syslogd
, and when you restartsyslogd
SSHGuard crashes, but only when you're using a blacklist? And after it crashes, it also crashes more when using the same blacklist?If so, could you attach a 'broken' blacklist file? A debug build would be helpful, but I think I might be able to understand what's going on from the blacklist file itself.
I'm running sshguard as a daemon like this:
/usr/local/sbin/sshguard -b 40:/var/db/sshguard/blacklist.db -l /var/log/auth.log -l /var/log/exim/mainlog -a 40 -p 420 -s 1200 -w /usr/local/etc/sshguard.whitelist -i /var/run/sshguard.pid
Previously I ran the basic version (no firewall attachment), now I switched to the version that is linked with IPFW support and it refuses to start, dumping core.
Update: after I deleted the blacklist file it started up fine.
Sounds like it might be something interesting going on with the
ipfw
backend. I used your 'blacklist.db' onpf
and everything worked fine. Could you run a debug build and paste your backtrace?Hope this helps...
Thanks! We definitely know what's going on now. An errata notice went on the mailing list with additional details and possible workarounds. Hopefully we'll have this fixed shortly.
Diff:
Diff:
A patch is attached (and on the mailing list). Could you test it and see if it works?
Fixed in 3e8591f with the new
ipfw
backend.