Menu
▾
▴
sshguard-users — User questions and answers, bugs, and general support
You can subscribe to this list here.
| 2007 |
Jan
|
Feb
|
Mar
(10) |
Apr
(7) |
May
(6) |
Jun
(13) |
Jul
(4) |
Aug
|
Sep
|
Oct
(17) |
Nov
(5) |
Dec
(4) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2008 |
Jan
(2) |
Feb
|
Mar
|
Apr
(4) |
May
(2) |
Jun
(7) |
Jul
(10) |
Aug
(4) |
Sep
(14) |
Oct
|
Nov
(1) |
Dec
(7) |
| 2009 |
Jan
(17) |
Feb
(20) |
Mar
(11) |
Apr
(14) |
May
(8) |
Jun
(3) |
Jul
(22) |
Aug
(9) |
Sep
(8) |
Oct
(6) |
Nov
(4) |
Dec
(8) |
| 2010 |
Jan
(17) |
Feb
(9) |
Mar
(15) |
Apr
(24) |
May
(14) |
Jun
(1) |
Jul
(21) |
Aug
(6) |
Sep
(2) |
Oct
(2) |
Nov
(6) |
Dec
(9) |
| 2011 |
Jan
(11) |
Feb
(1) |
Mar
(3) |
Apr
(4) |
May
|
Jun
|
Jul
(2) |
Aug
(3) |
Sep
(2) |
Oct
(29) |
Nov
(1) |
Dec
(1) |
| 2012 |
Jan
(1) |
Feb
(1) |
Mar
|
Apr
(13) |
May
(4) |
Jun
(9) |
Jul
(2) |
Aug
(2) |
Sep
(1) |
Oct
(2) |
Nov
(11) |
Dec
(4) |
| 2013 |
Jan
(2) |
Feb
(2) |
Mar
(4) |
Apr
(13) |
May
(4) |
Jun
|
Jul
|
Aug
(1) |
Sep
(5) |
Oct
(3) |
Nov
(1) |
Dec
(3) |
| 2014 |
Jan
|
Feb
(3) |
Mar
(3) |
Apr
(6) |
May
(8) |
Jun
|
Jul
|
Aug
(1) |
Sep
(1) |
Oct
(3) |
Nov
(14) |
Dec
(8) |
| 2015 |
Jan
(16) |
Feb
(30) |
Mar
(20) |
Apr
(5) |
May
(33) |
Jun
(11) |
Jul
(15) |
Aug
(91) |
Sep
(23) |
Oct
(10) |
Nov
(7) |
Dec
(9) |
| 2016 |
Jan
(22) |
Feb
(8) |
Mar
(6) |
Apr
(23) |
May
(38) |
Jun
(29) |
Jul
(43) |
Aug
(43) |
Sep
(18) |
Oct
(8) |
Nov
(2) |
Dec
(25) |
| 2017 |
Jan
(38) |
Feb
(3) |
Mar
(1) |
Apr
|
May
(18) |
Jun
(2) |
Jul
(16) |
Aug
(2) |
Sep
|
Oct
(1) |
Nov
(4) |
Dec
(14) |
| 2018 |
Jan
(15) |
Feb
(2) |
Mar
(3) |
Apr
(5) |
May
(8) |
Jun
(12) |
Jul
(19) |
Aug
(16) |
Sep
(8) |
Oct
(13) |
Nov
(15) |
Dec
(10) |
| 2019 |
Jan
(9) |
Feb
(3) |
Mar
|
Apr
(2) |
May
|
Jun
(1) |
Jul
|
Aug
(5) |
Sep
(5) |
Oct
(12) |
Nov
(4) |
Dec
|
| 2020 |
Jan
(2) |
Feb
(6) |
Mar
|
Apr
|
May
(11) |
Jun
(1) |
Jul
(3) |
Aug
(22) |
Sep
(8) |
Oct
|
Nov
(2) |
Dec
|
| 2021 |
Jan
(7) |
Feb
|
Mar
(19) |
Apr
|
May
(10) |
Jun
(5) |
Jul
(7) |
Aug
(3) |
Sep
(1) |
Oct
|
Nov
(10) |
Dec
(4) |
| 2022 |
Jan
(17) |
Feb
|
Mar
(7) |
Apr
(3) |
May
|
Jun
(1) |
Jul
(3) |
Aug
|
Sep
|
Oct
(6) |
Nov
|
Dec
|
| 2023 |
Jan
|
Feb
(5) |
Mar
(1) |
Apr
(3) |
May
|
Jun
(3) |
Jul
(2) |
Aug
|
Sep
|
Oct
|
Nov
(6) |
Dec
|
| 2024 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(3) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2025 |
Jan
|
Feb
|
Mar
(15) |
Apr
(8) |
May
(10) |
Jun
|
Jul
|
Aug
|
Sep
(6) |
Oct
|
Nov
|
Dec
|
|
From: Kevin B. <kev...@gm...> - 2025-03-20 02:01:04
|
On 2025/03/20 02:52, Kevin Zheng wrote: > > Could you check that the attached patch fixes some of the build warnings > that you reported? The supplied patch has removed the warnings. > Regarding initgroups(): it seems like on BSD this is available in > unistd.h, but on Linux it requires sys/types.h and grp.h. Could you test > that this fixes the problem? > > Regarding asprintf(): This apparently requires defining the feature test > macro _GNU_SOURCE on Linux. Could you confirm that defining this fixes > the warning, and also doesn't break things? ISTRT that _GNU_SOURCE macro has been added in, for some other compatability, in other source files. I'll take a look at the remaining two and get back to you. Another Kevin |
|
From: Kevin Z. <kev...@gm...> - 2025-03-19 18:52:52
|
Hi Kevin, Thanks for your testing and feedback. > I have found that I can generate a tarball WITHOUT the doubled > directories if I make this change That's interesting. Neither `make dist` nor `make dist-bzip2` on my system results in these doubled directories. I wonder if something is subtly different about my system (because it's BSD)? You would think autoconf would pave over these differences... In any case, your suggested patch that removes the trailing / seems to work for me, so I'm inclined to accept it. Still, it would be good to understand what's going on... > And finally, in terms of HTH feedback, the compilation warning > messages from the rpmbuild on a SLES15sp5 system: just in case > you feel like tidying everything up! Could you check that the attached patch fixes some of the build warnings that you reported? Regarding initgroups(): it seems like on BSD this is available in unistd.h, but on Linux it requires sys/types.h and grp.h. Could you test that this fixes the problem? Regarding asprintf(): This apparently requires defining the feature test macro _GNU_SOURCE on Linux. Could you confirm that defining this fixes the warning, and also doesn't break things? Regards, Kevin |
|
From: Kevin B. <kev...@gm...> - 2025-03-19 08:36:27
|
On 2025/03/18 15:46, Kevin Buckley wrote:
> ...
> Deployed the RPM I was able to build to a test system.
>
> It seems to be working as expected, even more so now that I'm
> not trying to "intrude" from a whitelisted address !
And finally, in terms of HTH feedback, the compilation warning
messages from the rpmbuild on a SLES15sp5 system: just in case
you feel like tidying everything up!
This set appears twice,
make[2]: Entering directory '/usr/src/packages/BUILD/sshguard-2.5.0/src/blocker'
CC sandbox.o
make[3]: Entering directory '/usr/src/packages/BUILD/sshguard-2.5.0/src/parser'
CC sandbox.o
so presumably that componnet get rebuilt for the two functionalities
../common/sandbox.c: In function 'init_log':
../common/sandbox.c:14:18: warning: implicit declaration of function 'getenv'; did you mean 'getpw'? [-Wimplicit-function-declaration]
int debug = (getenv("SSHGUARD_DEBUG") != NULL);
^~~~~~
getpw
../common/sandbox.c:14:43: warning: comparison between pointer and integer
int debug = (getenv("SSHGUARD_DEBUG") != NULL);
^~
../common/sandbox.c:26:5: warning: implicit declaration of function 'tzset' [-Wimplicit-function-declaration]
tzset();
^~~~~
../common/sandbox.c: In function 'droproot':
../common/sandbox.c:33:9: warning: implicit declaration of function 'perror' [-Wimplicit-function-declaration]
perror("Could not find user");
^~~~~~
../common/sandbox.c:36:9: warning: implicit declaration of function 'initgroups'; did you mean 'getgroups'? [-Wimplicit-function-declaration]
if (initgroups(user, pw->pw_gid) == -1) {
^~~~~~~~~~
getgroups
../common/sandbox.c: In function 'sandbox_init':
../common/sandbox.c:48:18: warning: initialization makes pointer from integer without a cast [-Wint-conversion]
char *user = getenv("SSHGUARD_USER");
^~~~~~
and then there's one last singleton:
make[3]: Entering directory '/usr/src/packages/BUILD/sshguard-2.5.0/src/parser'
CC metrics.o
../common/metrics.c: In function 'metrics_init':
../common/metrics.c:30:9: warning: implicit declaration of function 'asprintf'; did you mean 'vsprintf'? [-Wimplicit-function-declaration]
if (asprintf(&stats_file_path, "%s/sshguard_%s.prom", stats_dir, name) < 0) {
^~~~~~~~
vsprintf
make[3]: Leaving directory '/usr/src/packages/BUILD/sshguard-2.5.0/src/parser'
Another Kevin
|
|
From: Kevin B. <kev...@gm...> - 2025-03-18 07:47:04
|
On 2025/03/18 11:10, Kevin Buckley wrote: > > I have found that I can generate a tarball WITHOUT the doubled > directories if I make this change > > > $ diff --git a/Makefile.am b/Makefile.am > index f0d58d4..21565c7 100644 > --- a/Makefile.am > +++ b/Makefile.am > @@ -1,6 +1,6 @@ > SUBDIRS = src > > -EXTRA_DIST = doc/ examples/ CHANGELOG.rst CONTRIBUTING.rst INSTALL.rst README.rst > +EXTRA_DIST = CHANGELOG.rst CONTRIBUTING.rst INSTALL.rst README.rst doc examples > dist_man_MANS = doc/sshguard-setup.7 doc/sshguard.8 > > if BUILD_MAN > > $ > > After which, a make dist-bzip has these files > > drwxrwxr-x 20480/20480 0 2025-03-17 16:10 sshguard-2.5.0/doc/ > -rw-rw-r-- 20480/20480 4838 2025-03-17 15:45 sshguard-2.5.0/doc/sshguard.8.rst > -rw-rw-r-- 20480/20480 10492 2025-03-17 16:10 sshguard-2.5.0/doc/sshguard-setup.7 > -rw-rw-r-- 20480/20480 673 2025-03-17 15:45 sshguard-2.5.0/doc/sshguard.dot > -rw-rw-r-- 20480/20480 5769 2025-03-17 16:10 sshguard-2.5.0/doc/sshguard.8 > -rw-rw-r-- 20480/20480 8514 2025-03-17 15:45 sshguard-2.5.0/doc/sshguard-setup.7.rst > > drwxrwxr-x 20480/20480 0 2025-03-17 15:45 sshguard-2.5.0/examples/ > -rw-rw-r-- 20480/20480 263 2025-03-17 15:45 sshguard-2.5.0/examples/whitelistfile.example > -rw-rw-r-- 20480/20480 392 2025-03-17 15:45 sshguard-2.5.0/examples/net.sshguard.plist > -rw-rw-r-- 20480/20480 2744 2025-03-17 15:45 sshguard-2.5.0/examples/sshguard.conf.sample > -rw-rw-r-- 20480/20480 348 2025-03-17 15:45 sshguard-2.5.0/examples/sshguard.service > > which I think is correct. Deployed the RPM I was able to build to a test system. It seems to be working as expected, even more so now that I'm not trying to "intrude" from a whitelisted address ! Another Kevin |
|
From: Kevin B. <kev...@gm...> - 2025-03-18 03:11:14
|
On 2025/03/17 16:17, Kevin Buckley wrote: > > Trouble with that is: there aren't any "pre-built man pages"? Ooh-err! > > However, if I install something that gives me rst2man, the > > make dist-bzi2 > > now runs through, but still generates a tarball with those > "doubled" doc and examples directories, which then can't be > used for an rpmbuild. > > HTH, > Another Kevin > > I have found that I can generate a tarball WITHOUT the doubled directories if I make this change $ diff --git a/Makefile.am b/Makefile.am index f0d58d4..21565c7 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,6 +1,6 @@ SUBDIRS = src -EXTRA_DIST = doc/ examples/ CHANGELOG.rst CONTRIBUTING.rst INSTALL.rst README.rst +EXTRA_DIST = CHANGELOG.rst CONTRIBUTING.rst INSTALL.rst README.rst doc examples dist_man_MANS = doc/sshguard-setup.7 doc/sshguard.8 if BUILD_MAN $ After which, a make dist-bzip has these files drwxrwxr-x 20480/20480 0 2025-03-17 16:10 sshguard-2.5.0/doc/ -rw-rw-r-- 20480/20480 4838 2025-03-17 15:45 sshguard-2.5.0/doc/sshguard.8.rst -rw-rw-r-- 20480/20480 10492 2025-03-17 16:10 sshguard-2.5.0/doc/sshguard-setup.7 -rw-rw-r-- 20480/20480 673 2025-03-17 15:45 sshguard-2.5.0/doc/sshguard.dot -rw-rw-r-- 20480/20480 5769 2025-03-17 16:10 sshguard-2.5.0/doc/sshguard.8 -rw-rw-r-- 20480/20480 8514 2025-03-17 15:45 sshguard-2.5.0/doc/sshguard-setup.7.rst drwxrwxr-x 20480/20480 0 2025-03-17 15:45 sshguard-2.5.0/examples/ -rw-rw-r-- 20480/20480 263 2025-03-17 15:45 sshguard-2.5.0/examples/whitelistfile.example -rw-rw-r-- 20480/20480 392 2025-03-17 15:45 sshguard-2.5.0/examples/net.sshguard.plist -rw-rw-r-- 20480/20480 2744 2025-03-17 15:45 sshguard-2.5.0/examples/sshguard.conf.sample -rw-rw-r-- 20480/20480 348 2025-03-17 15:45 sshguard-2.5.0/examples/sshguard.service which I think is correct. Another Kevin |
|
From: Kevin B. <kev...@gm...> - 2025-03-17 08:18:19
|
On 2025/03/17 15:22, Kevin Buckley wrote: > On the assumption that I might have coddled a few things along the way, I went back to the start and re-cloned the repo afresh, instead of the 'git pull' over the top of what I'd had in the working directory. $ autoreconf -i configure.ac:6: warning: 'AM_CONFIG_HEADER': this macro is obsolete. configure.ac:6: You should use the 'AC_CONFIG_HEADERS' macro instead. ./lib/autoconf/general.m4:2434: AC_DIAGNOSE is expanded from... aclocal.m4:859: AM_CONFIG_HEADER is expanded from... configure.ac:6: the top level configure.ac:15: warning: The macro `AC_PROG_CC_C99' is obsolete. configure.ac:15: You should run autoupdate. ./lib/autoconf/c.m4:1659: AC_PROG_CC_C99 is expanded from... configure.ac:15: the top level configure.ac:19: warning: AC_PROG_LEX without either yywrap or noyywrap is obsolete ./lib/autoconf/programs.m4:716: _AC_PROG_LEX is expanded from... ./lib/autoconf/programs.m4:709: AC_PROG_LEX is expanded from... aclocal.m4:728: AM_PROG_LEX is expanded from... configure.ac:19: the top level configure.ac:41: warning: AC_OUTPUT should be used without arguments. configure.ac:41: You should run autoupdate. configure.ac:18: installing './ar-lib' configure.ac:12: installing './compile' configure.ac:7: installing './install-sh' configure.ac:7: installing './missing' configure.ac:9: installing './tap-driver.sh' src/blocker/Makefile.am:5: warning: source file '../common/sandbox.c' is in a subdirectory, src/blocker/Makefile.am:5: but option 'subdir-objects' is disabled automake: warning: possible forward-incompatibility. automake: At least one source file is in a subdirectory, but the 'subdir-objects' automake: automake option hasn't been enabled. For now, the corresponding output automake: object file(s) will be placed in the top-level directory. However, this automake: behavior may change in a future Automake major version, with object automake: files being placed in the same subdirectory as the corresponding sources. automake: You are advised to start using 'subdir-objects' option throughout your automake: project, to avoid future incompatibilities. src/blocker/Makefile.am:5: warning: source file '../common/service_names.c' is in a subdirectory, src/blocker/Makefile.am:5: but option 'subdir-objects' is disabled src/blocker/Makefile.am:5: warning: source file '../common/simclist.c' is in a subdirectory, src/blocker/Makefile.am:5: but option 'subdir-objects' is disabled src/blocker/Makefile.am: installing './depcomp' src/fw/Makefile.am:26: warning: source file '../common/simclist.c' is in a subdirectory, src/fw/Makefile.am:26: but option 'subdir-objects' is disabled src/parser/Makefile.am:15: warning: source file '../common/metrics.c' is in a subdirectory, src/parser/Makefile.am:15: but option 'subdir-objects' is disabled src/parser/Makefile.am:15: warning: source file '../common/sandbox.c' is in a subdirectory, src/parser/Makefile.am:15: but option 'subdir-objects' is disabled configure.ac: installing './ylwrap' parallel-tests: installing './test-driver' $ $ ./configure ... configure: WARNING: rst2man not found; using pre-built man pages ... $ $ make dist-bzip2 make distdir-am make[1]: Entering directory '/path/to/SSHGuard/Git/sshguard' make[1]: *** No rule to make target 'doc/sshguard-setup.7', needed by 'distdir-am'. Stop. make[1]: Leaving directory '/path/to/SSHGuard/Git/sshguard' make: *** [Makefile:580: distdir] Error 2 $ Trouble with that is: there aren't any "pre-built man pages"? Ooh-err! However, if I install something that gives me rst2man, the make dist-bzi2 now runs through, but still generates a tarball with those "doubled" doc and examples directories, which then can't be used for an rpmbuild. HTH, Another Kevin |
|
From: Kevin B. <kev...@gm...> - 2025-03-17 07:23:13
|
On 2025/03/17 15:06, Kevin Buckley wrote: > On 2025/03/16 15:23, Kevin Zheng wrote: >> Dear SSHGuard users and maintainers, >> >> It has been some time since the last versioned SSHGuard release, and >> it's time to cut a new version for the benefit of packagers and users. >> >> If you are able and comfortable to compile from source and deploy on >> test/production systems, your early testing and feedback is appreciated >> so that we can squash any late-breaking bugs before the release. >> >> You can check out a copy of the release candidate code from: >> >> https://bitbucket.org/sshguard/sshguard.git >> > > Further to my question about the SPEC-file, > > I "git pulled" from the repo and ran a > > make dist-bzip2 > > so as to get a tarball to use against an existing distro's SPEC-file, > which I'd tweak for the 2.5.0 release. > > > It looks as though the generated tarball has doubled up on the > examples directory? > > $ tar tvf sshguard-2.5.0.tar.bz2 > ... > -rw-rw-r-- 20480/20480 1021 2020-01-22 10:31 sshguard-2.5.0/COPYING > drwxrwxr-x 20480/20480 0 2025-03-17 09:45 sshguard-2.5.0/examples/ > drwxrwxr-x 20480/20480 0 2025-03-17 09:40 sshguard-2.5.0/examples/examples/ > -rw-rw-r-- 20480/20480 263 2020-01-22 10:31 sshguard-2.5.0/examples/examples/whitelistfile.example > -rw-rw-r-- 20480/20480 392 2021-12-02 08:53 sshguard-2.5.0/examples/examples/net.sshguard.plist > -rw-rw-r-- 20480/20480 2744 2025-03-17 09:40 sshguard-2.5.0/examples/examples/sshguard.conf.sample > -rw-rw-r-- 20480/20480 348 2024-06-24 15:03 sshguard-2.5.0/examples/examples/sshguard.service > -rw-rw-r-- 20480/20480 1423 2025-03-17 09:40 sshguard-2.5.0/configure.ac > ... > > which came to light when the "harden patch" didn't apply, > as it was expecting just the single depth there: > > $ head -r harden_sshguard.service.patch > Index: sshguard-2.4.3/examples/sshguard.service > =================================================================== > --- sshguard-2.4.3.orig/examples/sshguard.service > +++ sshguard-2.4.3/examples/sshguard.service > @@ -9,6 +9,19 @@ After=libvirtd.service > $ > > There's no doubling visible in the working copy. > > Not sure, as yet, where that "doubling" has come from. Looks as though that dist-bzip2 Makefile target is also doubling the doc subdir, albeit in a subtly different way: -rwxr-xr-x 20480/20480 4640 2021-12-02 08:55 sshguard-2.5.0/test-driver drwxrwxr-x 20480/20480 0 2025-03-17 15:18 sshguard-2.5.0/doc/ -rw-rw-r-- 20480/20480 10488 2021-12-02 08:55 sshguard-2.5.0/doc/sshguard-setup.7 -rw-rw-r-- 20480/20480 5369 2021-12-02 08:55 sshguard-2.5.0/doc/sshguard.8 drwxrwxr-x 20480/20480 0 2025-03-17 09:40 sshguard-2.5.0/doc/doc/ -rw-rw-r-- 20480/20480 4838 2025-03-17 09:40 sshguard-2.5.0/doc/doc/sshguard.8.rst -rw-rw-r-- 20480/20480 10488 2021-12-02 08:55 sshguard-2.5.0/doc/doc/sshguard-setup.7 -rw-rw-r-- 20480/20480 673 2021-12-02 08:53 sshguard-2.5.0/doc/doc/sshguard.dot -rw-rw-r-- 20480/20480 5369 2021-12-02 08:55 sshguard-2.5.0/doc/doc/sshguard.8 -rw-rw-r-- 20480/20480 8514 2025-03-17 09:40 sshguard-2.5.0/doc/doc/sshguard-setup.7.rst -rwxr-xr-x 20480/20480 5826 2021-12-02 08:55 sshguard-2.5.0/ar-lib HTH, Another Kevin |
|
From: Kevin B. <kev...@gm...> - 2025-03-17 07:07:08
|
On 2025/03/16 15:23, Kevin Zheng wrote: > Dear SSHGuard users and maintainers, > > It has been some time since the last versioned SSHGuard release, and > it's time to cut a new version for the benefit of packagers and users. > > If you are able and comfortable to compile from source and deploy on > test/production systems, your early testing and feedback is appreciated > so that we can squash any late-breaking bugs before the release. > > You can check out a copy of the release candidate code from: > > https://bitbucket.org/sshguard/sshguard.git > Further to my question about the SPEC-file, I "git pulled" from the repo and ran a make dist-bzip2 so as to get a tarball to use against an existing distro's SPEC-file, which I'd tweak for the 2.5.0 release. It looks as though the generated tarball has doubled up on the examples directory? $ tar tvf sshguard-2.5.0.tar.bz2 ... -rw-rw-r-- 20480/20480 1021 2020-01-22 10:31 sshguard-2.5.0/COPYING drwxrwxr-x 20480/20480 0 2025-03-17 09:45 sshguard-2.5.0/examples/ drwxrwxr-x 20480/20480 0 2025-03-17 09:40 sshguard-2.5.0/examples/examples/ -rw-rw-r-- 20480/20480 263 2020-01-22 10:31 sshguard-2.5.0/examples/examples/whitelistfile.example -rw-rw-r-- 20480/20480 392 2021-12-02 08:53 sshguard-2.5.0/examples/examples/net.sshguard.plist -rw-rw-r-- 20480/20480 2744 2025-03-17 09:40 sshguard-2.5.0/examples/examples/sshguard.conf.sample -rw-rw-r-- 20480/20480 348 2024-06-24 15:03 sshguard-2.5.0/examples/examples/sshguard.service -rw-rw-r-- 20480/20480 1423 2025-03-17 09:40 sshguard-2.5.0/configure.ac ... which came to light when the "harden patch" didn't apply, as it was expecting just the single depth there: $ head -r harden_sshguard.service.patch Index: sshguard-2.4.3/examples/sshguard.service =================================================================== --- sshguard-2.4.3.orig/examples/sshguard.service +++ sshguard-2.4.3/examples/sshguard.service @@ -9,6 +9,19 @@ After=libvirtd.service $ There's no doubling visible in the working copy. Not sure, as yet, where that "doubling" has come from. Another Kevin |
|
From: Kevin B. <kev...@gm...> - 2025-03-17 04:01:53
|
On 2025/03/16 15:23, Kevin Zheng wrote: > Dear SSHGuard users and maintainers, > > It has been some time since the last versioned SSHGuard release, and > it's time to cut a new version for the benefit of packagers and users. > > If you are able and comfortable to compile from source and deploy on > test/production systems, your early testing and feedback is appreciated > so that we can squash any late-breaking bugs before the release. > > You can check out a copy of the release candidate code from: > > https://bitbucket.org/sshguard/sshguard.git Didn't there use to be an sshguard.spec file in the repo, against which to do an rpmbuild? Or were they only ever created by the packagers for any given specific distro, in which case you'ld need to get them out of a previous src.rpm ? Another Kevin |
|
From: Kevin Z. <kev...@gm...> - 2025-03-16 07:24:03
|
Dear SSHGuard users and maintainers, It has been some time since the last versioned SSHGuard release, and it's time to cut a new version for the benefit of packagers and users. If you are able and comfortable to compile from source and deploy on test/production systems, your early testing and feedback is appreciated so that we can squash any late-breaking bugs before the release. You can check out a copy of the release candidate code from: https://bitbucket.org/sshguard/sshguard.git The two main changes are: 1. Non-privileged processes such as the parser can now switch users after starting. Previously, they only used OS-level sandboxing mechanisms if available (Capsicum on FreeBSD and pledge on OpenBSD). 2. The web log (CLF) parser was refactored to fix some false positives and provide flexibility in defining new attacks. While the new web log parser passes all existing and new tests, there may be some regressions in cases that are not currently covered by tests. The draft change log is below: **Added** - Add attack signatures for Proxmox VE - Update signatures for: - Cyrus - Exim - OpenSSH - Postfix - Add option to write Prometheus-compatible metrics - Add option to change sandboxable-processes to an unprivileged user **Changed** - Any HTTP 401 response is now recognized as an attack - Code improvements in in log banner and web (CLF) parsers. If there are regressions, please file a bug report with example attacks so that they can be added to our tests. **Fixed** - Fix configure issues when the shell is not bash - Fix false positives in web (CLF) log detection with "mail" in the request Your efforts in testing the release candidate are appreciated! Regards, Kevin |
|
From: Kevin Z. <kev...@gm...> - 2025-03-16 07:11:00
|
Hi Hendrik, On 3/15/25 1:34 PM, Hendrik Visage wrote: > Would it be possible to release a new tagged release? At least I’m > interested in the ProxMox PVE rules included for those PVEs I can’t > secure behind OOB networks… for reasons ... ;( > > Would help to get it in the next Debian release too :)=) As the FreeBSD package maintainer myself, I understand the need for versioned releases to make it into package systems. I intended to cut a release in January this year (as you can see from the version string bump to 2.5.0), but I haven't put together the release yet. Let me go ahead and do that now. Regards, Kevin |
|
From: Hendrik V. <hv...@he...> - 2025-03-16 03:41:17
|
Good day, Project *seems* stagnant with no new releases the past 2years ;( Would it be possible to release a new tagged release? At least I’m interested in the ProxMox PVE rules included for those PVEs I can’t secure behind OOB networks… for reasons ... ;( Would help to get it in the next Debian release too :)=) Hendrik --- Hendrik Visage hv...@he... HeViS.Co Systems Pty Ltd https://www.envisage.co.za |
|
From: Kevin Z. <kev...@gm...> - 2025-03-09 02:02:12
|
Hi Jos, At this moment, I believe it is a false positive. libcap_net.so.1, of course, is provided by the FreeBSD base system in /lib/casper. It is possible that because this is a non-standard library search path, tools like pkg aren't correctly finding the shared library? I would need to do more testing/digging to come up with a definite answer, though. There is now a forum post about this issue: https://forums.freebsd.org/threads/sshguard-is-missing-a-required-shared-library-libcap_net-so-1.96989/ In the meantime, this issue does not affect SSHGuard being able to work correctly. Regards, Kevin |
|
From: Jos C. <ssh...@cl...> - 2025-03-08 15:15:30
|
Hi Kev, Hope you are well. Just upgrade FreeBSD to 13.5-RELEASE and got this error after running %> pkg check -d sshguard Checking sshguard: 100% sshguard is missing a required shared library: libcap_net.so.1 Can remember we had this issue earlier but disappeared in BSD 13.4 Can you offer an workaround? Thanks and keep up the good work! Best, Jos Jos Chrispijn: > Hi, thank you both. > > Best regards, > Jos > > Kevin Zheng: >> Hi Christoph, >> >> Thanks for the patch. Happy to include this attack signature for >> Proxmox VE in SSHGuard. >> >> I'm glad you found the documentation useful. >> >> I made a small adjustment to your patch. In attack_scanner.l the >> attack signatures for the "unknown user" case overlap with those for >> the known user, so everything still works when I remove the two lines >> for the unknown user case. >> >> I've committed this and this will be available in the next release. >> >> Thanks again for your contribution! > Best regards, Jos |
|
From: Jos C. <jo...@cl...> - 2024-05-09 22:01:19
|
Hi, thank you both. Best regards, Jos Kevin Zheng: > Hi Christoph, > > Thanks for the patch. Happy to include this attack signature for > Proxmox VE in SSHGuard. > > I'm glad you found the documentation useful. > > I made a small adjustment to your patch. In attack_scanner.l the > attack signatures for the "unknown user" case overlap with those for > the known user, so everything still works when I remove the two lines > for the unknown user case. > > I've committed this and this will be available in the next release. > > Thanks again for your contribution! |
|
From: Kevin Z. <kev...@gm...> - 2024-05-09 18:25:20
|
Hi Christoph, Thanks for the patch. Happy to include this attack signature for Proxmox VE in SSHGuard. I'm glad you found the documentation useful. I made a small adjustment to your patch. In attack_scanner.l the attack signatures for the "unknown user" case overlap with those for the known user, so everything still works when I remove the two lines for the unknown user case. I've committed this and this will be available in the next release. Thanks again for your contribution! Thanks, Kevin |
|
From: <de...@kl...> - 2024-05-05 08:16:20
|
Dear all, please find attached a parser for evaluating authentication failure from pvedaemon, a major part of Proxmox Virtual Environment. (https://proxmox.com/en/proxmox-virtual-environment/overview) This parser ist based upon information in the Proxmox wiki (parser & jail for Fail2Ban) as well as some real-world auth errors I've generated myself. :) Additionally, I've attached the logs from running make check. Hopefully this all will be of some use for you. Notes on myself : I'm working as full-time sysadmin and we are evaluating using Proxmox at work. In private I'm using Proxmox since about 1.5 years. As I myself prefer sshguard over Fail2Ban due to it being way faster and for me easier to understand and implement. The instruction on how to contribute on the website is quite well thus I've decided to try to add this parser myself. Quite surprised it went that well at all. Nevertheless please bear with me it's my very first patch file ever. kind regards Christoph ---------------------------------------- >From 50bdd556f457bc42a1112d844a9b186ec4412881 Mon Sep 17 00:00:00 2001 From: chrkli <de...@kl...> Date: Sun, 5 May 2024 03:18:08 +0200 Subject: [PATCH] add parser for Proxmox VE based on information found on Proxmox wiki in regard to Fail2Ban, see https://pve.proxmox.com/wiki/Fail2ban#Filter_Config note: only parses messages from pvedaemon, does NOT consider additionally thrown auth_pam error when using realm "PAM" inside Proxmox VE webapp --- src/common/attack.h | 1 + src/common/service_names.c | 1 + src/parser/attack_parser.y | 8 ++++++++ src/parser/attack_scanner.l | 10 +++++++++- src/parser/tests.txt | 16 ++++++++++++++++ 5 files changed, 35 insertions(+), 1 deletion(-) diff --git a/src/common/attack.h b/src/common/attack.h index e7e4896..d19945c 100644 --- a/src/common/attack.h +++ b/src/common/attack.h @@ -50,6 +50,7 @@ enum service { SERVICES_OPENVPN_PS = 410, //< OpenVPN Portshare SERVICES_GITEA = 500, //< Gitea SERVICES_MSSQL = 600, //< Microsoft SQL Server for Linux + SERVICES_PROXMOXVE = 700, //< Proxmox VE }; /* an attack (source address & target service info) */ diff --git a/src/common/service_names.c b/src/common/service_names.c index bbc4d69..174c57c 100644 --- a/src/common/service_names.c +++ b/src/common/service_names.c @@ -29,6 +29,7 @@ static const struct service_s services[] = { {SERVICES_GITEA, "Gitea"}, {SERVICES_OPENVPN_PS, "OpenVPN Portshare"}, {SERVICES_MSSQL, "MSSQL"}, + {SERVICES_PROXMOXVE, "Proxmox VE"}, }; const char *service_to_name(enum service code) { diff --git a/src/parser/attack_parser.y b/src/parser/attack_parser.y index 601d81c..d632ac9 100644 --- a/src/parser/attack_parser.y +++ b/src/parser/attack_parser.y @@ -119,6 +119,8 @@ static void yyerror(attack_t *, const char *); %token OPENVPN_PS_TERM_SUFF /* MSSQL */ %token MSSQL_AUTHFAIL_PREF +/* Proxmox VE */ +%token PROXMOXVE_AUTHFAIL_PREF PROXMOXVE_AUTHFAIL_SUFF %% @@ -195,6 +197,7 @@ msg_single: | giteamsg { attack->service = SERVICES_GITEA; } | openvpnpsmsg { attack->service = SERVICES_OPENVPN_PS; } | sqlservrmsg { attack->service = SERVICES_MSSQL; } + | proxmoxvemsg { attack->service = SERVICES_PROXMOXVE; } ; /* an address */ @@ -390,6 +393,11 @@ openvpnpsmsg: | OPENVPN_PS_TERM_PREF '[' addr ']' OPENVPN_PS_TERM_SUFF ; + /* attack rules for Proxmox VE */ +proxmoxvemsg: + PROXMOXVE_AUTHFAIL_PREF addr PROXMOXVE_AUTHFAIL_SUFF + ; + %% static void yyerror(__attribute__((unused)) attack_t *a, diff --git a/src/parser/attack_scanner.l b/src/parser/attack_scanner.l index a7c2a33..c7a4913 100644 --- a/src/parser/attack_scanner.l +++ b/src/parser/attack_scanner.l @@ -37,7 +37,7 @@ static int getsyslogpid(char *syslogbanner, int length); /* Start Conditions */ /* for Login services */ -%s ssh_notallowed ssh_reversemap ssh_disconnect ssh_badproto ssh_invalid_format ssh_badkex cockpit_authfail +%s ssh_notallowed ssh_reversemap ssh_disconnect ssh_badproto ssh_invalid_format ssh_badkex cockpit_authfail proxmoxve_authfail /* for SSHGuard */ %s sshguard_attack sshguard_block %s bind @@ -344,6 +344,14 @@ HTTP_LOGIN_200OK_BAD .*({WORDPRESS_LOGIN}|{TYPO3_LOGIN}|{CONTAO_LOGIN}).* "Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. [CLIENT: " { return MSSQL_AUTHFAIL_PREF; } "Length specified in network packet payload did not match number of bytes read; the connection has been closed. Please contact the vendor of the client library. [CLIENT: " { return MSSQL_AUTHFAIL_PREF; } + /* Proxmox VE */ + /* failed authentication */ +"authentication failure; rhost=" { BEGIN(proxmoxve_authfail); return PROXMOXVE_AUTHFAIL_PREF; } +<proxmoxve_authfail>" "+"user=".+" "+"msg=".+ { BEGIN(INITIAL); return PROXMOXVE_AUTHFAIL_SUFF; } + /* unknown internal user */ +"authentication failure; rhost=" { BEGIN(proxmoxve_authfail); return PROXMOXVE_AUTHFAIL_PREF; } +<proxmoxve_authfail>" "+"user=".+" "+"msg=no such user ('".+"')" { BEGIN(INITIAL); return PROXMOXVE_AUTHFAIL_SUFF; } + /** COMMON-USE TOKENS do not touch these **/ /* an IPv4 address */ {IPV4} { yylval.str = yytext; return IPv4; } diff --git a/src/parser/tests.txt b/src/parser/tests.txt index bd610fe..4ee143c 100644 --- a/src/parser/tests.txt +++ b/src/parser/tests.txt @@ -597,3 +597,19 @@ M 600 198.199.105.106 4 10 M +#### Proxmox VE +May 04 23:45:19 deb12-pve pvedaemon[2352]: authentication failure; rhost=::ffff:192.0.2.74 user=tester@pve msg=Authentication failure +700 192.0.2.74 4 10 +M +May 05 00:11:56 deb12-pve pvedaemon[2350]: authentication failure; rhost=2001:0DB8:72a:1936:2d49:83ed:d49a:6ffd user=root@pam msg=Authentication failure +700 2001:0DB8:72a:1936:2d49:83ed:d49a:6ffd 6 10 +M +May 05 00:07:09 deb12-pve pvedaemon[2351]: authentication failure; rhost=::ffff:192.0.2.154 user=tester2@pam msg=no such user ('tester2@pam') +700 192.0.2.154 4 10 +M +May 05 00:08:19 deb12-pve pvedaemon[2352]: authentication failure; rhost=::ffff:192.0.2.7 user=tester3@pve msg=no such user ('tester3@pve') +700 192.0.2.7 4 10 +M +May 05 00:12:11 deb12-pve pvedaemon[2352]: authentication failure; rhost=2001:0DB8:72a:1936:2d49:83ed:d49a:6ffd user=root@pve msg=no such user ('root@pve') +700 2001:0DB8:72a:1936:2d49:83ed:d49a:6ffd 6 10 +M -- 2.45.0 |
|
From: Jos C. <tri...@cl...> - 2023-11-11 20:55:42
|
Kevin Zheng: > I'm still troubleshooting the issue. As I mentioned, I'm a bit > confused why pkg is reporting this as an issue since libcap_net is > part of the FreeBSD base system. > > As long as SSHGuard appears to be working with you, I don't think this > issue is very serious. You can double check that you have libcap_net > located at that path, which you probably do because it's part of the > base system. As far as I can check SSHGuard works ok. Just checked FreeBSD 13.2-RELEASE-p4 and found the following casper related files: /lib/casper /lib/casper/libcap_dns.so.2 /lib/casper/libcap_fileargs.so.1 /lib/casper/libcap_grp.so.1 /lib/casper/libcap_net.so.1 /lib/casper/libcap_pwd.so.1 /lib/casper/libcap_sysctl.so.2 /lib/casper/libcap_syslog.so.1 /lib/libcasper.so.1 /usr/include/casper /usr/include/casper/cap_dns.h /usr/include/casper/cap_fileargs.h /usr/include/casper/cap_grp.h /usr/include/casper/cap_net.h /usr/include/casper/cap_pwd.h /usr/include/casper/cap_sysctl.h /usr/include/casper/cap_syslog.h /usr/include/libcasper.h /usr/include/libcasper_service.h /usr/lib/libcasper.so /usr/local/lib/perl5/site_perl/mach/5.36/libcasper.ph /usr/local/lib/perl5/site_perl/mach/5.36/libcasper_service.ph /usr/share/man/man3/caph_enter_casper.3.gz /usr/share/man/man3/libcasper.3.gz /usr/share/man/man3/libcasper_service.3.gz /usr/tests/lib/libcasper /usr/tests/lib/libcasper/services /usr/tests/lib/libcasper/services/cap_dns /usr/tests/lib/libcasper/services/cap_grp /usr/tests/lib/libcasper/services/cap_pwd /usr/tests/lib/libcasper/services/cap_sysctl Best, Jos -- With both feed on the ground you can never make a step forward |
|
From: Kevin Z. <kev...@gm...> - 2023-11-11 20:45:14
|
Hi Jos, On 11/11/23 12:43 PM, Jos Chrispijn wrote: >> I've managed to reproduce the issue and will be investigating. >> libcap_net.so.1 is typically provided by the base system, located e.g. >> at /lib/casper/libcap_net.so.1 > > Next week I will upgrade FreeBSD to v14-p5 > Might be that the libcap is added. Can you add it in the next sshguard > version or should I report this to BSD maintainer(s)? I'm still troubleshooting the issue. As I mentioned, I'm a bit confused why pkg is reporting this as an issue since libcap_net is part of the FreeBSD base system. As long as SSHGuard appears to be working with you, I don't think this issue is very serious. You can double check that you have libcap_net located at that path, which you probably do because it's part of the base system. I'll let you know what I find. Regards, Kevin |
|
From: Jos C. <tri...@cl...> - 2023-11-11 20:42:16
|
Hi Kevin, > Thanks for the report. This looks like a FreeBSD-specific issue > related to the latest release, which updated the Capsicum-sandboxed > DNS lookup to use libcasper. > > I've managed to reproduce the issue and will be investigating. > libcap_net.so.1 is typically provided by the base system, located e.g. > at /lib/casper/libcap_net.so.1 Next week I will upgrade FreeBSD to v14-p5 Might be that the libcap is added. Can you add it in the next sshguard version or should I report this to BSD maintainer(s)? Thanks Jos -- With both feed on the ground you can never make a step forward |
|
From: Kevin Z. <kev...@gm...> - 2023-11-08 19:19:32
|
Hi Jos. On 11/8/23 7:07 AM, Jos Chrispijn via sshguard-users wrote: > After the update of sshguard, I noticed this while running > > # pkg check -Bdsr > > (sshguard-2.4.3,1) /usr/local/libexec/sshg-blocker - required shared > library libcap_net.so.1 not found > (sshguard-2.4.3,1) /usr/local/libexec/sshg-fw-hosts - required shared > library libcap_net.so.1 not found > (sshguard-2.4.3,1) /usr/local/libexec/sshg-parser - required shared > library libcap_net.so.1 not found > > Can you tell me if this is just due to the upgrade or should these > libraries have been updated during that upgrade? Thanks for the report. This looks like a FreeBSD-specific issue related to the latest release, which updated the Capsicum-sandboxed DNS lookup to use libcasper. I've managed to reproduce the issue and will be investigating. libcap_net.so.1 is typically provided by the base system, located e.g. at /lib/casper/libcap_net.so.1 Regards, Kevin |
|
From: Jos C. <tri...@cl...> - 2023-11-08 15:05:44
|
After the update of sshguard, I noticed this while running # pkg check -Bdsr (sshguard-2.4.3,1) /usr/local/libexec/sshg-blocker - required shared library libcap_net.so.1 not found (sshguard-2.4.3,1) /usr/local/libexec/sshg-fw-hosts - required shared library libcap_net.so.1 not found (sshguard-2.4.3,1) /usr/local/libexec/sshg-parser - required shared library libcap_net.so.1 not found Can you tell me if this is just due to the upgrade or should these libraries have been updated during that upgrade? Best, Jos -- With both feed on the ground you can never make a step forward |
|
From: Jos C. <ssh...@cl...> - 2023-11-08 13:36:09
|
Dear All, After the update of sshguard, I noticed this while running # pkg check -Bdsr (sshguard-2.4.3,1) /usr/local/libexec/sshg-blocker - required shared library libcap_net.so.1 not found (sshguard-2.4.3,1) /usr/local/libexec/sshg-fw-hosts - required shared library libcap_net.so.1 not found (sshguard-2.4.3,1) /usr/local/libexec/sshg-parser - required shared library libcap_net.so.1 not found Can you tell me if this is just due to the upgrade or should these libraries have been updated during that upgrade? thanks for your comment, Jos -- With both feed on the ground you will never make a step forward |
|
From: Kevin Z. <kev...@gm...> - 2023-07-05 17:52:40
|
Dear SSHGuard users, SSHGuard 2.4.3 is now available on SourceForge: https://sourceforge.net/projects/sshguard/files/sshguard/2.4.3/ This release adds and updates some attack signatures and corrects a whitelisting bug on 32-bit x86 and DNS resolution inside the FreeBSD capability sandbox. If you are not impacted by either bug, and do not require the updated signatures, then this update is optional. Added - Add signature for BIND - Add signature for Gitea - Add signature for Microsoft SQL Server for Linux - Add signature for OpenVPN Portshare - Add signature for user-defined HTTP attacks - Update signatures for Dovecot - Update signatures for Postfix Fixed - Fix memset off-by-one (whitelisting on 32-bit x86) - Resolve DNS names in capability mode using casper (FreeBSD) Regards, Kevin |
|
From: Kevin B. <kev...@gm...> - 2023-07-03 02:25:56
|
On 2023/06/30 17:04, Özgür Kazancci wrote:
>
> The following lines are not getting captured in /var/log/maillog file;
> ...
> Jun 30 01:38:57 mail dovecot: auth-worker(85069): conn
> unix:auth-worker (pid=88192,uid=518): auth-worker<4>:
> sql(in...@my...,41.22.15.12,<bLCwXEz/5apY7KF/>): Password mismatch
> Jun 30 01:39:00 mail dovecot: auth-worker(85069): conn
> unix:auth-worker (pid=88192,uid=518): auth-worker<5>:
> sql(in...@my...,41.22.15.12,<XbMaXUz/CqRY7KF/>): Password mismatch
>
> (I tried to create failed login attempts above through wrong
> passwords by using Outlook client)
>
> P.S.: My sshguard.conf file contains; FILES="/var/log/authlog /var/log/maillog”
>
> Any ideas would be much appreciated, many thanks!
>
Are you able to checkout the SSHGuard source from the Git repo
https://bitbucket.org/sshguard/sshguard.git
or otherwise access the source code?
If so, take a look at the file
src/parser/attack_scanner.l
to see the format of the strings that are being looked for, eg:
/* get this instead: match invalid login @ Linux Ubuntu */
/* "Failed password for validuser from 1.2.3.4 port 54609 ssh2" */
"Failed "[^ ]+" for "[^ ]+" from " { return SSH_LOGINERR_PREF; }
and where the current entry targetting Dovecot seems to be:
/* dovecot */
("(libdovecot."[0-9\.]+".dylib) ")?(imap|pop3|submission)"-login: ""Info: "?("Aborted login"|Disconnected).*" (auth failed, "{NUMBER}" attempts".*"): ".+" rip=" { BEGIN(dovecot_loginerr); return DOVECOT_IMAP_LOGINERR_PREF; }
<dovecot_loginerr>", lip=".+ { BEGIN(INITIAL); return DOVECOT_IMAP_LOGINERR_SUFF; }
That might help you to construct an attack signature that matches
what you would like to trap.
|
2 messages has been excluded from this view by a project administrator.
