Re: [SSHGuard-users] sshguard.conf dictates sshg-fw-iptables backend: still runs sshg-fw-firewalld?

[Kevin B. <kev...@gm...>]

On 2026/09/21 16:26, Kevin Zheng wrote:
> 
> Lines 8-16 sound like the commands for firewalld initialization. 
> sshg-fw-firewalld is just a shell script so you can take a look at what 
> it is trying to do.

I did look at the file, and saw that it has 

${FIREW_CMD} <args>

on each of the line numbers referred to in the output, however

> Could you check that /etc/sshguard.conf is the correct location for your 
> config file, that it is not being overriden somewhere else, and that 
> there is not a subsequent BACKEND= line that sets it back to firewalld?
the relevant lines in the systemd service file are:

EnvironmentFile=-/etc/sshguard.conf
ExecStart=/usr/sbin/sshguard -a $THRESHOLD -p $BLOCK_TIME -s $DETECTION_TIME -w $WHITELIST_FILE -b $BLACKLIST_FILE

and then, from a drop-in, these commands that stand up, and teardown,
the sshguard chain within the IPTables environment:

ExecStartPre=/usr/sbin/iptables -N sshguard
ExecStartPre=/usr/sbin/iptables -A INPUT -p tcp -m tcp -j sshguard
ExecStopPost=/usr/sbin/iptables -D INPUT -p tcp -m tcp -j sshguard
ExecStopPost=/usr/sbin/iptables -F sshguard
ExecStopPost=/usr/sbin/iptables -X sshguard

and there's definitely only one BACKEND line in

/etc/sshguard.conf

so I have no idea what could be invoking that sshg-fw-firewalld.

We could just overwrite that script and make it a no-op, but, as
I think of it, it should not be being invoked in the first place.

Kevin