sshguard-users — User questions and answers, bugs, and general support

Re: [SSHGuard-users] OpenSMTPD and SSHGuard?

[Júlio M. <ju...@ma...>]

On 26 May 2018 at 19:41, Gary <li...@la...> wrote:
> But getting back to SSHGuard, I never understood how to use it for both ssh and email ports.

It's all about logs. No port are monitored by SSHGuard, I presume.

> They are different attacks.

Yes. Different objectives, apps and logs. But SSHGuard is not only
ssh. It's actually a "MultiAppGuard" as writen in the website.

> Just because some server is attacking ssh, do I really want to block that server's email?

I didn't understand your doubt. But to clarify my case, I want to
monitor three apps: an IMAP, an SMTP and an SSH server. SSHGuard (and
Fail2Ban) method is to read and analyze the respective log files. What
these apps have in common? Run in the same server and have access
protection (login/passwd). SSHGuard can see in the logs all failed
attempts to access the apps, so it can configure a firewall to block
the offender access to the apps: block a port (or all ports) to some
external IP.

A good comparison is failed login attempts to an ATM or smartcard
holding a digital certificate. Three (n) errors in a row will block
access for a day (bank) or forever (smartcard). Did I help you?

Júlio

Sent via Migadu.com, world's easiest email hosting

Re: [SSHGuard-users] OpenSMTPD and SSHGuard?

[Gary <li...@la...>]

As a former BSD user, there is a general consensus that the open source community support for BSD is going to erode. Human resources are limited. It used to be BSD on the server and Linux on the desktop. Now it is Linux everywhere. 

But getting back to SSHGuard, I never understood how to use it for both ssh and email ports. They are different attacks. Just because some server is attacking ssh, do I really want to block that server's email? 


  Original Message  
From: kev...@gm...
Sent: May 26, 2018 9:58 AM
To: ssh...@li...
Subject: Re: [SSHGuard-users] OpenSMTPD and SSHGuard?

On 05/26/2018 08:38, Júlio Maranhão wrote:
> On 25 May 2018 at 14:38, Kevin Zheng <kev...@gm...> wrote:
>>
>> An older version of SSHGuard is available on OpenBSD:
>>
>> security/sshguard
>>
>> SSHGuard does not recognize log messages from OpenSMTPD.
> 
> In your (members) opinion, is SSHGuard mature? I.e., is it done for
> what it does propose/declare in the website (few bugs)?

Being completely biased, I would say so.

The code is separated into well-defined components with well-defined
interfaces. In fact, the recent changes that updated attack signatures
have only changed one binary ('sshg-parser'). You could even write your
own sshg-parser and continue to use the rest of SSHGuard as-is.

Both the blocker ('sshg-blocker') and parser ('sshg-parser') logic work
with minimal privileges. While I still had OpenBSD to test on, both
pledge "dns" and "stdio". I'd be happy to help you update this.

> Sorry for these questions. I am only used to a python-based software
> and Linux. I need to assess the OpenBSD + Dovecot + OpenSMTPD +
> SSHGuard. Your anwer is clear: no go.
> 
> What about Postfix instead of OpenSMTPD?

I think it's better to choose the SMTPD you want. I would be confident
running OpenSMTPD without SSHGuard, but would still install SSHGuard to
reduce the amount of log noise.

We do recognize some SASL login errors from Postfix, but most likely
they need to be updated or expanded, as well.

> P.S.:  Interesting C/yacc code. If the only problem is OpenSMTPD and
> low interest/priority, I am willing to work it.

I'd be happy to help take a look at adding OpenSMTPD signatures.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] OpenSMTPD and SSHGuard?

[Kevin Z. <kev...@gm...>]

On 05/26/2018 08:38, Júlio Maranhão wrote:
> On 25 May 2018 at 14:38, Kevin Zheng <kev...@gm...> wrote:
>>
>> An older version of SSHGuard is available on OpenBSD:
>>
>> security/sshguard
>>
>> SSHGuard does not recognize log messages from OpenSMTPD.
> 
> In your (members) opinion, is SSHGuard mature? I.e., is it done for
> what it does propose/declare in the website (few bugs)?

Being completely biased, I would say so.

The code is separated into well-defined components with well-defined
interfaces. In fact, the recent changes that updated attack signatures
have only changed one binary ('sshg-parser'). You could even write your
own sshg-parser and continue to use the rest of SSHGuard as-is.

Both the blocker ('sshg-blocker') and parser ('sshg-parser') logic work
with minimal privileges. While I still had OpenBSD to test on, both
pledge "dns" and "stdio". I'd be happy to help you update this.

> Sorry for these questions. I am only used to a python-based software
> and Linux. I need to assess the OpenBSD + Dovecot + OpenSMTPD +
> SSHGuard. Your anwer is clear: no go.
> 
> What about Postfix instead of OpenSMTPD?

I think it's better to choose the SMTPD you want. I would be confident
running OpenSMTPD without SSHGuard, but would still install SSHGuard to
reduce the amount of log noise.

We do recognize some SASL login errors from Postfix, but most likely
they need to be updated or expanded, as well.

> P.S.:  Interesting C/yacc code. If the only problem is OpenSMTPD and
> low interest/priority, I am willing to work it.

I'd be happy to help take a look at adding OpenSMTPD signatures.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] OpenSMTPD and SSHGuard?

[Júlio M. <ju...@ma...>]

On 25 May 2018 at 14:38, Kevin Zheng <kev...@gm...> wrote:
>
> An older version of SSHGuard is available on OpenBSD:
>
> security/sshguard
>
> SSHGuard does not recognize log messages from OpenSMTPD.

In your (members) opinion, is SSHGuard mature? I.e., is it done for
what it does propose/declare in the website (few bugs)?

Sorry for these questions. I am only used to a python-based software
and Linux. I need to assess the OpenBSD + Dovecot + OpenSMTPD +
SSHGuard. Your anwer is clear: no go.

What about Postfix instead of OpenSMTPD?

P.S.:  Interesting C/yacc code. If the only problem is OpenSMTPD and
low interest/priority, I am willing to work it.

Júlio

Sent via Migadu.com, world's easiest email hosting

Re: [SSHGuard-users] OpenSMTPD and SSHGuard?

[Kevin Z. <kev...@gm...>]

On 05/25/2018 09:20, Júlio Maranhão wrote:
> Does SSHGuard support OpenSMTPD, both running on OpenBSD?
> 
> I found no positive indication on net and your site.

An older version of SSHGuard is available on OpenBSD:

security/sshguard

SSHGuard does not recognize log messages from OpenSMTPD.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] OpenSMTPD and SSHGuard?

[Júlio M. <jul...@gm...>]

Does SSHGuard support OpenSMTPD, both running on OpenBSD?

I found no positive indication on net and your site.

Cheers

Júlio

Re: [SSHGuard-users] Query over 'double counting' attacks?

[Jim S. <jse...@Li...>]

On Fri, 20 Apr 2018 18:29:39 +0100
Karl Pielorz <kpi...@td...> wrote:

[snip]
> 
> The bigger annoyance is 99% of IP's don't seem to trip the blocks
> (because they only try once or twice from a single IP and never
> again) - I can't think of any simple way of handling that either.
[snip]

That's one weakness in a tool like sshguard.  Using a bot farm, the
attacker can spread the attack vector out all over Internet creation,
and attempt from any given IP address just once every so many hours
or days.

There's no good way to counter that, other than making sshguard a
*lot* smarter than it is.  E.g.: Detect multiple failed attempts over
N days, with zero successes, from a given IP address.

That would of course require a very fast database.  (Very fast in
terms of lookups.)  And it would probably increase the likelihood of
sshguard, itself, becoming a DOS vector, if an attacker were
so-inclined.

In the end what really needs to happen is the hardening of client
systems, including IoT devices, so they're no longer quite so easily
turned into attack tools.

Regards,
Jim
-- 
Note: My mail server employs *very* aggressive anti-spam
filtering.  If you reply to this email and your email is
rejected, please accept my apologies and let me know via my
web form at <http://jimsun.LinxNet.com/contact/scform.php>.

Re: [SSHGuard-users] Query over 'double counting' attacks?

[Karl P. <kpi...@td...>]

--On 20 April 2018 at 08:57:18 -0700 Kevin Zheng <kev...@gm...> 
wrote:

>> Will this count as a 'danger' of 20? - Or does sshguard know / realise
>> these are both for the same connection, so collapse them? - The logs
>> seem to indicate they're treated as two separate things...
>
> No, SSHGuard currently does not.
>
> Checking the timestamp and throwing away duplicates could possibly work,
> but there are also many attackers who make multiple connections in the
> span of one second.
>
> I'm open to ideas on how to fix this.

Ok, it's not a major issue (as someone else already replied 'Does it really 
need fixing?')

It did confuse me a little looking at the logs (and obviously has 
implications for the counts before blocking - but it is all working).

I might see if I can get away with ignoring the "Disconnected from" lines - 
as so far it looks like everything 'evil' triggers from at least one other 
line - I'll collect some logs and check.

The bigger annoyance is 99% of IP's don't seem to trip the blocks (because 
they only try once or twice from a single IP and never again) - I can't 
think of any simple way of handling that either. Obvious dictionary attacks 
from single IP's are shut down very quickly though, which is good.

Thanks,

-Karl

Re: [SSHGuard-users] Query over 'double counting' attacks?

[Jim S. <jse...@Li...>]

On Fri, 20 Apr 2018 08:57:18 -0700
Kevin Zheng <kev...@gm...> wrote:

> On 04/20/2018 03:09, Karl Pielorz wrote:
> > So sshguard triggers for the 'Invalid user' line - and then,
> > again for the 'Disconnected from' line.
> > 
> > 
> > Will this count as a 'danger' of 20? - Or does sshguard know /
> > realise these are both for the same connection, so collapse them?
> > - The logs seem to indicate they're treated as two separate
> > things...  
> 
> No, SSHGuard currently does not.
> 
> Checking the timestamp and throwing away duplicates could possibly
> work, but there are also many attackers who make multiple
> connections in the span of one second.
> 
> I'm open to ideas on how to fix this.
> 

Does it really *need* fixing?  If somebody's hammering SSH that hard,
from multiple different angles, I'd want them blocked sooner, rather
than later, anyway.

Regards,
Jim
-- 
Note: My mail server employs *very* aggressive anti-spam
filtering.  If you reply to this email and your email is
rejected, please accept my apologies and let me know via my
web form at <http://jimsun.LinxNet.com/contact/scform.php>.

Re: [SSHGuard-users] Query over 'double counting' attacks?

[Kevin Z. <kev...@gm...>]

On 04/20/2018 03:09, Karl Pielorz wrote:
> So sshguard triggers for the 'Invalid user' line - and then, again for
> the 'Disconnected from' line.
> 
> 
> Will this count as a 'danger' of 20? - Or does sshguard know / realise
> these are both for the same connection, so collapse them? - The logs
> seem to indicate they're treated as two separate things...

No, SSHGuard currently does not.

Checking the timestamp and throwing away duplicates could possibly work,
but there are also many attackers who make multiple connections in the
span of one second.

I'm open to ideas on how to fix this.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Query over 'double counting' attacks?

[Karl P. <kpi...@td...>]

Hi,

I've recently installed sshguard 2.1.0 under FreeBSD - and it's all setup, 
and appears to be working fine.

In the logs though I'll see entries like:

Apr 20 10:43:32 sshd2[90659]: Connection from x.x.x.x port 58942 on 
192.168.1.129 port 2323
Apr 20 10:43:42 sshd2[90659]: Invalid user test from x.x.x.x
Apr 20 10:43:42 sshguard[89640]: Attack from "x.x.x.x" on service 100 with 
danger 10.
Apr 20 10:43:42 sshd2[90659]: Received disconnect from x.x.x.x port 
58942:11: Normal Shutdown, Thank you for playing [preauth]
Apr 20 10:43:42 sshd2[90659]: Disconnected from x.x.x.x port 58942 [preauth]
Apr 20 10:43:42 sshguard[89640]: Attack from "x.x.x.x" on service 100 with 
danger 10.


So sshguard triggers for the 'Invalid user' line - and then, again for the 
'Disconnected from' line.


Will this count as a 'danger' of 20? - Or does sshguard know / realise 
these are both for the same connection, so collapse them? - The logs seem 
to indicate they're treated as two separate things...

Thanks,

-Karl

Re: [SSHGuard-users] Postfix compatibility

[Gary <li...@la...>]

When you get a few hundred relay requests spaces less than a second apart, I call it hacking. 

It is more efficient to  block at the firewall than postfix  rate limit via anvil. 


  Original Message  
From: jse...@Li...
Sent: March 19, 2018 7:33 AM
To: ssh...@li...
Subject: Re: [SSHGuard-users] Postfix compatibility

On Sun, 18 Mar 2018 21:58:38 -0700
"li...@la..." <li...@la...> wrote:

> I've been getting machine gun rate attempts to relay through my
> Postfix MTA. Is there anyway to set up sshguard to block postfix
> hacking?
[snip]

They're not "hacking" Postfix.  They're simply trying to relay
through whatever they can.  Postfix is already doing the job it
was designed (and configured) to do.  Adding another layer, via
sshguard, would net you nothing except to increase complexity.

Regards,
Jim
-- 
Note: My mail server employs *very* aggressive anti-spam
filtering.  If you reply to this email and your email is
rejected, please accept my apologies and let me know via my
web form at <http://jimsun.LinxNet.com/contact/scform.php>.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] Postfix compatibility

[Jim S. <jse...@Li...>]

On Sun, 18 Mar 2018 21:58:38 -0700
"li...@la..." <li...@la...> wrote:

> I've been getting machine gun rate attempts to relay through my
> Postfix MTA. Is there anyway to set up sshguard to block postfix
> hacking?
[snip]

They're not "hacking" Postfix.  They're simply trying to relay
through whatever they can.  Postfix is already doing the job it
was designed (and configured) to do.  Adding another layer, via
sshguard, would net you nothing except to increase complexity.

Regards,
Jim
-- 
Note: My mail server employs *very* aggressive anti-spam
filtering.  If you reply to this email and your email is
rejected, please accept my apologies and let me know via my
web form at <http://jimsun.LinxNet.com/contact/scform.php>.

[SSHGuard-users] Postfix compatibility

[<li...@la...>]

I've been getting machine gun rate attempts to relay through my Postfix
MTA. Is there anyway to set up sshguard to block postfix hacking?

I'm running 2.1.0 on centos. I install from git.

sample error message:
Mar 19 02:16:30 centos-1gb-sfo1-01 postfix/smtpd[11364]: NOQUEUE: reject: RCPT from unknown[61.236.111.38]: 554 5.7.1 <ea...@ya...>: Relay access denied; from=<X...@te...> to=<ea...@ya...> proto=ESMTP helo=<192.168.171.203>

Re: [SSHGuard-users] Federated block (and unblocking)

[Niklaas B. v. G. <st...@ni...>]

On 27.02.2018 04:14, Andrew Elwell wrote:

> We have a cluster of frontend nodes (round robin DNS points to the
> cluster) - is there a way of getting a sshguard to share blocking /
> unblocking across all machines? We can run things on central syslog
> ingest node or on each node as required.

You can let your firwalls synchronise the tables containing the blocked
and/or whitelisted IPs. E.g., firewall PF supports that with `pfsync`,
see https://www.freebsd.org/cgi/man.cgi?pfsync .

[SSHGuard-users] Federated block (and unblocking)

[Andrew E. <and...@gm...>]

Hi Folks,

We have a cluster of frontend nodes (round robin DNS points to the
cluster) - is there a way of getting a sshguard to share blocking /
unblocking across all machines? We can run things on central syslog
ingest node or on each node as required.

If not, are other sites interested in this functionality? possibly
thinking of a publish/subscribe model


Many thanks

Andrew

Re: [SSHGuard-users] Different rules for root?

[Kevin Z. <kev...@gm...>]

On 01/30/2018 15:15, @lbutlr wrote:
> Is it possible to setup a different rule for connections that attempt
> to connect to the root account?
> 
> My machines do not allow root access via sshd, so I'd prefer that any
> attempt to login as root be immediately blacklisted.

Not currently.

You can implement it by directly modifying sshg-parser, or making your
own parser script that wraps around the sshg-parser script, with your rule.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Different rules for root?

[@lbutlr <kr...@kr...>]

Is it possible to setup a different rule for connections that attempt to connect to the root account?

My machines do not allow root access via sshd, so I'd prefer that any attempt to login as root be immediately blacklisted.

Re: [SSHGuard-users] A minor bug in Wordpress brute force protection

[Gary <li...@la...>]

I think 444 is strictly user generated. Nginx will generate a 400 return by itself. There is some virus/botnet/??? that sends \xx type data. Some attacks I have determined are attempts to hack RDP. Others I haven't a clue, but they sure aren't browsing. You also get a 400 on a "connect", which I assume some server software uses to set up proxies. 

Besides WordPress hackers, I snag the Struts attacks, php administrators attacks, and hackers that somehow assume they can escape out of the web root. They look for /usr for example. 

Maybe once a week I take the access file and delete the obvious legit stuff. Self referrals, favicon loads, Google searches (real or spoofed), just to data reduce the log. Then I look at the 404 returns to see if there is some new attack. 

Mind you none of this activity is dangerous in a well patched system. I'm more concerned about the zero day stuff. If I can block via IP likely sources of hacking, I've reduced my exposure to the unknowns. 

As a bonus, all this data center IP space in my "noeyes" blacklist gets banned from all mail ports other than 25. 

  Original Message  
From: ton...@gm...
Sent: January 27, 2018 11:06 AM
To: li...@la...; kev...@gm...; ssh...@li...
Subject: Re: [SSHGuard-users] A minor bug in Wordpress brute force protection

I slightly configured my nginx a bit, so it only sends 401 logs to 
syslog for two reverse proxies that has http basic auth, and only log 
wp-login.php accesses when there is a POST + 200 response.

I do wonder though, on what scenario will nginx sends a 444 proactively 
(other than configured doing so).

在 2018/1/27 下午 2:03, Gary 写道:
> I hadn't realized you were looking at web server logs.
> 
> I don't run WordPress, but I use Nginx maps to snag all these obvious hackers. Perhaps a different approach, at least for Nginx users, would be to look for the 444 response code rather than trying to come up with regex for every scenario.
> 
> On my freeBSD server, I've been using swatch to give the hacker a three minute timeout. From my experiments, that is what it takes for these hacking scripts like Jorgee to go away.
> 
> They must have 60+ attacks in Jorgee. These are all easy enough for a non-coder like me to snap with a map. I think it would be more flexible, at least for Nginx, to just look for 444. Actually what I do is set up a custom log format so I can easily parse the log for the 444 return and then the IP address. I have a script to make a list of the offending IP addresses and see which go to data centers. I then block the IP space of that data center and then pest is gone forever.
> 
>    Original Message
> From: kev...@gm...
> Sent: January 27, 2018 10:42 AM
> To: ssh...@li...; ton...@gm...
> Subject: Re: [SSHGuard-users] A minor bug in Wordpress brute force protection
> 
> Hi Tony,
> 
> Thanks for the report.
> 
> On 01/25/2018 08:33, Tony Zhou wrote:
>> I tried to implement Wordpress login brute force protection with my
>> SSHGuard 2.1.0 (2.1.0-1 from Arch Linux repo), and found that SSHGuard
>> will not react to access log of attempts to wp-login.php if there is an
>> argument passed to wp-login.php.
>>
>> I am using iTheme Security to hide my wp-login.php address, and when a
>> failed login happens, the following log was captured:
>>
>> server nginx: my.client.ip.addr - - [25/Jan/2018:11:20:57 -0500] "POST
>> /wp-login.php?itsec-hb-token=somewploginentry HTTP/2.0" 200 2159
>> "https://my.server.domain.tld/wp-login.php?itsec-hb-token=somewploginentry"
>> "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gcko/20100101
>> Firefox/58.0"
> 
> I didn't expect to see the '?' in POST requests, so the parser does not
> recognize characters after 'wp-login.php' when detecting the attack.
> 
> I think I'll go ahead and add a catch-all to the regex?
> 

Re: [SSHGuard-users] A minor bug in Wordpress brute force protection

[Tony Z. <ton...@gm...>]

I slightly configured my nginx a bit, so it only sends 401 logs to 
syslog for two reverse proxies that has http basic auth, and only log 
wp-login.php accesses when there is a POST + 200 response.

I do wonder though, on what scenario will nginx sends a 444 proactively 
(other than configured doing so).

在 2018/1/27 下午 2:03, Gary 写道:
> I hadn't realized you were looking at web server logs.
> 
> I don't run WordPress, but I use Nginx maps to snag all these obvious hackers. Perhaps a different approach, at least for Nginx users, would be to look for the 444 response code rather than trying to come up with regex for every scenario.
> 
> On my freeBSD server, I've been using swatch to give the hacker a three minute timeout. From my experiments, that is what it takes for these hacking scripts like Jorgee to go away.
> 
> They must have 60+ attacks in Jorgee. These are all easy enough for a non-coder like me to snap with a map. I think it would be more flexible, at least for Nginx, to just look for 444. Actually what I do is set up a custom log format so I can easily parse the log for the 444 return and then the IP address. I have a script to make a list of the offending IP addresses and see which go to data centers. I then block the IP space of that data center and then pest is gone forever.
> 
>    Original Message
> From: kev...@gm...
> Sent: January 27, 2018 10:42 AM
> To: ssh...@li...; ton...@gm...
> Subject: Re: [SSHGuard-users] A minor bug in Wordpress brute force protection
> 
> Hi Tony,
> 
> Thanks for the report.
> 
> On 01/25/2018 08:33, Tony Zhou wrote:
>> I tried to implement Wordpress login brute force protection with my
>> SSHGuard 2.1.0 (2.1.0-1 from Arch Linux repo), and found that SSHGuard
>> will not react to access log of attempts to wp-login.php if there is an
>> argument passed to wp-login.php.
>>
>> I am using iTheme Security to hide my wp-login.php address, and when a
>> failed login happens, the following log was captured:
>>
>> server nginx: my.client.ip.addr - - [25/Jan/2018:11:20:57 -0500] "POST
>> /wp-login.php?itsec-hb-token=somewploginentry HTTP/2.0" 200 2159
>> "https://my.server.domain.tld/wp-login.php?itsec-hb-token=somewploginentry"
>> "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gcko/20100101
>> Firefox/58.0"
> 
> I didn't expect to see the '?' in POST requests, so the parser does not
> recognize characters after 'wp-login.php' when detecting the attack.
> 
> I think I'll go ahead and add a catch-all to the regex?
> 

Re: [SSHGuard-users] A minor bug in Wordpress brute force protection

[Gary <li...@la...>]

I hadn't realized you were looking at web server logs. 

I don't run WordPress, but I use Nginx maps to snag all these obvious hackers. Perhaps a different approach, at least for Nginx users, would be to look for the 444 response code rather than trying to come up with regex for every scenario. 

On my freeBSD server, I've been using swatch to give the hacker a three minute timeout. From my experiments, that is what it takes for these hacking scripts like Jorgee to go away. 

They must have 60+ attacks in Jorgee. These are all easy enough for a non-coder like me to snap with a map. I think it would be more flexible, at least for Nginx, to just look for 444. Actually what I do is set up a custom log format so I can easily parse the log for the 444 return and then the IP address. I have a script to make a list of the offending IP addresses and see which go to data centers. I then block the IP space of that data center and then pest is gone forever. 

  Original Message  
From: kev...@gm...
Sent: January 27, 2018 10:42 AM
To: ssh...@li...; ton...@gm...
Subject: Re: [SSHGuard-users] A minor bug in Wordpress brute force protection

Hi Tony,

Thanks for the report.

On 01/25/2018 08:33, Tony Zhou wrote:
> I tried to implement Wordpress login brute force protection with my
> SSHGuard 2.1.0 (2.1.0-1 from Arch Linux repo), and found that SSHGuard
> will not react to access log of attempts to wp-login.php if there is an
> argument passed to wp-login.php.
> 
> I am using iTheme Security to hide my wp-login.php address, and when a
> failed login happens, the following log was captured:
> 
> server nginx: my.client.ip.addr - - [25/Jan/2018:11:20:57 -0500] "POST
> /wp-login.php?itsec-hb-token=somewploginentry HTTP/2.0" 200 2159
> "https://my.server.domain.tld/wp-login.php?itsec-hb-token=somewploginentry"
> "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gcko/20100101
> Firefox/58.0"

I didn't expect to see the '?' in POST requests, so the parser does not
recognize characters after 'wp-login.php' when detecting the attack.

I think I'll go ahead and add a catch-all to the regex?

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] A minor bug in Wordpress brute force protection

[Kevin Z. <kev...@gm...>]

Hi Tony,

Thanks for the report.

On 01/25/2018 08:33, Tony Zhou wrote:
> I tried to implement Wordpress login brute force protection with my
> SSHGuard 2.1.0 (2.1.0-1 from Arch Linux repo), and found that SSHGuard
> will not react to access log of attempts to wp-login.php if there is an
> argument passed to wp-login.php.
> 
> I am using iTheme Security to hide my wp-login.php address, and when a
> failed login happens, the following log was captured:
> 
> server nginx: my.client.ip.addr - - [25/Jan/2018:11:20:57 -0500] "POST
> /wp-login.php?itsec-hb-token=somewploginentry HTTP/2.0" 200 2159
> "https://my.server.domain.tld/wp-login.php?itsec-hb-token=somewploginentry"
> "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gcko/20100101
> Firefox/58.0"

I didn't expect to see the '?' in POST requests, so the parser does not
recognize characters after 'wp-login.php' when detecting the attack.

I think I'll go ahead and add a catch-all to the regex?

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] A minor bug in Wordpress brute force protection

[Tony Z. <ton...@gm...>]

Hello,

I tried to implement Wordpress login brute force protection with my
SSHGuard 2.1.0 (2.1.0-1 from Arch Linux repo), and found that SSHGuard will
not react to access log of attempts to wp-login.php if there is an argument
passed to wp-login.php.

I am using iTheme Security to hide my wp-login.php address, and when a
failed login happens, the following log was captured:

server nginx: my.client.ip.addr - - [25/Jan/2018:11:20:57 -0500] "POST
/wp-login.php?itsec-hb-token=somewploginentry HTTP/2.0" 200 2159 "
https://my.server.domain.tld/wp-login.php?itsec-hb-token=somewploginentry"
"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gcko/20100101
Firefox/58.0"

And the journalctl command used by SSHGuard can capture this message, but
SSHGuard does not react to it (like "my.client.ip.addr" on service 370 with*
danger 10*.").

Could it be the WORDPRESS_LOGIN variable in attack_scanner.l the problem? I
saw it was defined as .*"/wp-login"(\.php)?, I guess the regex need to
allow addtional strings after the question mark.

Thanks for your great work on SSHGuard!

Re: [SSHGuard-users] Error message in log: xtables

[Daniel A. <co...@da...>]

On Mon, Jan 8, 2018, at 07:46, li...@la... wrote:
> On Mon, 8 Jan 2018 12:43:49 +0800
> Kevin Zheng <kev...@gm...> wrote:
> 
> > On 01/08/2018 11:47, li...@la... wrote:
> > > From centos 7 boot in the messages log. Is this a problem?
> > > 
> > > Jan  7 05:11:48  systemd: Starting LSB: Bring up/down networking...
> > > Jan  7 05:11:48  systemd: Starting SSHGuard - blocks brute-force
> > > login attempts... Jan  7 05:11:48  iptables: Another app is
> > > currently holding the xtables lock. Perhaps you want to use the -w
> > > option? Jan  7 05:11:48  systemd: Started SSHGuard - blocks
> > > brute-force login attempts.  
> > 
> > Perhaps. I remember something similar being reported before.
> > 
> > What version of SSHGuard, Linux kernel, distribution, and iptables are
> > you using?
> > 
> 
> Some additional firewalld stuff I meant to post but forgot. The default
> size of the ipset is very small. I maxed one out at less than 30 IP
> addresses. 
> 
> Check out this post, specifically at the bottom:
> https://lists.fedorahosted.org/archives/list/fir...@li.../thread/EQAIIB5YTEAFZRW7Z6ALKCV3HGSWJ2EM/
> 
> You need to specify the maximum size of the elements of the ipset. But
> what I found interesting is if you add an IP address to block, you will
> be returned a "success" even if the ipset is full (reached limit).

I tested on Fedora 27 just now and added over 1000 addresses to the sshguard4 ipset without problem. The default maximum size of an ipset should be 65 536. I’m not sure what is going on on your system, but I doubt that this is your problem if you only have 30 entries. 
-- 
Daniel Aleksandersen
https://www.daniel.priv.no/

Re: [SSHGuard-users] Error message in log: xtables

[<li...@la...>]

On Mon, 8 Jan 2018 12:43:49 +0800
Kevin Zheng <kev...@gm...> wrote:

> On 01/08/2018 11:47, li...@la... wrote:
> > From centos 7 boot in the messages log. Is this a problem?
> > 
> > Jan  7 05:11:48  systemd: Starting LSB: Bring up/down networking...
> > Jan  7 05:11:48  systemd: Starting SSHGuard - blocks brute-force
> > login attempts... Jan  7 05:11:48  iptables: Another app is
> > currently holding the xtables lock. Perhaps you want to use the -w
> > option? Jan  7 05:11:48  systemd: Started SSHGuard - blocks
> > brute-force login attempts.  
> 
> Perhaps. I remember something similar being reported before.
> 
> What version of SSHGuard, Linux kernel, distribution, and iptables are
> you using?
> 

Some additional firewalld stuff I meant to post but forgot. The default
size of the ipset is very small. I maxed one out at less than 30 IP
addresses. 

Check out this post, specifically at the bottom:
https://lists.fedorahosted.org/archives/list/fir...@li.../thread/EQAIIB5YTEAFZRW7Z6ALKCV3HGSWJ2EM/

You need to specify the maximum size of the elements of the ipset. But
what I found interesting is if you add an IP address to block, you will
be returned a "success" even if the ipset is full (reached limit).