Re: [SSHGuard-users] Issue restarting sshguard

[Burton S. <Bu...@Bu...>]

1.7.1 + a couple of patches
iptables
No, I can't spare the effort to switch to 1.99.x now.

I'm using systemd and systemctl stop sshguard.service or restart. And I'm
not seeing the flush command being executed.

It may be belt & suspenders, but I can't see the harm in flushing the chain
regardless.

Ultimately I want to create an sshguard and sshguard-perm chain so I can
have the perm blocks just dumped before the Shorewall even logs them. The
patch is working, but it will be cleaner to arrange the chains that way just
so sshguard doesn't see the already blocked addresses in SYN log and whine.

-----Burton

-----Original Message-----
From: Kevin Zheng [mailto:kev...@gm...] 
Sent: Wednesday, January 18, 2017 1:30 PM
To: BSt...@ac...; ssh...@li...
Subject: Re: [SSHGuard-users] Issue restarting sshguard

On 01/18/17 03:45, Burton Strauss wrote:
> If sshguard shuts down other than cleanly, and you restart it, the 
> blocklist rules get doubled.
>
> Does it hurt anything to add a flush command first? For iptables it 
> would be:

In 1.7, if SSHGuard exits cleanly it should issue a 'flush' command before
exiting. In 2.0, sshg-blocker sets 'flushonexit' and sshg-fw flushes before
exiting.

What version are you using? What backend are you using? If you're able to,
does 2.0 fix your issue?

Best,
Kevin

--
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090