Re: [SSHGuard-users] sshguard.conf dictates sshg-fw-iptables backend: still runs sshg-fw-firewalld?

[Kevin B. <kev...@gm...>]

On 2026/09/21 15:18, Kevin Buckley wrote:
> 
> We're running: sshguard-2.4.2-bp157.1.6.x86_64
> 
> In
> 
>  /etc/sshguard.conf
> 
> we have
> 
> BACKEND="/usr/lib/sshg-fw-iptables"
> 
> but, as the service (systemd invoked on a SLES 15 OS) starts,
> we see the following, in var/log/messages
> 
> 2026-09-01T14:53:34.634459+08:00 <hostname> sshguard[93330]: blacklist: blocking 0 addresses
> 2026-09-01T14:53:34.634526+08:00 <hostname> sshguard[93330]: Now monitoring attacks.
> 2026-09-01T14:53:34.634761+08:00 <hostname> sshguard[93335]: /usr/lib/sshg-fw-firewalld: line 8: firewall-cmd: command not found
> 2026-09-01T14:53:34.635433+08:00 <hostname> sshguard[93336]: /usr/lib/sshg-fw-firewalld: line 9: firewall-cmd: command not found
> 2026-09-01T14:53:34.636143+08:00 <hostname> sshguard[93337]: /usr/lib/sshg-fw-firewalld: line 10: firewall-cmd: command not found
> 2026-09-01T14:53:34.636807+08:00 <hostname> sshguard[93338]: /usr/lib/sshg-fw-firewalld: line 12: firewall-cmd: command not found
> 2026-09-01T14:53:34.637501+08:00 <hostname> sshguard[93339]: /usr/lib/sshg-fw-firewalld: line 13: firewall-cmd: command not found
> 2026-09-01T14:53:34.637614+08:00 <hostname> sshguard[93330]: Attack from "83.235.21.125" on service SSH with danger 10.
> 2026-09-01T14:53:34.638156+08:00 <hostname> sshguard[93340]: /usr/lib/sshg-fw-firewalld: line 14: firewall-cmd: command not found
> 2026-09-01T14:53:34.638849+08:00 <hostname> sshguard[93341]: /usr/lib/sshg-fw-firewalld: line 16: firewall-cmd: command not found
> 2026-09-01T14:53:34.640565+08:00 <hostname> sshguard[93332]: sshg-fw-firewalld: Could not initialize firewall
> 
> so why is SSHGuard even bothering to look for firewalld-related
> things, which we aren't running, hence the config file setting?
I suppose the thing I failed to mention is that the "Attack from" line
in the above comes from PID 93330, and so do all the others that are
observed afterwards.

So maybe the question should be: what are those other 7 processes,
93335-93341, that seem to be "doing SSHGuard stuff" whilst ignoring
the sshguard.conf file setting?