sshguard-users — User questions and answers, bugs, and general support

Re: [SSHGuard-users] sshguard 2.5.0 release candidate

[Kevin B. <kev...@gm...>]

On 2025/03/17 15:06, Kevin Buckley wrote:
> On 2025/03/16 15:23, Kevin Zheng wrote:
>> Dear SSHGuard users and maintainers,
>> 
>> It has been some time since the last versioned SSHGuard release, and
>> it's time to cut a new version for the benefit of packagers and users.
>> 
>> If you are able and comfortable to compile from source and deploy on
>> test/production systems, your early testing and feedback is appreciated
>> so that we can squash any late-breaking bugs before the release.
>> 
>> You can check out a copy of the release candidate code from:
>> 
>> https://bitbucket.org/sshguard/sshguard.git
>> 
> 
> Further to my question about the SPEC-file,
> 
> I "git pulled" from the repo and ran a
> 
> make dist-bzip2
> 
> so as to get a tarball to use against an existing distro's SPEC-file,
> which I'd tweak for the 2.5.0 release.
> 
> 
> It looks as though the generated tarball has doubled up on the
> examples directory?
> 
> $ tar tvf sshguard-2.5.0.tar.bz2
> ...
> -rw-rw-r-- 20480/20480    1021 2020-01-22 10:31 sshguard-2.5.0/COPYING
> drwxrwxr-x 20480/20480       0 2025-03-17 09:45 sshguard-2.5.0/examples/
> drwxrwxr-x 20480/20480       0 2025-03-17 09:40 sshguard-2.5.0/examples/examples/
> -rw-rw-r-- 20480/20480     263 2020-01-22 10:31 sshguard-2.5.0/examples/examples/whitelistfile.example
> -rw-rw-r-- 20480/20480     392 2021-12-02 08:53 sshguard-2.5.0/examples/examples/net.sshguard.plist
> -rw-rw-r-- 20480/20480    2744 2025-03-17 09:40 sshguard-2.5.0/examples/examples/sshguard.conf.sample
> -rw-rw-r-- 20480/20480     348 2024-06-24 15:03 sshguard-2.5.0/examples/examples/sshguard.service
> -rw-rw-r-- 20480/20480    1423 2025-03-17 09:40 sshguard-2.5.0/configure.ac
> ...
> 
> which came to light when the "harden patch" didn't apply,
> as it was expecting just the single depth there:
> 
> $ head -r harden_sshguard.service.patch
> Index: sshguard-2.4.3/examples/sshguard.service
> ===================================================================
> --- sshguard-2.4.3.orig/examples/sshguard.service
> +++ sshguard-2.4.3/examples/sshguard.service
> @@ -9,6 +9,19 @@ After=libvirtd.service
> $
> 
> There's no doubling visible in the working copy.
> 
> Not sure, as yet, where that "doubling" has come from.


Looks as though that dist-bzip2 Makefile target is also
doubling the doc subdir, albeit in a subtly different way:


-rwxr-xr-x 20480/20480    4640 2021-12-02 08:55 sshguard-2.5.0/test-driver
drwxrwxr-x 20480/20480       0 2025-03-17 15:18 sshguard-2.5.0/doc/
-rw-rw-r-- 20480/20480   10488 2021-12-02 08:55 sshguard-2.5.0/doc/sshguard-setup.7
-rw-rw-r-- 20480/20480    5369 2021-12-02 08:55 sshguard-2.5.0/doc/sshguard.8
drwxrwxr-x 20480/20480       0 2025-03-17 09:40 sshguard-2.5.0/doc/doc/
-rw-rw-r-- 20480/20480    4838 2025-03-17 09:40 sshguard-2.5.0/doc/doc/sshguard.8.rst
-rw-rw-r-- 20480/20480   10488 2021-12-02 08:55 sshguard-2.5.0/doc/doc/sshguard-setup.7
-rw-rw-r-- 20480/20480     673 2021-12-02 08:53 sshguard-2.5.0/doc/doc/sshguard.dot
-rw-rw-r-- 20480/20480    5369 2021-12-02 08:55 sshguard-2.5.0/doc/doc/sshguard.8
-rw-rw-r-- 20480/20480    8514 2025-03-17 09:40 sshguard-2.5.0/doc/doc/sshguard-setup.7.rst
-rwxr-xr-x 20480/20480    5826 2021-12-02 08:55 sshguard-2.5.0/ar-lib

HTH,
Another Kevin

Re: [SSHGuard-users] sshguard 2.5.0 release candidate

[Kevin B. <kev...@gm...>]

On 2025/03/16 15:23, Kevin Zheng wrote:
> Dear SSHGuard users and maintainers,
> 
> It has been some time since the last versioned SSHGuard release, and
> it's time to cut a new version for the benefit of packagers and users.
> 
> If you are able and comfortable to compile from source and deploy on
> test/production systems, your early testing and feedback is appreciated
> so that we can squash any late-breaking bugs before the release.
> 
> You can check out a copy of the release candidate code from:
> 
> https://bitbucket.org/sshguard/sshguard.git
> 

Further to my question about the SPEC-file,

I "git pulled" from the repo and ran a

make dist-bzip2

so as to get a tarball to use against an existing distro's SPEC-file,
which I'd tweak for the 2.5.0 release.


It looks as though the generated tarball has doubled up on the
examples directory?

$ tar tvf sshguard-2.5.0.tar.bz2
...
-rw-rw-r-- 20480/20480    1021 2020-01-22 10:31 sshguard-2.5.0/COPYING
drwxrwxr-x 20480/20480       0 2025-03-17 09:45 sshguard-2.5.0/examples/
drwxrwxr-x 20480/20480       0 2025-03-17 09:40 sshguard-2.5.0/examples/examples/
-rw-rw-r-- 20480/20480     263 2020-01-22 10:31 sshguard-2.5.0/examples/examples/whitelistfile.example
-rw-rw-r-- 20480/20480     392 2021-12-02 08:53 sshguard-2.5.0/examples/examples/net.sshguard.plist
-rw-rw-r-- 20480/20480    2744 2025-03-17 09:40 sshguard-2.5.0/examples/examples/sshguard.conf.sample
-rw-rw-r-- 20480/20480     348 2024-06-24 15:03 sshguard-2.5.0/examples/examples/sshguard.service
-rw-rw-r-- 20480/20480    1423 2025-03-17 09:40 sshguard-2.5.0/configure.ac
...

which came to light when the "harden patch" didn't apply,
as it was expecting just the single depth there:

$ head -r harden_sshguard.service.patch
Index: sshguard-2.4.3/examples/sshguard.service
===================================================================
--- sshguard-2.4.3.orig/examples/sshguard.service
+++ sshguard-2.4.3/examples/sshguard.service
@@ -9,6 +9,19 @@ After=libvirtd.service
$

There's no doubling visible in the working copy.

Not sure, as yet, where that "doubling" has come from.


Another Kevin

Re: [SSHGuard-users] sshguard 2.5.0 release candidate

[Kevin B. <kev...@gm...>]

On 2025/03/16 15:23, Kevin Zheng wrote:
> Dear SSHGuard users and maintainers,
> 
> It has been some time since the last versioned SSHGuard release, and
> it's time to cut a new version for the benefit of packagers and users.
> 
> If you are able and comfortable to compile from source and deploy on
> test/production systems, your early testing and feedback is appreciated
> so that we can squash any late-breaking bugs before the release.
> 
> You can check out a copy of the release candidate code from:
> 
> https://bitbucket.org/sshguard/sshguard.git


Didn't there use to be an sshguard.spec file in the repo,
against which to do an rpmbuild?

Or were they only ever created by the packagers for any
given specific distro, in which case you'ld need to get
them out of a previous src.rpm ?

Another Kevin

[SSHGuard-users] sshguard 2.5.0 release candidate

[Kevin Z. <kev...@gm...>]

Dear SSHGuard users and maintainers,

It has been some time since the last versioned SSHGuard release, and 
it's time to cut a new version for the benefit of packagers and users.

If you are able and comfortable to compile from source and deploy on 
test/production systems, your early testing and feedback is appreciated 
so that we can squash any late-breaking bugs before the release.

You can check out a copy of the release candidate code from:

https://bitbucket.org/sshguard/sshguard.git

The two main changes are:

1. Non-privileged processes such as the parser can now switch users
    after starting. Previously, they only used OS-level sandboxing
    mechanisms if available (Capsicum on FreeBSD and pledge on OpenBSD).

2. The web log (CLF) parser was refactored to fix some false positives
    and provide flexibility in defining new attacks. While the new web
    log parser passes all existing and new tests, there may be some
    regressions in cases that are not currently covered by tests.

The draft change log is below:

**Added**

- Add attack signatures for Proxmox VE
- Update signatures for:
   - Cyrus
   - Exim
   - OpenSSH
   - Postfix
- Add option to write Prometheus-compatible metrics
- Add option to change sandboxable-processes to an unprivileged user

**Changed**

- Any HTTP 401 response is now recognized as an attack
- Code improvements in in log banner and web (CLF) parsers. If there are
   regressions, please file a bug report with example attacks so that 
they can
   be added to our tests.

**Fixed**

- Fix configure issues when the shell is not bash
- Fix false positives in web (CLF) log detection with "mail" in the request

Your efforts in testing the release candidate are appreciated!

Regards,
Kevin

Re: [SSHGuard-users] New (point?) release? (With ProxMox PVE rules)

[Kevin Z. <kev...@gm...>]

Hi Hendrik,

On 3/15/25 1:34 PM, Hendrik Visage wrote:
> Would it be possible to release a new tagged release? At least I’m
> interested in the ProxMox PVE rules included for those PVEs I can’t
> secure behind OOB networks… for reasons ... ;(
> 
> Would help to get it in the next Debian release too :)=)

As the FreeBSD package maintainer myself, I understand the need for 
versioned releases to make it into package systems.

I intended to cut a release in January this year (as you can see from 
the version string bump to 2.5.0), but I haven't put together the 
release yet. Let me go ahead and do that now.

Regards,
Kevin

[SSHGuard-users] New (point?) release? (With ProxMox PVE rules)

[Hendrik V. <hv...@he...>]

Good day,

 Project *seems* stagnant with no new releases the past 2years ;(

Would it be possible to release a new tagged release? At least I’m interested in the ProxMox PVE rules included for those PVEs I can’t secure behind OOB networks… for reasons ... ;(

Would help to get it in the next Debian release too :)=)

Hendrik
---

Hendrik Visage

hv...@he...


HeViS.Co Systems Pty Ltd

https://www.envisage.co.za

Re: [SSHGuard-users] patch with parser for Proxmox VE auth failures

[Kevin Z. <kev...@gm...>]

Hi Jos,

At this moment, I believe it is a false positive.

libcap_net.so.1, of course, is provided by the FreeBSD base system in 
/lib/casper. It is possible that because this is a non-standard library 
search path, tools like pkg aren't correctly finding the shared library?

I would need to do more testing/digging to come up with a definite 
answer, though.

There is now a forum post about this issue: 
https://forums.freebsd.org/threads/sshguard-is-missing-a-required-shared-library-libcap_net-so-1.96989/

In the meantime, this issue does not affect SSHGuard being able to work 
correctly.

Regards,
Kevin

Re: [SSHGuard-users] patch with parser for Proxmox VE auth failures

[Jos C. <ssh...@cl...>]

Hi Kev,

Hope you are well.
Just upgrade FreeBSD to 13.5-RELEASE and got this error after running

%> pkg check -d sshguard

Checking sshguard: 100%
sshguard is missing a required shared library: libcap_net.so.1

Can remember we had this issue earlier but disappeared in BSD 13.4

Can you offer an workaround?

Thanks and keep up the good work!
Best, Jos

Jos Chrispijn:
> Hi, thank you both.
>
> Best regards,
> Jos
>
> Kevin Zheng:
>> Hi Christoph,
>>
>> Thanks for the patch. Happy to include this attack signature for 
>> Proxmox VE in SSHGuard.
>>
>> I'm glad you found the documentation useful.
>>
>> I made a small adjustment to your patch. In attack_scanner.l the 
>> attack signatures for the "unknown user" case overlap with those for 
>> the known user, so everything still works when I remove the two lines 
>> for the unknown user case.
>>
>> I've committed this and this will be available in the next release.
>>
>> Thanks again for your contribution!
>

Best regards,
Jos

Re: [SSHGuard-users] patch with parser for Proxmox VE auth failures

[Jos C. <jo...@cl...>]

Hi, thank you both.

Best regards,
Jos

Kevin Zheng:
> Hi Christoph,
>
> Thanks for the patch. Happy to include this attack signature for 
> Proxmox VE in SSHGuard.
>
> I'm glad you found the documentation useful.
>
> I made a small adjustment to your patch. In attack_scanner.l the 
> attack signatures for the "unknown user" case overlap with those for 
> the known user, so everything still works when I remove the two lines 
> for the unknown user case.
>
> I've committed this and this will be available in the next release.
>
> Thanks again for your contribution!

Re: [SSHGuard-users] patch with parser for Proxmox VE auth failures

[Kevin Z. <kev...@gm...>]

Hi Christoph,

Thanks for the patch. Happy to include this attack signature for Proxmox 
VE in SSHGuard.

I'm glad you found the documentation useful.

I made a small adjustment to your patch. In attack_scanner.l the attack 
signatures for the "unknown user" case overlap with those for the known 
user, so everything still works when I remove the two lines for the 
unknown user case.

I've committed this and this will be available in the next release.

Thanks again for your contribution!

Thanks,
Kevin

[SSHGuard-users] patch with parser for Proxmox VE auth failures

[<de...@kl...>]

Dear all,

please find attached a parser for evaluating authentication failure from pvedaemon, a major part of Proxmox Virtual Environment. (https://proxmox.com/en/proxmox-virtual-environment/overview)

This parser ist based upon information in the Proxmox wiki
(parser & jail for Fail2Ban) as well as some real-world
auth errors I've generated myself. :)

Additionally, I've attached the logs from running make check.
Hopefully this all will be of some use for you.

Notes on myself : I'm working as full-time sysadmin and we are evaluating using Proxmox at work. In private I'm using Proxmox since about 1.5 years. As I myself prefer sshguard over Fail2Ban due to it being way faster and for me easier to  understand and implement.
The instruction on how to contribute on the website is quite well thus I've decided to try to add this parser myself. Quite surprised it went that well at all. Nevertheless please bear with me it's my very first patch file ever.

kind regards
Christoph

----------------------------------------
>From 50bdd556f457bc42a1112d844a9b186ec4412881 Mon Sep 17 00:00:00 2001
From: chrkli <de...@kl...>
Date: Sun, 5 May 2024 03:18:08 +0200
Subject: [PATCH] add parser for Proxmox VE

based on information found on Proxmox wiki in regard to Fail2Ban, see
https://pve.proxmox.com/wiki/Fail2ban#Filter_Config
note: only parses messages from pvedaemon, does NOT consider additionally
thrown auth_pam error when using realm "PAM" inside Proxmox VE webapp
---
src/common/attack.h         |  1 +
src/common/service_names.c  |  1 +
src/parser/attack_parser.y  |  8 ++++++++
src/parser/attack_scanner.l | 10 +++++++++-
src/parser/tests.txt        | 16 ++++++++++++++++
5 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/src/common/attack.h b/src/common/attack.h
index e7e4896..d19945c 100644
--- a/src/common/attack.h
+++ b/src/common/attack.h
@@ -50,6 +50,7 @@ enum service {
     SERVICES_OPENVPN_PS     = 410,  //< OpenVPN Portshare
     SERVICES_GITEA          = 500,  //< Gitea
     SERVICES_MSSQL          = 600,  //< Microsoft SQL Server for Linux
+    SERVICES_PROXMOXVE      = 700,  //< Proxmox VE
};

/* an attack (source address & target service info) */
diff --git a/src/common/service_names.c b/src/common/service_names.c
index bbc4d69..174c57c 100644
--- a/src/common/service_names.c
+++ b/src/common/service_names.c
@@ -29,6 +29,7 @@ static const struct service_s services[] = {
     {SERVICES_GITEA, "Gitea"},
     {SERVICES_OPENVPN_PS, "OpenVPN Portshare"},
     {SERVICES_MSSQL, "MSSQL"},
+    {SERVICES_PROXMOXVE, "Proxmox VE"},
};

const char *service_to_name(enum service code) {
diff --git a/src/parser/attack_parser.y b/src/parser/attack_parser.y
index 601d81c..d632ac9 100644
--- a/src/parser/attack_parser.y
+++ b/src/parser/attack_parser.y
@@ -119,6 +119,8 @@ static void yyerror(attack_t *, const char *);
%token OPENVPN_PS_TERM_SUFF
/* MSSQL */
%token MSSQL_AUTHFAIL_PREF
+/* Proxmox VE */
+%token PROXMOXVE_AUTHFAIL_PREF PROXMOXVE_AUTHFAIL_SUFF

%%

@@ -195,6 +197,7 @@ msg_single:
   | giteamsg          { attack->service = SERVICES_GITEA; }
   | openvpnpsmsg      { attack->service = SERVICES_OPENVPN_PS; }
   | sqlservrmsg       { attack->service = SERVICES_MSSQL; }
+  | proxmoxvemsg      { attack->service = SERVICES_PROXMOXVE; }
   ;

/* an address */
@@ -390,6 +393,11 @@ openvpnpsmsg:
   | OPENVPN_PS_TERM_PREF '[' addr ']' OPENVPN_PS_TERM_SUFF
   ;

+ /* attack rules for Proxmox VE */
+proxmoxvemsg:
+    PROXMOXVE_AUTHFAIL_PREF addr PROXMOXVE_AUTHFAIL_SUFF
+  ;
+
%%

static void yyerror(__attribute__((unused)) attack_t *a,
diff --git a/src/parser/attack_scanner.l b/src/parser/attack_scanner.l
index a7c2a33..c7a4913 100644
--- a/src/parser/attack_scanner.l
+++ b/src/parser/attack_scanner.l
@@ -37,7 +37,7 @@ static int getsyslogpid(char *syslogbanner, int length);

  /* Start Conditions */
  /* for Login services */
-%s ssh_notallowed ssh_reversemap ssh_disconnect ssh_badproto ssh_invalid_format ssh_badkex cockpit_authfail
+%s ssh_notallowed ssh_reversemap ssh_disconnect ssh_badproto ssh_invalid_format ssh_badkex cockpit_authfail proxmoxve_authfail
  /* for SSHGuard */
%s sshguard_attack sshguard_block
%s bind
@@ -344,6 +344,14 @@ HTTP_LOGIN_200OK_BAD       .*({WORDPRESS_LOGIN}|{TYPO3_LOGIN}|{CONTAO_LOGIN}).*
"Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. [CLIENT: " { return MSSQL_AUTHFAIL_PREF; }
"Length specified in network packet payload did not match number of bytes read; the connection has been closed. Please contact the vendor of the client library. [CLIENT: " { return MSSQL_AUTHFAIL_PREF; }

+ /* Proxmox VE */
+ /* failed authentication */
+"authentication failure; rhost="  { BEGIN(proxmoxve_authfail); return PROXMOXVE_AUTHFAIL_PREF; }
+<proxmoxve_authfail>" "+"user=".+" "+"msg=".+                        { BEGIN(INITIAL); return PROXMOXVE_AUTHFAIL_SUFF; }
+ /* unknown internal user */
+"authentication failure; rhost="  { BEGIN(proxmoxve_authfail); return PROXMOXVE_AUTHFAIL_PREF; }
+<proxmoxve_authfail>" "+"user=".+" "+"msg=no such user ('".+"')"     { BEGIN(INITIAL); return PROXMOXVE_AUTHFAIL_SUFF; }
+
  /**         COMMON-USE TOKENS       do not touch these          **/
  /* an IPv4 address */
{IPV4}                                                          { yylval.str = yytext; return IPv4; }
diff --git a/src/parser/tests.txt b/src/parser/tests.txt
index bd610fe..4ee143c 100644
--- a/src/parser/tests.txt
+++ b/src/parser/tests.txt
@@ -597,3 +597,19 @@ M
600 198.199.105.106 4 10
M

+#### Proxmox VE
+May 04 23:45:19 deb12-pve pvedaemon[2352]: authentication failure; rhost=::ffff:192.0.2.74 user=tester@pve msg=Authentication failure
+700 192.0.2.74 4 10
+M
+May 05 00:11:56 deb12-pve pvedaemon[2350]: authentication failure; rhost=2001:0DB8:72a:1936:2d49:83ed:d49a:6ffd user=root@pam msg=Authentication failure
+700 2001:0DB8:72a:1936:2d49:83ed:d49a:6ffd 6 10
+M
+May 05 00:07:09 deb12-pve pvedaemon[2351]: authentication failure; rhost=::ffff:192.0.2.154 user=tester2@pam msg=no such user ('tester2@pam')
+700 192.0.2.154 4 10
+M
+May 05 00:08:19 deb12-pve pvedaemon[2352]: authentication failure; rhost=::ffff:192.0.2.7 user=tester3@pve msg=no such user ('tester3@pve')
+700 192.0.2.7 4 10
+M
+May 05 00:12:11 deb12-pve pvedaemon[2352]: authentication failure; rhost=2001:0DB8:72a:1936:2d49:83ed:d49a:6ffd user=root@pve msg=no such user ('root@pve')
+700 2001:0DB8:72a:1936:2d49:83ed:d49a:6ffd 6 10
+M
-- 
2.45.0

Re: [SSHGuard-users] Latest update check

[Jos C. <tri...@cl...>]

Kevin Zheng:
> I'm still troubleshooting the issue. As I mentioned, I'm a bit 
> confused why pkg is reporting this as an issue since libcap_net is 
> part of the FreeBSD base system.
>
> As long as SSHGuard appears to be working with you, I don't think this 
> issue is very serious. You can double check that you have libcap_net 
> located at that path, which you probably do because it's part of the 
> base system.

As far as I can check SSHGuard works ok.
Just checked FreeBSD 13.2-RELEASE-p4 and found the following casper 
related files:

/lib/casper
/lib/casper/libcap_dns.so.2
/lib/casper/libcap_fileargs.so.1
/lib/casper/libcap_grp.so.1
/lib/casper/libcap_net.so.1
/lib/casper/libcap_pwd.so.1
/lib/casper/libcap_sysctl.so.2
/lib/casper/libcap_syslog.so.1
/lib/libcasper.so.1

/usr/include/casper
/usr/include/casper/cap_dns.h
/usr/include/casper/cap_fileargs.h
/usr/include/casper/cap_grp.h
/usr/include/casper/cap_net.h
/usr/include/casper/cap_pwd.h
/usr/include/casper/cap_sysctl.h
/usr/include/casper/cap_syslog.h
/usr/include/libcasper.h
/usr/include/libcasper_service.h

/usr/lib/libcasper.so

/usr/local/lib/perl5/site_perl/mach/5.36/libcasper.ph
/usr/local/lib/perl5/site_perl/mach/5.36/libcasper_service.ph

/usr/share/man/man3/caph_enter_casper.3.gz
/usr/share/man/man3/libcasper.3.gz
/usr/share/man/man3/libcasper_service.3.gz

/usr/tests/lib/libcasper
/usr/tests/lib/libcasper/services
/usr/tests/lib/libcasper/services/cap_dns
/usr/tests/lib/libcasper/services/cap_grp
/usr/tests/lib/libcasper/services/cap_pwd
/usr/tests/lib/libcasper/services/cap_sysctl

Best, Jos

-- With both feed on the ground you can never make a step forward

Re: [SSHGuard-users] Latest update check

[Kevin Z. <kev...@gm...>]

Hi Jos,

On 11/11/23 12:43 PM, Jos Chrispijn wrote:
>> I've managed to reproduce the issue and will be investigating.
>> libcap_net.so.1 is typically provided by the base system, located e.g. 
>> at /lib/casper/libcap_net.so.1
> 
> Next week I will upgrade FreeBSD to v14-p5
> Might be that the libcap is added. Can you add it in the next sshguard 
> version or should I report this to BSD maintainer(s)?

I'm still troubleshooting the issue. As I mentioned, I'm a bit confused 
why pkg is reporting this as an issue since libcap_net is part of the 
FreeBSD base system.

As long as SSHGuard appears to be working with you, I don't think this 
issue is very serious. You can double check that you have libcap_net 
located at that path, which you probably do because it's part of the 
base system.

I'll let you know what I find.

Regards,
Kevin

Re: [SSHGuard-users] Latest update check

[Jos C. <tri...@cl...>]

Hi Kevin,
> Thanks for the report. This looks like a FreeBSD-specific issue 
> related to the latest release, which updated the Capsicum-sandboxed 
> DNS lookup to use libcasper.
>
> I've managed to reproduce the issue and will be investigating.
> libcap_net.so.1 is typically provided by the base system, located e.g. 
> at /lib/casper/libcap_net.so.1

Next week I will upgrade FreeBSD to v14-p5
Might be that the libcap is added. Can you add it in the next sshguard 
version or should I report this to BSD maintainer(s)?

Thanks
Jos

-- With both feed on the ground you can never make a step forward

Re: [SSHGuard-users] Latest update check

[Kevin Z. <kev...@gm...>]

Hi Jos.

On 11/8/23 7:07 AM, Jos Chrispijn via sshguard-users wrote:
> After the update of sshguard, I noticed this while running
> 
> # pkg check -Bdsr
> 
> (sshguard-2.4.3,1) /usr/local/libexec/sshg-blocker - required shared 
> library libcap_net.so.1 not found
> (sshguard-2.4.3,1) /usr/local/libexec/sshg-fw-hosts - required shared 
> library libcap_net.so.1 not found
> (sshguard-2.4.3,1) /usr/local/libexec/sshg-parser - required shared 
> library libcap_net.so.1 not found
> 
> Can you tell me if this is just due to the upgrade or should these 
> libraries have been updated during that upgrade?

Thanks for the report. This looks like a FreeBSD-specific issue related 
to the latest release, which updated the Capsicum-sandboxed DNS lookup 
to use libcasper.

I've managed to reproduce the issue and will be investigating.

libcap_net.so.1 is typically provided by the base system, located e.g. 
at /lib/casper/libcap_net.so.1

Regards,
Kevin

[SSHGuard-users] Latest update check

[Jos C. <tri...@cl...>]

After the update of sshguard, I noticed this while running

# pkg check -Bdsr

(sshguard-2.4.3,1) /usr/local/libexec/sshg-blocker - required shared 
library libcap_net.so.1 not found
(sshguard-2.4.3,1) /usr/local/libexec/sshg-fw-hosts - required shared 
library libcap_net.so.1 not found
(sshguard-2.4.3,1) /usr/local/libexec/sshg-parser - required shared 
library libcap_net.so.1 not found

Can you tell me if this is just due to the upgrade or should these 
libraries have been updated during that upgrade?

Best, Jos


-- With both feed on the ground you can never make a step forward

[SSHGuard-users] Alert latest update

[Jos C. <ssh...@cl...>]

Dear All,

After the update of sshguard, I noticed this while running

# pkg check -Bdsr

(sshguard-2.4.3,1) /usr/local/libexec/sshg-blocker - required shared 
library libcap_net.so.1 not found
(sshguard-2.4.3,1) /usr/local/libexec/sshg-fw-hosts - required shared 
library libcap_net.so.1 not found
(sshguard-2.4.3,1) /usr/local/libexec/sshg-parser - required shared 
library libcap_net.so.1 not found

Can you tell me if this is just due to the upgrade or should these 
libraries have been updated during that upgrade?

thanks for your comment,
Jos

-- With both feed on the ground you will never make a step forward

[SSHGuard-users] SSHGuard 2.4.3 release announcement

[Kevin Z. <kev...@gm...>]

Dear SSHGuard users,

SSHGuard 2.4.3 is now available on SourceForge:

https://sourceforge.net/projects/sshguard/files/sshguard/2.4.3/

This release adds and updates some attack signatures and corrects a 
whitelisting bug on 32-bit x86 and DNS resolution inside the FreeBSD 
capability sandbox.

If you are not impacted by either bug, and do not require the updated 
signatures, then this update is optional.

Added

- Add signature for BIND
- Add signature for Gitea
- Add signature for Microsoft SQL Server for Linux
- Add signature for OpenVPN Portshare
- Add signature for user-defined HTTP attacks
- Update signatures for Dovecot
- Update signatures for Postfix

Fixed

- Fix memset off-by-one (whitelisting on 32-bit x86)
- Resolve DNS names in capability mode using casper (FreeBSD)

Regards,
Kevin

Re: [SSHGuard-users] SSHGuard not capturing Dovecot's failed login lines?

[Kevin B. <kev...@gm...>]

On 2023/06/30 17:04, Özgür Kazancci wrote:
> 
> The following lines are not getting captured in /var/log/maillog file;
> ...
> Jun 30 01:38:57 mail dovecot: auth-worker(85069): conn
> unix:auth-worker (pid=88192,uid=518): auth-worker<4>:
> sql(in...@my...,41.22.15.12,<bLCwXEz/5apY7KF/>): Password mismatch
> Jun 30 01:39:00 mail dovecot: auth-worker(85069): conn
> unix:auth-worker (pid=88192,uid=518): auth-worker<5>:
> sql(in...@my...,41.22.15.12,<XbMaXUz/CqRY7KF/>): Password mismatch
> 
> ‌(I tried to create failed login attempts above through wrong
> passwords by using Outlook client)
> 
> P.S.: My sshguard.conf file contains; FILES="/var/log/authlog /var/log/maillog”
> 
> Any ideas would be much appreciated, many thanks!
> 

Are you able to checkout the SSHGuard source from the Git repo

    https://bitbucket.org/sshguard/sshguard.git

or otherwise access the source code?

If so, take a look at the file

   src/parser/attack_scanner.l

to see the format of the strings that are being looked for, eg:


/* get this instead: match invalid login @ Linux Ubuntu */
  /* "Failed password for validuser from 1.2.3.4 port 54609 ssh2" */
"Failed "[^ ]+" for "[^ ]+" from "                              { return SSH_LOGINERR_PREF; }

and where the current entry targetting Dovecot seems to be:

  /* dovecot */
("(libdovecot."[0-9\.]+".dylib) ")?(imap|pop3|submission)"-login: ""Info: "?("Aborted login"|Disconnected).*" (auth failed, "{NUMBER}" attempts".*"): ".+" rip=" { BEGIN(dovecot_loginerr); return DOVECOT_IMAP_LOGINERR_PREF; }
<dovecot_loginerr>", lip=".+                                        { BEGIN(INITIAL); return DOVECOT_IMAP_LOGINERR_SUFF; }

That might help you to construct an attack signature that matches
what you would like to trap.

Re: [SSHGuard-users] SSHGuard to fetch and ban Roundcube Webmail login attacks?

[Kevin Z. <kev...@gm...>]

Thank you for your reports and for filing the bugs on the Bitbucket 
tracker. If you don't mind, I'll respond to those on the tracker.

Regards,
Kevin

[SSHGuard-users] SSHGuard not capturing Dovecot's failed login lines?

[Özgür K. <ozg...@gm...>]

Hello there.

OS: OpenBSD 7.3
SSHGuard: 2.4.2

Sshguard runs ok with Sshd and Postfix, however not with Dovecot.

The following lines are not getting captured in /var/log/maillog file;

Jun 30 01:38:41 mail dovecot: auth-worker(85069): conn
unix:auth-worker (pid=88192,uid=518): auth-worker<1>:
sql(in...@my...,41.22.15.12,<bLCwXEz/5apY7KF/>): Password mismatch
Jun 30 01:38:49 mail dovecot: auth-worker(85069): conn
unix:auth-worker (pid=88192,uid=518): auth-worker<2>:
sql(in...@my...,41.22.15.12,<bLCwXEz/5apY7KF/>): Password mismatch
Jun 30 01:38:52 mail dovecot: auth-worker(85069): conn
unix:auth-worker (pid=88192,uid=518): auth-worker<3>:
sql(in...@my...,41.22.15.12,<XbMaXUz/CqRY7KF/>): Password mismatch
Jun 30 01:38:57 mail dovecot: auth-worker(85069): conn
unix:auth-worker (pid=88192,uid=518): auth-worker<4>:
sql(in...@my...,41.22.15.12,<bLCwXEz/5apY7KF/>): Password mismatch
Jun 30 01:39:00 mail dovecot: auth-worker(85069): conn
unix:auth-worker (pid=88192,uid=518): auth-worker<5>:
sql(in...@my...,41.22.15.12,<XbMaXUz/CqRY7KF/>): Password mismatch

‌(I tried to create failed login attempts above through wrong
passwords by using Outlook client)

P.S.: My sshguard.conf file contains; FILES="/var/log/authlog /var/log/maillog”

Any ideas would be much appreciated, many thanks!

[SSHGuard-users] SSHGuard to fetch and ban Roundcube Webmail login attacks?

[Özgür K. <ozg...@gm...>]

Hello there. First of all, thanks a lot for such a great security tool!

I’m using sshguard-2.4.2 on OpenBSD 7.3, so far, it recognizes sshd
logins, and also contents of the maillog file.

Additionally, I’d really like to add Roundcube Webmail’s login log
file as well, but I don’t really know how to do that.

My sshguard.conf file has currently;

“FILES="/var/log/authlog /var/log/maillog” line, and I tried to make it like;

FILES="/var/log/authlog /var/log/maillog /var/www/logs/roundcube/userlogins.log"

But that didn’t work, SSHGuard doesn’t see failed attempts within the
userlogins.log file.

Here’s the content of userlogins.log file (for both Successful login
and Failed login samples);

[28-Jun-2023 21:31:37 +0300]: <8olvcata> Successful login for
in...@my... (ID: 1) from 85.106.175.13 in session 8olvcataaln1drt7
[29-Jun-2023 10:29:34 +0300]: <4qrhf5r9> Successful login for
in...@my... (ID: 1) from 88.236.173.109 in session
4qrhf5r9m826g04q
[29-Jun-2023 10:42:35 +0300]: <kvhe82m4> Failed login for
te...@my... from 88.236.173.109 in session kvhe82m46sdgbq0r
(error: 0)
[29-Jun-2023 10:42:42 +0300]: <kvhe82m4> Failed login for
te...@my... from 88.236.173.109 in session kvhe82m46sdgbq0r
(error: -2)

As both successful and failed login lines are single lines, I think
SSHGuard could fetch them easily.

Could you kindly please let me know how to do that?

Many thanks in advance!

Re: [SSHGuard-users] OpenSMTPd lexer/parser broken

[B. A. G. <gro...@tc...>]

Kevin,

Thanks for the quick turn around. I've taken a closer look at the filter 
API, and I'm unsure about how exactly y'alls might want to proceed 
there. sshguard is fundamentally a "pull" type service gathering data 
from sources, whereas the smtpd filter API is a "push" type, where smtpd 
executes a long-running filter executable and pushes data to it, 
potentially expecting a response.

At a minimum, a plug will be needed that smtpd can execute, which would 
then place that data into a logfile or fifo that sshguard can read. (I 
think a fifo would be perfect for this, since no retention is needed for 
the data we want, as it would already be logged in maillog).

Since we have to have a separate plug executable, we come to the 
question of where one actually wants to do the parsing. It seems to me 
that it would be simpler to have the plug do the primary parsing via 
something like libopensmtpd rather than implement the full parser in 
sshguard. The plug would just output a simplified format added to the 
sshguard parser, e.g. "timestamp smtpd found-attack hostname.hostdomain 
127.0.0.1".

As for the actual API events in which sshguard would be interested, the 
following would seem to be the most likely candidates:

- link-connect: this contains among other information, a pass/fail 
variable on forward-confirmed reverse DNS. It is recommended by most to 
require FCrDNS to allow the connection to an MX to proceed, so it is 
reasonable to see a failure here as an attack indicator.

-link-auth: this event contains two variables, the username used for an 
authentication attempt, and a pass/fail/error. pass and error to be 
ignored, but fail should be seen as a possible attack.

In theory, one could also use filter-report/filter-response to monitor 
output from other filters, such-as filter-rspamd, so you could handle 
spam messages as an indicator as well, but that seems more than a little 
ambitious for the moment.

Overall, I don't see this as being particularly difficult to get 
working, but it certainly raises the complexity. Instead of allowing 
sshguard to simply do its job, this requires the user to also configure 
smtpd to assist in that matter. Having looked at the requirements for 
this, I'm not entirely convinced that it's something that should be 
done; the prudent action may simply be to update the documentation to 
say "OpenSMTPd support for version <=x.x", and move on.

Hope this helps,
B

Re: [SSHGuard-users] OpenSMTPd lexer/parser broken

[Kevin Z. <kev...@gm...>]

Hi there,

On 4/1/23 2:15 AM, B. Atticus Grobe via sshguard-users wrote:
> The lexer/parser for OpenSMTPd in sshguard is rather broken. It doesn't 
> seem to recognize anything at all from /var/log/maillog. I have verified 
> this using `/usr/local/libexec/sshg-parser -a' as mentioned in the man 
> pages.
> 
> This is all on OpenBSD 7.2 with the up-to-date syspatches and packages, 
> with sshguard being reported as v2.4.2, although I have confirmed that 
> even with HEAD the issue remains.

This is because OpenSMTPD changed their logging format since we first 
added them, and we haven't updated our attack signatures since.

Part of the reason why we've been slow to update the attack signature is 
that the log output is now split across two lines. SSHGuard's parser 
understands "one line, one attack."

OpenSMTPD developers have also expressed that we should be using the 
smtpd-filters API: https://man.openbsd.org/smtpd-filters.7

This is supposed to offer a stable output format. I haven't taken a look 
yet, but may do so soon. If you're able to look at this as a head start 
and write back with what it might take for SSHGuard to support this, 
please do let me know.

Thanks for reporting and for the log examples.

Regards,
Kevin

[SSHGuard-users] OpenSMTPd lexer/parser broken

[B. A. G. <gro...@tc...>]

Gents and Ladies,

The lexer/parser for OpenSMTPd in sshguard is rather broken. It doesn't 
seem to recognize anything at all from /var/log/maillog. I have verified 
this using `/usr/local/libexec/sshg-parser -a' as mentioned in the man 
pages.

This is all on OpenBSD 7.2 with the up-to-date syspatches and packages, 
with sshguard being reported as v2.4.2, although I have confirmed that 
even with HEAD the issue remains.

I'm making a partially anonymized maillog available to aid in debugging. 
The anonymization consists only of completely removing lines, no 
mangling. Everything remaining is exactly as OpenSMTPd wrote it. The log 
can be found at https://tcp80.org/maillog

I appreciate all the work y'alls have put into this, and it does work 
quite nicely with OpenSSHd, which helps cut down on issues.

Thanks,
B