[Sshguard-users] RE : Errors when trying to add ipfw rules

[Yves G. <yve...@ya...>]

Hello,

Under which user the sshguard is running: ps auxwww
Look into your securelevel for your kernel: man securelevel
run the kernel below the 3rd level.

Regards

Jeff Berman <sp...@ya...> a écrit : Hi everyone,

I just installed sshguard 1.0 on my Mac running OS X
10.4.9.  Sshguard seems to run just fine, but it fails
when trying to add rules to ipfw.  This is the error:

ipfw: socket: Operation not permitted

And this is what is logged:

Apr 14 10:11:08 G3 sshguard[378]: Started successfully
[(a,p,s)=(4, 420, 1200)], now ready to scan.
Apr 14 10:11:25 G3 sshguard[378]: Blocking 127.0.0.1:
4 failures over 5 seconds.\n
Apr 14 10:11:25 G3 sshguard[378]: Blocking command
failed. Exited: 17664
Apr 14 10:20:52 G3 sshguard[378]: Releasing 127.0.0.1
after 567 seconds.\n
Apr 14 10:20:52 G3 sshguard[378]: could not get back
rule ID for address 127.0.0.1
Apr 14 10:20:52 G3 sshguard[378]: Release command
failed. Exited: -1

I'm not an expert with *nix permissions, but this is
how the sshguard executable is listed via ls:

-rwxr-xr-x   1 root  wheel  52924 Apr 14 05:03
sshguard

So I would think that it would have authority to write
out to ipfw.  I also tried running sshguard via sudo
but it gets the same error.  Any ideas how to fix
this?

Thanks!


      ____________________________________________________________________________________
Be a better friend, newshound, and 
know-it-all with Yahoo! Mobile.  Try it now.  http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Sshguard-users mailing list
Ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users



Yves Guerin
http://welcome.to/virtuelab
 ooooooooside 2008-04-16 and 2008-04-22 ooooooooside 2008-04-23 and 2008-04-29 between 2008-04-04 and 9999-99-99       <hr size="1"> Envoyé avec <a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html">Yahoo! Mail</a>.<br>Une boite mail plus intelligente. </a>