sshguard-users — User questions and answers, bugs, and general support

Re: [SSHGuard-users] Error message in log: xtables

[<li...@la...>]

On Mon, 8 Jan 2018 12:43:49 +0800
Kevin Zheng <kev...@gm...> wrote:

> On 01/08/2018 11:47, li...@la... wrote:
> > From centos 7 boot in the messages log. Is this a problem?
> > 
> > Jan  7 05:11:48  systemd: Starting LSB: Bring up/down networking...
> > Jan  7 05:11:48  systemd: Starting SSHGuard - blocks brute-force
> > login attempts... Jan  7 05:11:48  iptables: Another app is
> > currently holding the xtables lock. Perhaps you want to use the -w
> > option? Jan  7 05:11:48  systemd: Started SSHGuard - blocks
> > brute-force login attempts.  
> 
> Perhaps. I remember something similar being reported before.
> 
> What version of SSHGuard, Linux kernel, distribution, and iptables are
> you using?
> 

I'm running firewalld. I'm very much a novice on firewalld, but I
understand it can be augnmented with iptables, but it isn't a
requirement.

Centos
uname -a
Linux  3.10.0-693.11.1.el7.x86_64 #1 SMP Mon Dec 4
23:52:40 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

firewall-cmd --version
0.4.4.4

sh-4.2# systemctl status iptables
Unit iptables.service could not be found.

sh-4.2# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2018-01-07 05:11:48 UTC; 1 day 1h ago
     Docs: man:firewalld(1)
 Main PID: 585 (firewalld)
   CGroup: /system.slice/firewalld.service                                                                                                                                         
           └─585 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid                                                                                                          

Jan 07 05:12:14  firewalld[585]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.                                                          
Jan 07 05:12:20  firewalld[585]: WARNING: ALREADY_ENABLED: rule family=ipv6 source ipset=sshguard6 drop                                                                            
Jan 07 05:12:21  firewalld[585]: ERROR: NAME_CONFLICT: new_ipset(): 'sshguard4'                                                                                                    
Jan 07 05:12:22  firewalld[585]: WARNING: ALREADY_ENABLED: rule family=ipv4 source ipset=sshguard4 drop                                                                            
Jan 07 05:12:48  firewalld[585]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.                                                                        
Jan 07 05:12:48  firewalld[585]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.                                                          
Jan 07 05:12:48  firewalld[585]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.                                                                       
Jan 07 05:12:48  firewalld[585]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.                                                         
Jan 07 05:12:48  firewalld[585]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.                                                                        
Jan 07 05:12:48  firewalld[585]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.

Re: [SSHGuard-users] Error message in log: xtables

[Kevin Z. <kev...@gm...>]

On 01/08/2018 11:47, li...@la... wrote:
> From centos 7 boot in the messages log. Is this a problem?
> 
> Jan  7 05:11:48  systemd: Starting LSB: Bring up/down networking...
> Jan  7 05:11:48  systemd: Starting SSHGuard - blocks brute-force login attempts...
> Jan  7 05:11:48  iptables: Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
> Jan  7 05:11:48  systemd: Started SSHGuard - blocks brute-force login attempts.

Perhaps. I remember something similar being reported before.

What version of SSHGuard, Linux kernel, distribution, and iptables are
you using?

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Error message in log: xtables

[<li...@la...>]

From centos 7 boot in the messages log. Is this a problem?

Jan  7 05:11:48  systemd: Starting LSB: Bring up/down networking...
Jan  7 05:11:48  systemd: Starting SSHGuard - blocks brute-force login attempts...
Jan  7 05:11:48  iptables: Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Jan  7 05:11:48  systemd: Started SSHGuard - blocks brute-force login attempts.

Re: [SSHGuard-users] Multiple instances of sshguard on startup

[Kevin Z. <kev...@gm...>]

On 01/04/2018 13:26, John Haynes wrote:
> When I start sshguard, like this:
>> sudo ./sshguard -l /var/log/auth.log
> 
> it seems that three separate sshguard processes are spawned:
>> ps -A | grep sshg
>  1486 pts/1    00:00:00 sshguard
>  1487 pts/1    00:00:00 sshguard
>  1488 pts/1    00:00:00 sshg-parser
>  1489 pts/1    00:00:00 sshg-blocker
>  1491 pts/1    00:00:00 sshguard
>  1492 pts/1    00:00:00 sshg-fw-hosts
> 
> Is this normal?  Everything seems to be working, but I'm perplexed as to
> how three instances are started.  (Unless this is intentional, in which
> case there's nothing to see here...)

This is normal. The 'sshguard' processes are actually subshells spawned
when you started 'sshguard' (it's a shell script).

All the actual work is being done in a pipeline from the logs ->
sshg-parser -> sshg-blocker -> sshg-fw-hosts. I don't see a sshg-logtail
in this list; are you piping logs to SSHGuard? That has caused problems
for other users in the past so we discourage it.

> The following may or may not not be related, but I also had to change
> the first non-comment line of the sbin/sshguard script from:
>   trap "trap - SIGTERM && kill 0" SIGINT SIGTERM EXIT
> to:
>   trap "trap - TERM && kill 0" INT TERM EXIT
> to avoid the following error on starting or interrupting the script:
>   trap: SIGTERM: bad trap

That's a bug. I've fixed it in 2ed7e0a which will make it into the next
release.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Multiple instances of sshguard on startup

[John H. <joh...@gm...>]

Hello,

When I start sshguard, like this:
> sudo ./sshguard -l /var/log/auth.log

it seems that three separate sshguard processes are spawned:
> ps -A | grep sshg
 1486 pts/1    00:00:00 sshguard
 1487 pts/1    00:00:00 sshguard
 1488 pts/1    00:00:00 sshg-parser
 1489 pts/1    00:00:00 sshg-blocker
 1491 pts/1    00:00:00 sshguard
 1492 pts/1    00:00:00 sshg-fw-hosts

Is this normal?  Everything seems to be working, but I'm perplexed as to
how three instances are started.  (Unless this is intentional, in which
case there's nothing to see here...)

The following may or may not not be related, but I also had to change the
first non-comment line of the sbin/sshguard script from:
  trap "trap - SIGTERM && kill 0" SIGINT SIGTERM EXIT
to:
  trap "trap - TERM && kill 0" INT TERM EXIT
to avoid the following error on starting or interrupting the script:
  trap: SIGTERM: bad trap

(I'm not sure why my shell complains about this... see for example
https://unix.stackexchange.com/questions/314554/why-do-i-get-an-error-message-when-trying-to-trap-a-sigint-signal
)

Many thanks,

John H

[SSHGuard-users] Thanks!

[Jos C. <jo...@cl...>]

I would like to thank the SSHGuard team and its port maintainer for 
their excellent work in 2017.
Without you we would never enjoy BSD as we do until this very day.

Best regards,
Jos Chrispijn

#CSSis *{*beautiful*}*

Re: [SSHGuard-users] Centos sshguard "error"

[<li...@la...>]

On Wed, 27 Dec 2017 06:16:21 +0100
Daniel Aleksandersen <co...@da...> wrote:

> On Wed, Dec 27, 2017, at 04:36, li...@la... wrote:
> > I'm running Centos 7.3 using Firewalld. Is this error really an
> > error? Also any help to see what IP is being blocked would help.  
> 
> TL;DR: Commands included at the bottom.
> 
> > Dec 27 02:04:05 centos-1gb-sfo1-01 sshd[3829]: error: maximum
> > authentication attempts exceeded for root from 197.251.5.165 port
> > 42280 ssh2 [preauth] Dec 27 02:04:05 centos-1gb-sfo1-01 sshd[3829]:
> > Disconnecting: Too many authentication failures [preauth]  
> 
> The above messages are from OpenSSH and are processed by SSHGuard.
> That appears to be working as SSHGuard logs a warning about having
> detected a login attempt:
> 
> > Dec 27 02:04:05 centos-1gb-sfo1-01 sshguard[2934]: Attack from
> > "197.251.5.165" on service 100 with danger 10.  
> 
> The attacking source 197.251.5.165 now has a dangerousness score of
> 10. SSHGuard doens’t block an IP until it reaches 30, by the default
> configuration. 197.251.5.165 would need to attack your two more times
> within the configured detection time before it would be blocked. See
> the sshguard.conf file, especially the THRESHOLD, BLOCK_TIME, and
> DETECTION_TIME in particular.
> 
> > Perhaps useful info:
> > firewall-cmd  --list-icmp-blocks
> > returns noting.  
> 
> ICMP blocks have nothing to do with SSHGuard.
> 
> > I used this as a guide:
> > https://www.ctrl.blog/entry/how-to-sshguard-firewalld  
> 
> full disclosure: I’m the author.
> 
> > Unfortunately Centos does not use firewallctl but rather
> > firewall-cmd, so the commands don't tranlate.   
> 
> firewallctl was added to FirewallD in version 0.4.3 released more
> than 18 months ago, and there have been many releases of FirewallD
> since then. You must be using an even older version of FirewallD. You
> should keep the version of FirewallD (and other software) you’re
> using up to date. Software on CentOS is often years out of date. :(
> 
> Please note that the most recent version of SSHGuard still use
> firewall-cmd internally for backwards compatibility. firewallctl is
> equivalent to firewall-cmd, but the former is believed to better for
> end-users as the syntax is simpler and more similar to that of other
> tools on CentOS/Fedora/RHEL.
> 
> > Here is the suggested command to see what IP has been blocked:  
> 
> The following commands are equivalent for firewall-cmd:
> 
> firewall-cmd --ipset=sshguard4 --get-entries [--permanent]
> firewall-cmd --ipset=sshguard6 --get-entries [--permanent]
> 
> 
> I hope this helps! :-) Let us know if you have any further questions.
> 
> PS: What resources other than my blog post did you use when learning
> about SSHGuard? Did you read the man page? or the configuration file?
> SSHGuard website? Have a look in your browser’s history if possible.
> I’m curious about this as we can use such information to help improve
> documentation.

Regarding firewalld: firewalld-0.4.4.4-6.el7.noarch
So I am one update beyond 0.4.3

I don't think I found a centos page for sshguard plus firewalld, but I
figured fedora should be very close. I'm familiar with compiling code,
loading dependencies, using wget, etc. I do that on my own computers,
but was hoping not to do that on a server since you rather just use
repositories. But even if I never compiled a program in my life, the
instructions were very detailed and I would have no problem following
them. (wget isn't stock either, but I assume the reader would figure
that out.) The page is much appreciated. 

About the only thing I haven't done is made sshguard a service since I
want to see what it blocks. On a VPS with no root password, you really
need ssh to work. I'm paranoid to the point that I do full image
backups and then boot from that backup to verify both that it is
bootable and ssh works. I keep two images. Cloud storage is really
cheap.

Regarding centos being old, they were on postfix2(2.6 I think). I loaded
ghetto forge to get postfix3, which I have been running on my freeBSD
server. Anyway, I have updated the centos repos, well such as they are.

firewall-cmd --ipset=sshguard4 --get-entries --permanent
returns a blank line. I run the old version of sshguard on freeBSD, and
it nails hackers night and day, so maybe the limits have changed.

But my question was regarding the line being declared an error. But
looking at my older sshguard on a freeBSD server, that also declared an
errpr.

I found no blacklisted IP addresses. I grepped out the blocking of my
worst offender on the Centos server:

egrep -e 88.99.96.49/32 junk
Dec 26 20:17:53 centos-1gb-sfo1-01 sshguard[2934]: Blocking "88.99.96.49/32" for 120 secs (3 attacks in 103 secs, after 1 abuses over 103 secs.)
Dec 26 20:22:05 centos-1gb-sfo1-01 sshguard[2934]: Blocking "88.99.96.49/32" for 240 secs (3 attacks in 100 secs, after 2 abuses over 355 secs.)
Dec 26 20:29:06 centos-1gb-sfo1-01 sshguard[2934]: Blocking "88.99.96.49/32" for 480 secs (3 attacks in 112 secs, after 3 abuses over 776 secs.)
Dec 26 20:38:27 centos-1gb-sfo1-01 sshguard[2934]: Blocking "88.99.96.49/32" for 960 secs (3 attacks in 48 secs, after 4 abuses over 1337 secs.)
Dec 26 20:56:13 centos-1gb-sfo1-01 sshguard[2934]: Blocking "88.99.96.49/32" for 1920 secs (3 attacks in 57 secs, after 5 abuses over 2403 secs.)
Dec 26 21:29:39 centos-1gb-sfo1-01 sshguard[2934]: Blocking "88.99.96.49/32" for 3840 secs (3 attacks in 60 secs, after 6 abuses over 4409 secs.)
Dec 26 22:35:30 centos-1gb-sfo1-01 sshguard[2934]: Blocking "88.99.96.49/32" for 7680 secs (3 attacks in 63 secs, after 7 abuses over 8360 secs.)

Using a key rather than a password, it is highly unlikely any of these fools will get ssh access, so I'm OK with the geometric blocking time increases rather than a blacklist. 

IP comes back to hetzner.de. Oh I'm so shocked. ;-) I will probably do
a geographic block in the firewall to cut out countries where I'm not
located. That works great for email ports, just don't block 25.

Re: [SSHGuard-users] Centos sshguard "error"

[Daniel A. <co...@da...>]

On Wed, Dec 27, 2017, at 04:36, li...@la... wrote:
> I'm running Centos 7.3 using Firewalld. Is this error really an error?
> Also any help to see what IP is being blocked would help.

TL;DR: Commands included at the bottom.

> Dec 27 02:04:05 centos-1gb-sfo1-01 sshd[3829]: error: maximum
> authentication attempts exceeded for root from 197.251.5.165 port 42280
> ssh2 [preauth] Dec 27 02:04:05 centos-1gb-sfo1-01 sshd[3829]:
> Disconnecting: Too many authentication failures [preauth]

The above messages are from OpenSSH and are processed by SSHGuard. That appears to be working as SSHGuard logs a warning about having detected a login attempt:

> Dec 27 02:04:05 centos-1gb-sfo1-01 sshguard[2934]: Attack from "197.251.5.165"
> on service 100 with danger 10.

The attacking source 197.251.5.165 now has a dangerousness score of 10. SSHGuard doens’t block an IP until it reaches 30, by the default configuration. 197.251.5.165 would need to attack your two more times within the configured detection time before it would be blocked. See the sshguard.conf file, especially the THRESHOLD, BLOCK_TIME, and DETECTION_TIME in particular.

> Perhaps useful info:
> firewall-cmd  --list-icmp-blocks
> returns noting.

ICMP blocks have nothing to do with SSHGuard.

> I used this as a guide:
> https://www.ctrl.blog/entry/how-to-sshguard-firewalld

full disclosure: I’m the author.

> Unfortunately Centos does not use firewallctl but rather firewall-cmd,
> so the commands don't tranlate. 

firewallctl was added to FirewallD in version 0.4.3 released more than 18 months ago, and there have been many releases of FirewallD since then. You must be using an even older version of FirewallD. You should keep the version of FirewallD (and other software) you’re using up to date. Software on CentOS is often years out of date. :(

Please note that the most recent version of SSHGuard still use firewall-cmd internally for backwards compatibility. firewallctl is equivalent to firewall-cmd, but the former is believed to better for end-users as the syntax is simpler and more similar to that of other tools on CentOS/Fedora/RHEL.

> Here is the suggested command to see what IP has been blocked:

The following commands are equivalent for firewall-cmd:

firewall-cmd --ipset=sshguard4 --get-entries [--permanent]
firewall-cmd --ipset=sshguard6 --get-entries [--permanent]


I hope this helps! :-) Let us know if you have any further questions.

PS: What resources other than my blog post did you use when learning about SSHGuard? Did you read the man page? or the configuration file? SSHGuard website? Have a look in your browser’s history if possible. I’m curious about this as we can use such information to help improve documentation.
-- 
Daniel Aleksandersen
https://www.daniel.priv.no/

[SSHGuard-users] Centos sshguard "error"

[<li...@la...>]

I'm running Centos 7.3 using Firewalld. Is this error really an error?
Also any help to see what IP is being blocked would help.

Dec 27 02:04:05 centos-1gb-sfo1-01 sshd[3829]: error: maximum
authentication attempts exceeded for root from 197.251.5.165 port 42280
ssh2 [preauth] Dec 27 02:04:05 centos-1gb-sfo1-01 sshd[3829]:
Disconnecting: Too many authentication failures [preauth] Dec 27
02:04:05 centos-1gb-sfo1-01 sshguard[2934]: Attack from "197.251.5.165"
on service 100 with danger 10.

Perhaps useful info:
sh-4.2# firewall-cmd  --get-ipsets
sshguard4 sshguard6

firewall-cmd  --list-icmp-blocks
returns noting.

I used this as a guide:
https://www.ctrl.blog/entry/how-to-sshguard-firewalld

Unfortunately Centos does not use firewallctl but rather firewall-cmd,
so the commands don't tranlate. Here is the suggested command to see
what IP has been blocked:
You can inspect the blocked entries in each ipset using the following
commands:

firewallctl info ipset --permanent "sshguard4"
firewallctl info ipset --permanent "sshguard6"

This returns a blank line:
sh-4.2# firewall-cmd  --ipset=sshguard4 --get-description --permanent

Re: [SSHGuard-users] Initializing (null) firewall

[Petri R. <pet...@me...>]

> I use sshguard 2.0.0 with FreeBSD 10.3. I noticed that ssh bruteforce attacks not beeing blocked by sshguard. While I analyzed the behaviour I found out that pfctl -T show -t sshguard shows no result, but when I restart ssh guard via service sshguard restart I am able to see the folling output:
> 
> ===>>> Initializing (null) firewall
> ===>>> Blocking 87.173.65.62 (null)
> ===>>> Blocking 37.228.134.110 (null)
> ===>>> Blocking 176.9.19.16 (null)

I am no authority on this, but are you using the correct backend? In /usr/local/etc/sshguard.conf enable the correct backend. I am using ipfw, but apparently you are using pf. The default is null, which might produce the output you are seeing - I haven’t tried it out.

The upgrade from 1.x to 2.0 wasn’t smooth. It took me a while to get things back the way they used to be. There used to be a separate port for each backend. Now there is only one port, but you must select the backend you are using.

Another detail that bit me: The /usr/local/etc/sshguard.whitelist is disabled by default in the .conf file. If you want to whitelist some addresses, enable the whitelist first. Took me a while to figure out as well.

br, Petri

[SSHGuard-users] Initializing (null) firewall

[Marcus.schmitt <mar...@pr...>]

Hello,

I use sshguard 2.0.0 with FreeBSD 10.3. I noticed that ssh bruteforce attacks not beeing blocked by sshguard. While I analyzed the behaviour I found out that pfctl -T show -t sshguard shows no result, but when I restart ssh guard via service sshguard restart I am able to see the folling output:

===>>> Initializing (null) firewall
===>>> Blocking 87.173.65.62 (null)
===>>> Blocking 37.228.134.110 (null)
===>>> Blocking 176.9.19.16 (null)
...
...

My /etc/sshguard includes the folloging entries:

sshguard_safety_threshold="8"
sshguard_danger_thresh="50"
sshguard_release_interval="600"
sshguard_reset_interval="7200"
sshguard_blacklist=100:/var/db/sshguard/blacklist.db
sshguard_watch_logs="/var/log/auth.log

In the auth.log I am able to see a lot of the following entries:
Attack from "62.116.168.227" on service 100 with danger 10.

Unfortunately I am notable to find any solution for this issue.

BR Marcus

Re: [SSHGuard-users] Blacklist and command line issue

[Jos C. <ssh...@cl...>]

On 11-12-2017 19:49, Kevin Zheng wrote:
> Are you saying that when you start SSHGuard from the command line, 
> nooutput appears? 

Kev,
Yes that is correct - when running sshguard from the prompt I get 
displays that a certain table is already existing (correct me if I am 
wrong) but when I then abandon that with Ctrl-C in my terminal session 
it stops any displaying but generate double entries in my blacklist.db 
file.
It indeed looks as if the process is not killed but the displays only?

Thanks,
Jos

-- With both feed on the ground you will never make a step forward

Re: [SSHGuard-users] Blacklist and command line issue

[Kevin Z. <kev...@gm...>]

On 12/11/2017 08:29, Jos Chrispijn wrote:
> Sometimes it occors that my blacklist.db contains double entries. Mostly
> that is caused by me, using the sshguard command stupidly redundant.
> In order to prevent such, would it be possible to scan running processes
> on sshguard whenever this sshguard command is given, so that only one
> process will be allowed? Dunno if that might affect VM use of sshguard.

I'll keep that in mind but I can't promise to work on it anytime soon.

The usual answer is for a daemon to always use a PID file, and not start
if the PID file is locked by another process.

A related change would be for SSHGuard to store a state file, keeping
track of currently blocked addresses, so that it remembers them when
after restarting. If the state file is similarly locked, SSHGuard would
know another instance of it has started.

> What I also noticed is that if I give a sshguard command from the
> command line, it takes ages before I get my prompt back with necessary
> command output. On which I give Ctrl-C which then may cause the first
> issue I described above.

Are you saying that when you start SSHGuard from the command line, no
output appears?

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Blacklist and command line issue

[Jos C. <ssh...@cl...>]

Sometimes it occors that my blacklist.db contains double entries. Mostly 
that is caused by me, using the sshguard command stupidly redundant.
In order to prevent such, would it be possible to scan running processes 
on sshguard whenever this sshguard command is given, so that only one 
process will be allowed? Dunno if that might affect VM use of sshguard.

What I also noticed is that if I give a sshguard command from the 
command line, it takes ages before I get my prompt back with necessary 
command output. On which I give Ctrl-C which then may cause the first 
issue I described above.

Thanks for your response,
Jos Chrispijn

-- With both feed on the ground you will never make a step forward

[SSHGuard-users] DNS Question

[Ryan R. <rr...@ro...>]

I am of the opinion that I don't mind users from anywhere on the
Internet using my servers such as DNS as long as they aren't abusing
them.  An approach to security is to try to stop people from gaining
access to something they shouldn't by using lots of ways to stop them. 
However, I'm still of the opinion that if one of my customers has a
stupid password setup like password and someone gains access to their
email and sends any email claiming they are them without permission the
person who owned the email address if they are a customer of mind should
be able to sue the person who acted like they were them and courts
should allow the offender to be punished for their crime.  We obviously
have a way to to to reach goals like that even if you don't think my
goals are correct.

However, that said, I'm seeing lots of evidence from my servers of
either hackers or even robots that are intentionally doing DNS queries
that burden my servers and others servers and I'd like to integrate some
of the capabilities of sshguard's log parsing to assist as I find tight
communication between sshd logs, my dns servers logs and IP's they've
seen abusing them and also mail server logs to be advantageous as there
are usually patterns of either before and or after or during attaching
ssh to attack dns and mail server services too.  With that in mind, is
there a way to add a file to sshguard or can I be pointed to the right
spot where I can search a line from a log for a pattern and use rules
similar to what you've already got and integrate that into sshguard.

Maybe something like

search string pattern including where in the line ip address info is of
potential remote attacker, rules regarding how many occurrences to
trigger temporary then permanent blacklist data.

Here are a few examples including DNS format errors stuff  I've been
seeing I'd like rules to search for and include in the sshguard
integration with firewalls as an example

-----------------------------------------

Dec  8 09:02:06 mail named[689]: DNS format error from x.x.x.x#53 resolving 1802812540-d97918ba5bda.cdn5.forter.com/AAAA for client y.y.y.y#10760: question section mismatch: got 1802812540-d97918ba5bda.cdn5.forter.com/IN/A
Dec  8 09:02:07 mail named[689]: DNS format error from x.x.x.x#53 resolving 1802812540-d97918ba5bda.cdn5.forter.com/AAAA for client y.y.y.y#10760: question section mismatch: got 1802812540-d97918ba5bda.cdn5.forter.com/IN/A
Dec  8 09:02:07 mail named[689]: DNS format error from x.x.x.x#53 resolving cdn5.forter.com/AAAA: question section mismatch: got cdn5.forter.com/IN/A
Dec  8 09:02:08 mail named[689]: DNS format error from x.x.x.x#53 resolving 1802812540-d97918ba5bda.cdn5.forter.com/AAAA for client y.y.y.y#10760: question section mismatch: got 1802812540-d97918ba5bda.cdn5.forter.com/IN/A
Dec  8 09:02:08 mail named[689]: DNS format error from x.x.x.x#53 resolving cdn5.forter.com/AAAA: question section mismatch: got cdn5.forter.com/IN/A
Dec  8 09:02:09 mail named[689]: DNS format error from x.x.x.x#53 resolving cdn5.forter.com/AAAA: question section mismatch: got cdn5.forter.com/IN/A
Dec  8 09:02:10 mail named[689]: DNS format error from x.x.x.x#53 resolving 1802812540-d97918ba5bda.cdn5.forter.com/AAAA for client y.y.y.y#10760: question section mismatch: got 1802812540-d97918ba5bda.cdn5.forter.com/IN/A
Dec  8 09:02:11 mail named[689]: DNS format error from x.x.x.x#53 resolving cdn5.forter.com/AAAA: question section mismatch: got cdn5.forter.com/IN/A
Dec  8 09:02:13 mail named[689]: DNS format error from x.x.x.x#53 resolving 1802812540-d97918ba5bda.cdn5.forter.com/AAAA for client y.y.y.y#10760: question section mismatch: got 1802812540-d97918ba5bda.cdn5.forter.com/IN/A
Dec  8 09:02:14 mail named[689]: DNS format error from x.x.x.x#53 resolving cdn5.forter.com/AAAA: question section mismatch: got cdn5.forter.com/IN/A
Dec  8 09:03:09 mail named[689]: DNS format error from z.z.z.z#53 resolving ns-cmn1.qq.com/AAAA: Name qq.com (SOA) not subdomain of zone ns-cmn1.qq.com -- invalid response
Dec  8 09:03:09 mail named[689]: DNS format error from z.z.z.z#53 resolving ns-cmn1.qq.com/AAAA: Name qq.com (SOA) not subdomain of zone ns-cmn1.qq.com -- invalid response

-----------------------------------------

In my situation although forter.com arguably has some DNS issues going
on as I likely do too attackers with their programs often using multiple
IP's take advantage of these alleged problems and seem to be
intentionally creating overhead on our systems and I'd like to myself
parse my logs and have the capability of both kindly notifying
forter.com of any potential actual problems and not just get rid of the
data, maybe a standard convention like sending a nice email to the
appropriately listed dns email contact(s) at forter.com but to also be
able to take action blocking at least dns service if not the entire ip
and inform other servers on my network to be suspicious and maybe use a
suspicious rule set with lower tolerance levels in next blocking ssh,
smtp, and other services.

If open source solutions already exist to do some of the things I'm
bringing up and sshguard isn't necessarily a good starting point and
something else out there that even integrates sshguard exists let me
know.  Obviously I'd like this to scale to shared database look-ups as
opposed to just single machine look-ups regarding ip abuse information
between servers.

Thanks,

Ryan Root

Root Automation

Re: [SSHGuard-users] SSHGuard 2.1.0 release announcement

[Kevin Z. <kev...@gm...>]

On 12/06/2017 11:37, Jos Chrispijn wrote:
> Is there a port maintainer who can respond?

I've submitted an update here, pending maintainer approval:

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224153

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] SSHGuard 2.1.0 release announcement

[Kevin Z. <kev...@gm...>]

On 12/06/2017 11:50, Jason de Cordoba wrote:
> Hey all!
> 
> Last time there was a major upgrade on FreeBSD it was a more draconian
> experience than graceful one...
> 
> In their defense, it was only lacking in documentation not
> implementation esp. the consolidation of the related fw ports into a
> single one and new config setup.

Some feedback on how to make breaking changes would be good for us.

The update from 1.7.1 to 2.0.0 was supposed to be breaking. The port
used to have several slave ports because the firewall selection was
compiled into the binary. Perhaps a better fix would have been to keep
the slave ports that each shipped with a different default configuration
file, but I thought that was more trouble than it was worth.

The breakage for running sshguard from syslog was intentional. Too many
users reported that syslogd would SIGHUP sshguard.

As always we appreciate feedback on how to make things better.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] SSHGuard 2.1.0 release announcement

[Jason de C. <ja...@av...>]

Hey all!

Last time there was a major upgrade on FreeBSD it was a more draconian
experience than graceful one...

In their defense, it was only lacking in documentation not
implementation esp. the consolidation of the related fw ports into a
single one and new config setup.

Good to see some FreeBSD folks here!
Oclair

On 12/6/17 20:37, Jos Chrispijn wrote:
> Is there a port maintainer who can respond?
> Thanks, Jos
>
> Op 2-12-2017 om 20:05 schreef Jos Chrispijn:
>> Dear team,,
>>
>> Thanks, that is good news!
>>
>> Just to inform you that currently sshguard-2.0.0_1  is the most
>> recent update of the FreeBSD ports collection.
>>
>> Dan, can you push 2.1.0 to our FreeBSD ports community?
>>
>> Thanks and keep up the good work,
>> BR, Jos
>>
>>
>> Op 9-11-2017 om 9:28 schreef Kevin Zheng:
>>> SSHGuard 2.1.0 is available.
>>>
>>> Added
>>> - Add **nftables** backend
>>> - Add monitoring support for new service: Cockpit, Linux server dashboard
>>> - Match "maximum authentication attempts" for SSH
>>> - Match Debian-style "Failed password for invalid user" for SSH
>>> - Add monitoring support for new service: Common webserver probes, in
>>> Common Log Format
>>> - Match 'Disconnecting invalid user' for SSH
>>> - Add monitoring support for new service: WordPress, in Common Log Format
>>> - Add monitoring support for new service: SSHGuard
>>> - Firewall backends now support blocking subnets.
>>> - Add new IPV6_SUBNET and IPV4_SUBNET configuration options. Defaults to
>>> traditional single-address blocking.
>>>
>>> Changed
>>> - Log whitelist matches with higher priority
>>>
>>> Fixed
>>> - Match port number in "invalid user" attack
>>> - FirewallD backend reloads firewall configuration less often.
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
> _______________________________________________
> sshguard-users mailing list
> ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] SSHGuard 2.1.0 release announcement

[Jos C. <ssh...@cl...>]

Is there a port maintainer who can respond?
Thanks, Jos

Op 2-12-2017 om 20:05 schreef Jos Chrispijn:
> Dear team,,
>
> Thanks, that is good news!
>
> Just to inform you that currently sshguard-2.0.0_1  is the most recent 
> update of the FreeBSD ports collection.
>
> Dan, can you push 2.1.0 to our FreeBSD ports community?
>
> Thanks and keep up the good work,
> BR, Jos
>
>
> Op 9-11-2017 om 9:28 schreef Kevin Zheng:
>> SSHGuard 2.1.0 is available.
>>
>> Added
>> - Add **nftables** backend
>> - Add monitoring support for new service: Cockpit, Linux server dashboard
>> - Match "maximum authentication attempts" for SSH
>> - Match Debian-style "Failed password for invalid user" for SSH
>> - Add monitoring support for new service: Common webserver probes, in
>> Common Log Format
>> - Match 'Disconnecting invalid user' for SSH
>> - Add monitoring support for new service: WordPress, in Common Log Format
>> - Add monitoring support for new service: SSHGuard
>> - Firewall backends now support blocking subnets.
>> - Add new IPV6_SUBNET and IPV4_SUBNET configuration options. Defaults to
>> traditional single-address blocking.
>>
>> Changed
>> - Log whitelist matches with higher priority
>>
>> Fixed
>> - Match port number in "invalid user" attack
>> - FirewallD backend reloads firewall configuration less often.

Re: [SSHGuard-users] SSHGuard 2.1.0 release announcement

[Jos C. <ssh...@cl...>]

Dear team,,

Thanks, that is good news!

Just to inform you that currently sshguard-2.0.0_1  is the most recent 
update of the FreeBSD ports collection.

Dan, can you push 2.1.0 to our FreeBSD ports community?

Thanks and keep up the good work,
BR, Jos


Op 9-11-2017 om 9:28 schreef Kevin Zheng:
> SSHGuard 2.1.0 is available.
>
> Added
> - Add **nftables** backend
> - Add monitoring support for new service: Cockpit, Linux server dashboard
> - Match "maximum authentication attempts" for SSH
> - Match Debian-style "Failed password for invalid user" for SSH
> - Add monitoring support for new service: Common webserver probes, in
> Common Log Format
> - Match 'Disconnecting invalid user' for SSH
> - Add monitoring support for new service: WordPress, in Common Log Format
> - Add monitoring support for new service: SSHGuard
> - Firewall backends now support blocking subnets.
> - Add new IPV6_SUBNET and IPV4_SUBNET configuration options. Defaults to
> traditional single-address blocking.
>
> Changed
> - Log whitelist matches with higher priority
>
> Fixed
> - Match port number in "invalid user" attack
> - FirewallD backend reloads firewall configuration less often.
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
> _______________________________________________
> sshguard-users mailing list
> ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

-- With both feed on the ground you will never make a step forward

Re: [SSHGuard-users] Service code clarification?

[Daniel A. <co...@da...>]

On Tue, Nov 14, 2017, at 22:06, Paul Bliss wrote:
> I was curious about the service codes listed at
> https://www.sshguard.net/docs/reference/service-codes/.
> 
> I get lots of blocks that are reporting a service code 260, which is not 
> listed in that document. Does anyone know what that is?

That document is outdated. I’ll look into updating it. In the meantime,
you can find version 2.1 service codes here:

https://bitbucket.org/sshguard/sshguard/src/0cafa052373608496fffcae1fae82924d092f7b9/src/common/attack.h?at=master&fileviewer=file-view-default#attack.h-27:46
-- 
Daniel Aleksandersen
https://www.daniel.priv.no/

Re: [SSHGuard-users] Service code clarification?

[Kevin Z. <kev...@gm...>]

On 11/14/2017 13:06, Paul Bliss wrote:
> Hey,
> 
>  I was curious about the service codes listed at
> https://www.sshguard.net/docs/reference/service-codes/.
> 
> I get lots of blocks that are reporting a service code 260, which is not
> listed in that document. Does anyone know what that is?

That's Postfix. I'll update the documentation.

The codes as documented in the sources are in src/common/attack.h.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Service code clarification?

[Paul B. <me...@me...>]

Hey,

  I was curious about the service codes listed at https://www.sshguard.net/docs/reference/service-codes/.

I get lots of blocks that are reporting a service code 260, which is not 
listed in that document. Does anyone know what that is?

Thanks!
Mechno

[SSHGuard-users] SSHGuard 2.1.0 release announcement

[Kevin Z. <kev...@gm...>]

SSHGuard 2.1.0 is available.

Added
- Add **nftables** backend
- Add monitoring support for new service: Cockpit, Linux server dashboard
- Match "maximum authentication attempts" for SSH
- Match Debian-style "Failed password for invalid user" for SSH
- Add monitoring support for new service: Common webserver probes, in
Common Log Format
- Match 'Disconnecting invalid user' for SSH
- Add monitoring support for new service: WordPress, in Common Log Format
- Add monitoring support for new service: SSHGuard
- Firewall backends now support blocking subnets.
- Add new IPV6_SUBNET and IPV4_SUBNET configuration options. Defaults to
traditional single-address blocking.

Changed
- Log whitelist matches with higher priority

Fixed
- Match port number in "invalid user" attack
- FirewallD backend reloads firewall configuration less often.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] SSHGuard 2.1 release candidate

[Daniel A. <co...@da...>]

Hello,

SSHGuard 2.1 is just around the corner. You can now grab the release candidate from SourceForge if you’re feeling like everything is going your way in life and you feel up for some adventure:

https://sourceforge.net/projects/sshguard/files/sshguard/2.0.99/

Please report any issues in the issue tracker:
https://bitbucket.org/sshguard/sshguard/issues?status=new&status=open

Here are some of the highlights of this release:

* New nftables sets firewall backend for Linux.
* New service for brute-force login attempts against Cockpit dashboard for Linux.
* New service for web app probes. Supports any server logging to NCIS common log format.
* New service for brute-force login attempts against WordPress’ wp-login.php from NCIS common log format logs.
* New service for SSHGuard lets you process and respond to logs from remote instances and block attackers across all your servers (e.g. using systemd-journal-remote). 
* LOGREADER and FILES log sources can now be configured and used at the same time.
* Can now block entire subnets in response to attacks. Subnet size configurable with new IPV6_SUBNET and IPV4_SUBNET options (default to one address). Notably, attacks from the same subnet isn’t yet detected as one attack-source, but this is likely to change in a future version.

Regards,
-- 
Daniel ‘da2x’ Aleksandersen
SSHGuard contributor
https://www.daniel.priv.no