sshguard-users — User questions and answers, bugs, and general support

Re: [SSHGuard-users] key exchange ssh not being blocked

[<li...@la...>]

I can't find the location of sshg-parser. The program isn't in my search path and I have looked in the obvious places.  On FreeBSD, sshguard is located in /usr/local/sbin. 

Once I have sshg-parser, I will feed it an archived log.




  Original Message  
From: Kevin Zheng
Sent: Thursday, May 25, 2017 5:33 PM
To: ssh...@li...
Subject: Re: [SSHGuard-users] key exchange ssh not being blocked

On 05/25/2017 17:04, li...@la... wrote:
> sshguard 1.7 is not catching key exchange ssh hacks. The number of
> fools attempting such a hack is small, but some are persistent. I've
> been blocking them by hand.

I can't reproduce your issue. Specifically, I checked out the 1.7.1
sshg-parser and ran:

$ echo "May 24 20:37:06 theranch sshd[60250]: fatal: Unable to negotiate
with 172.81.185.192 port 50267: no matching key exchange method found.
Their offer: diffie-hellman-group1-sha1 [preauth]" | sshg-parser

And got an attack.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] key exchange ssh not being blocked

[Kevin Z. <kev...@gm...>]

On 05/25/2017 17:04, li...@la... wrote:
> sshguard 1.7 is not catching key exchange ssh hacks. The number of
> fools attempting such a hack is small, but some are persistent. I've
> been blocking them by hand.

I can't reproduce your issue. Specifically, I checked out the 1.7.1
sshg-parser and ran:

$ echo "May 24 20:37:06 theranch sshd[60250]: fatal: Unable to negotiate
with 172.81.185.192 port 50267: no matching key exchange method found.
Their offer: diffie-hellman-group1-sha1 [preauth]" | sshg-parser

And got an attack.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] key exchange ssh not being blocked

[<li...@la...>]

sshguard 1.7 is not catching key exchange ssh hacks. The number of
fools attempting such a hack is small, but some are persistent. I've
been blocking them by hand.

# uname -a
FreeBSD theranch 10.3-RELEASE-p18 FreeBSD 10.3-RELEASE-p18 #0: Tue Apr 11 10:31:00 UTC 2017     ro...@am...:/usr/obj/usr/src/sys/GENERIC  amd64
# 

# pkg version -v | grep ssh
sshguard-ipfw-1.7.1                =   up-to-date with index

auth.log.0.bz2:May 24 20:37:06 theranch sshd[60250]: fatal: Unable to
negotiate with 172.81.185.192 port 50267: no matching key exchange
method found. Their offer: diffie-hellman-group1-sha1 [preauth]

Re: [SSHGuard-users] Do whitelist entries work inside the sshguard.conf file?

[Daniel A. <co...@da...>]

On Tuesday, 23 May 2017 04.45.01 CEST, Darshil Shah wrote:
> I've installed sshguard on a home server and was wondering if I 
> had set up whitelisting properly.
>
> What I have done is create a sshguard.conf file inside /etc and 
> have added a line and then restarted the sshguard service:
>
> # local ip whitelist
> -w local.ipaddress
>
> because I don't want to lock myself out when accessing from the 
> local network.
>
> Will this whitelist work? Or is a separate whitelist file required?

No. You can specify the -w argument on the command line, but you cannot 
include it in the configuration file. You’ll need to use a separate 
whitelist file.
-- 
Daniel Aleksandersen
https://daniel.priv.no/

[SSHGuard-users] Do whitelist entries work inside the sshguard.conf file?

[Darshil S. <Dar...@st...>]

Hello all,


I've installed sshguard on a home server and was wondering if I had set up whitelisting properly.


What I have done is create a sshguard.conf file inside /etc and have added a line and then restarted the sshguard service:


# local ip whitelist

-w local.ipaddress


because I don't want to lock myself out when accessing from the local network.


Will this whitelist work? Or is a separate whitelist file required?


Thanks everyone.

[SSHGuard-users] sshguard not detecting key exchange auth failure

[<li...@la...>]

Here is what shows up in auth.log. 

May 17 14:54:26 theranch sshd[53842]: fatal: Unable to negotiate with
103.207.39.38 port 62769: no matching key exchange method found. Their
offer: diffie-hellman-group1-sha1 [pre auth]

uname -a
FreeBSD theranch 10.3-RELEASE-p18 FreeBSD 10.3-RELEASE-p18 #0: Tue Apr 11 10:31:00 UTC 2017     ro...@am...:/usr/obj/usr/src/sys/GENERIC  amd64# 

sshguard -v
sshguard 1.7.1

FreeBSD is still on 1.7

[SSHGuard-users] SSHguard and IPFW

[jason h. <hi...@at...>]

Removing the pipe stopped Table 22 from being dumped

I guess I was wrong about that being the “permanent” jail 

All appears t be working right now

[SSHGuard-users] Fwd: SSHguard and IPFW

[jason h. <hi...@at...>]

> Begin forwarded message:
> 
> From: jason hirsh <hi...@at...>
> Subject: Re: [SSHGuard-users] SSHguard and IPFW
> Date: May 7, 2017 at 2:10:52 PM EDT
> To: Kevin Zheng <kev...@gm...>
> 
>> 
>> On May 7, 2017, at 1:52 PM, Kevin Zheng <kev...@gm... <mailto:kev...@gm...>> wrote:
>> 
>> On 05/07/2017 10:29, jason hirsh wrote:
>>> I am running FreeBSD 11 and IPFW.    I have found that every time my log is rotated the contents of Table 22 are cleaned.
>>> 
>>> I has assume that the blacklist.db was the volatile list and that the real bad guys were added to Table 22 by SSHGuard.  I was therefore adding know offenders to Table 22 .  If SSHGuard is going to cleanup Table 22 then I naturally need a different approach
>> 
>> It sounds like you might be running 1.7.1.
>> 
>> How do you have logging set up? You should use the '-l' argument to 
>> SSHGuard instead of piping from syslog, because when syslog rotates log 
>> files it sends SIGHUP to child processes. SSHGuard will clear out its 
>> ipfw table before exiting.
>> 
>> -- 
>> Kevin Zheng
>> kev...@gm... <mailto:kev...@gm...> | ke...@be... <mailto:ke...@be...> | PGP: 0xC22E1090
>> 
>> ———————
> 
> 
> Sorry about that.  Yes I am running 1.7.1. which is current version in FreeBSD ports
> 
> And I did do this as the SSHGuard install safe suggested
> auth.info <http://auth.info/>;authpriv.info <http://authpriv.info/>        |exec /path/to/sshguard
> 
> 
> I saw the part about flushing but I presumed that applied to blacklist not the table
> My mistake

Re: [SSHGuard-users] SSHguard and IPFW

[Kevin Z. <kev...@gm...>]

On 05/07/2017 10:29, jason hirsh wrote:
> I am running FreeBSD 11 and IPFW.    I have found that every time my log is rotated the contents of Table 22 are cleaned.
> 
> I has assume that the blacklist.db was the volatile list and that the real bad guys were added to Table 22 by SSHGuard.  I was therefore adding know offenders to Table 22 .  If SSHGuard is going to cleanup Table 22 then I naturally need a different approach

It sounds like you might be running 1.7.1.

How do you have logging set up? You should use the '-l' argument to 
SSHGuard instead of piping from syslog, because when syslog rotates log 
files it sends SIGHUP to child processes. SSHGuard will clear out its 
ipfw table before exiting.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] SSHguard and IPFW

[jason h. <hi...@at...>]

I am running FreeBSD 11 and IPFW.    I have found that every time my log is rotated the contents of Table 22 are cleaned.

I has assume that the blacklist.db was the volatile list and that the real bad guys were added to Table 22 by SSHGuard.  I was therefore adding know offenders to Table 22 .  If SSHGuard is going to cleanup Table 22 then I naturally need a different approach

Any ideas or insight would be appreciated

Re: [SSHGuard-users] Sshguard error message Received EOF from stdin

[jason h. <hi...@at...>]

> On May 7, 2017, at 9:01 AM, Daniel Aleksandersen <co...@da...> wrote:
> 
> On Sun, May 7, 2017, at 14:23, Jason Hirsh wrote:
>> I my logfiles show an error message
>> 
>> sshguard******]: Received EOF from stdin
>> 
>> Every hour on the hour. I have no idea what this is telling me if anything
> 
> What is your log source? A file? Then it looks like you run logrotate every hour on the hour. Immediately after a logrotate, your logfile will be empty and sshguard will see it as EOF. I’m assuming sshguard keeps working as expected?
> --
> Daniel Aleksandersen
> https://daniel.priv.no/



Duhhh never thought of that. 

Check cron and you got it right on

Yes sshguard appears to be working just fine 

Re: [SSHGuard-users] Sshguard error message Received EOF from stdin

[Daniel A. <co...@da...>]

On Sun, May 7, 2017, at 14:23, Jason Hirsh wrote:
> I my logfiles show an error message
> 
> sshguard******]: Received EOF from stdin
>
> Every hour on the hour. I have no idea what this is telling me if
> anything
What is your log source? A file? Then it looks like you run logrotate
every hour on the hour. Immediately after a logrotate, your logfile will
be empty and sshguard will see it as EOF. I’m assuming sshguard keeps
working as expected?-- 
Daniel Aleksandersen
https://daniel.priv.no/

[SSHGuard-users] Sshguard error message Received EOF from stdin

[jason h. <hi...@at...>]

I my logfiles show an error message

sshguard******]: Received EOF from stdin

Every hour on the hour.   I have no idea what this is telling me if anything


Thanks in advance

[SSHGuard-users] SSHGuard 2.0.0 release announcement

[Daniel A. <co...@da...>]

Hi all,

SSHGuard 2.0.0 has been released! Here are some of the highlights:

* sshguard.conf is now required and most configuration has moved here.
* New FirewallD, ipset, and ipfilter firewall backends for Linux.
* Support for Capsicum sandboxing on FreeBSD and pledge() on OpenBSD.
* All firewall backend scripts are now installed by default.

Read more highlights on the SSHGuard blog:
https://www.sshguard.net/litenewz/feeds/14

There has been a lot of changes to how SSHGuard is configured in this
release. Most notable, piped commands and runtime flags should be moved
from the init script to the permanent configuration file. The release
contains example configurations for systemd and the journal on Linux,
launchd and os_log on macOS, as well as a fully documented sshguard.conf
in examples/.

Maintainers and distributors should make sure to update their
distribution-specific configurations accordingly.

Get the release on SourceForge:
https://sourceforge.net/projects/sshguard/files/sshguard/2.0.0/

Ideas? Contributions? Bugs? Questions? Reach out through the bug tracker
or mailing lists!
https://bitbucket.org/sshguard/sshguard/issues
-- 
Daniel ‘da2x’ Aleksandersen

Re: [SSHGuard-users] Make errors in MacOS

[Kevin Z. <kev...@gm...>]

Hi Doug,

On 02/20/17 08:15, Doug Niven wrote:
> Hi Folks,
>
> Thanks to another list member, I’ve successfully used the following
> steps listed below to build a fresh copy of sshguard on MacOS Sierra
> machines.
>
> However, I’m now getting the following error at the ‘sudo make’ step,
> in both a VM with a fresh OS install as well as other up-to-date
> Sierra machines:
>
> sed -e 's|@libexecdir[@]|/usr/local/libexec|g' -e
> 's|@sysconfdir[@]|/usr/local/etc|g' -e
> 's|@sshguardversion[@]|2.0.0|g' ./sshguard.in > sshguard make[1]: ***
> No rule to make target `doc/sshguard-setup.7', needed by `all-am'.
> Stop. make: *** [all-recursive] Error 1
>
> I realize that SSHGuard 2 isn’t officially ready for prime time but
> figured I’d ask if this is something that can be fixed.

Thanks for pointing this out.

As the INSTALL.rst notes, if you're building from the source repository 
(and not a source distribution tarball) you need to have py-docutils 
installed to build the man pages.

There's some Automake logic that hides the man page build rules if 
rst2man is not available. We hid those so that end users without 
docutils should never run into a build error.

The proper fix might be to unconditionally keep the rule in the 
Makefile, but rely on the fact that `make dist` will include the 
prebuilt man page with the correct timestamp.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Make errors in MacOS

[Doug N. <dn...@uc...>]

Ah, nevermind. I need to stick with the stable releases, and 1.7.1 seems to be building and working just fine.

Cheers, Doug

> On Feb 20, 2017, at 8:15 AM, Doug Niven <dn...@uc...> wrote:
> 
> Hi Folks,
> 
> Thanks to another list member, I’ve successfully used the following steps listed below to build a fresh copy of sshguard on MacOS Sierra machines.
> 
> However, I’m now getting the following error at the ‘sudo make’ step, in both a VM with a fresh OS install as well as other up-to-date Sierra machines:
> 
> sed -e 's|@libexecdir[@]|/usr/local/libexec|g' -e 's|@sysconfdir[@]|/usr/local/etc|g' -e 's|@sshguardversion[@]|2.0.0|g' ./sshguard.in > sshguard
> make[1]: *** No rule to make target `doc/sshguard-setup.7', needed by `all-am'.  Stop.
> make: *** [all-recursive] Error 1
> 
> I realize that SSHGuard 2 isn’t officially ready for prime time but figured I’d ask if this is something that can be fixed.
> 
> Thanks!
> 
> Doug
> 
> ______________
> 
> Steps:
> 
> # To build:
> sudo mkdir -p /usr/local/src/
> sudo mkdir -p /usr/local/etc/
> sudo chown admin /usr/local/src/
> cd /usr/local/src/
> git clone https://bitbucket.org/sshguard/sshguard.git /usr/local/src/
> sshguard
> 
> cd /usr/local/src/
> sshguard
> 
> sudo autoreconf -i
> sudo ./configure --prefix=/usr/local
> sudo make
> sudo make install
> 
> 
> 
> sudo cp /usr/local/src/sshguard/examples/sshguard.conf.sample /usr/local/etc/
> sudo cp /usr/local/src/sshguard/examples/whitelistfile.example /usr/local/etc/
> sudo mv /usr/local/etc/sshguard.conf.sample /usr/local/etc/sshguard.conf
> 
> sudo mv /usr/local/etc/whitelistfile.example /usr/local/etc/whitelist
> 
> sudo cp /usr/local/src/sshguard/examples/net.sshguard.plist /Library/LaunchDaemons/
> sudo touch /usr/local/etc/
> blacklist
> 
> 
> sudo launchctl load -w /Library/LaunchDaemons/
> net.sshguard.plist
> 
> 
> # To update in future:
> cd /usr/local/src/
> sshguard
> 
> git pull
> 
> autoreconf 
> -i
> make
> clean
> .
> /configure --prefix=/usr/local
> make
> sudo make install

[SSHGuard-users] Make errors in MacOS

[Doug N. <dn...@uc...>]

Hi Folks,

Thanks to another list member, I’ve successfully used the following steps listed below to build a fresh copy of sshguard on MacOS Sierra machines.

However, I’m now getting the following error at the ‘sudo make’ step, in both a VM with a fresh OS install as well as other up-to-date Sierra machines:

sed -e 's|@libexecdir[@]|/usr/local/libexec|g' -e 's|@sysconfdir[@]|/usr/local/etc|g' -e 's|@sshguardversion[@]|2.0.0|g' ./sshguard.in > sshguard
make[1]: *** No rule to make target `doc/sshguard-setup.7', needed by `all-am'.  Stop.
make: *** [all-recursive] Error 1

I realize that SSHGuard 2 isn’t officially ready for prime time but figured I’d ask if this is something that can be fixed.

Thanks!

Doug

______________

Steps:

# To build:
sudo mkdir -p /usr/local/src/
sudo mkdir -p /usr/local/etc/
sudo chown admin /usr/local/src/
cd /usr/local/src/
git clone https://bitbucket.org/sshguard/sshguard.git /usr/local/src/
sshguard

cd /usr/local/src/
sshguard

sudo autoreconf -i
sudo ./configure --prefix=/usr/local
sudo make
sudo make install

 

sudo cp /usr/local/src/sshguard/examples/sshguard.conf.sample /usr/local/etc/
sudo cp /usr/local/src/sshguard/examples/whitelistfile.example /usr/local/etc/
sudo mv /usr/local/etc/sshguard.conf.sample /usr/local/etc/sshguard.conf

sudo mv /usr/local/etc/whitelistfile.example /usr/local/etc/whitelist

sudo cp /usr/local/src/sshguard/examples/net.sshguard.plist /Library/LaunchDaemons/
sudo touch /usr/local/etc/
blacklist
 

sudo launchctl load -w /Library/LaunchDaemons/
net.sshguard.plist
 

# To update in future:
cd /usr/local/src/
sshguard

git pull

autoreconf 
-i
make
 clean
.
/configure --prefix=/usr/local
make
sudo make install

Re: [SSHGuard-users] Fwd: Auth error ignored by sshguard

[<li...@la...>]

<html><head></head><body lang="en-US" style="background-color: rgb(255, 255, 255); line-height: initial;">                                                                                      <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">I see your point, but in reality, you will only be hit three times in a brute force attack. You won't get flooded. If they snowshoe, I suppose that is a different story.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">My VPS only allows a key based login on ssh, but their distribution of FreeBSD leaves the password login open. Not being familiar with FreeBSD or keygen type login, I didn't know to disable the password auth. But I figure that the list of IPs collected by sshguard is useful info in that it can be used to block other services.&nbsp;</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="font-size: initial; line-height: initial; text-align: initial;"><br></span></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="font-size: initial; line-height: initial; text-align: initial;">I can tell you that a full scan from zenmap will earn you a block from sshguard, so the IP gathering isn't exactly useless if you want to block probers. I ran zenmap as a pen test and blocked my own access. I had to tether through my phone to get back in and delete my IP from the table. </span></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="font-size: initial; line-height: initial; text-align: initial;"><br></span></div>                                                                                                                                     <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br style="display:initial"></div>                                                                                                                                                                                                   <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"></div>                                                                                                                                                                                  <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);">                           <div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;">  <div><b>From: </b>Reshey</div><div><b>Sent: </b>Tuesday, January 24, 2017 8:05 AM</div><div><b>To: </b>ssh...@li...</div><div><b>Subject: </b>[SSHGuard-users] Fwd:  Auth error ignored by sshguard</div></div></td></tr></tbody></table><div style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style=""><div dir="ltr">New to this mailing list thing. sorry if I sent it two times.<div><br><div class="gmail_quote">--Thank you for your replay<div dir="ltr"><div><br></div><div><div>I got sshguard working in OpenBSD 6.0.&nbsp;</div><div>It seems the problem was, I had enforced key based login for ssh.</div><div><br></div><div>Question : Is it possible for sshguard to ban bruteforcer, while having password login disabled?</div><div>sshguard bans user who fails password login, but does nothing to brutforcers who is trying while password login is disabled.</div><div>Attached log:</div><div><br></div><div># I hammer server from putty, with no key file. sshd is set to ONLY accept key based login. sshguard does not ban this "attacker".&nbsp;</div><div><br></div><div>Jan 24 16:03:12 wall sshd[99571]: Received disconnect from 176.11.88.222 port 49902:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:12 wall sshd[99571]: Disconnected from 176.11.88.222 port 49902 [preauth]</div><div>Jan 24 16:03:16 wall sshd[25553]: Received disconnect from 176.11.88.222 port 49903:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:16 wall sshd[25553]: Disconnected from 176.11.88.222 port 49903 [preauth]</div><div>Jan 24 16:03:21 wall sshd[78292]: Received disconnect from 176.11.88.222 port 49904:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:21 wall sshd[78292]: Disconnected from 176.11.88.222 port 49904 [preauth]</div><div>Jan 24 16:03:25 wall sshd[61028]: Received disconnect from 176.11.88.222 port 49905:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:25 wall sshd[61028]: Disconnected from 176.11.88.222 port 49905 [preauth]</div><div>Jan 24 16:03:28 wall sshd[47277]: Received disconnect from 176.11.88.222 port 49907:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:28 wall sshd[47277]: Disconnected from 176.11.88.222 port 49907 [preauth]</div><div>Jan 24 16:03:31 wall sshd[3940]: Received disconnect from 176.11.88.222 port 49908:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:31 wall sshd[3940]: Disconnected from 176.11.88.222 port 49908 [preauth]</div><div>Jan 24 16:03:34 wall sshd[94581]: Received disconnect from 176.11.88.222 port 49909:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:34 wall sshd[94581]: Disconnected from 176.11.88.222 port 49909 [preauth]</div><div>Jan 24 16:03:35 wall sshd[61363]: Connection closed by 123.183.209.132 port 64750 [preauth]</div><div>Jan 24 16:03:40 wall sshd[31923]: Received disconnect from 176.11.88.222 port 49910:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:40 wall sshd[31923]: Disconnected from 176.11.88.222 port 49910 [preauth]</div><div>Jan 24 16:03:46 wall sshd[13880]: Received disconnect from 176.11.88.222 port 49911:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:03:46 wall sshd[13880]: Disconnected from 176.11.88.222 port 49911 [preauth]</div><div>Jan 24 16:04:50 wall sshd[80716]: Received disconnect from 123.183.209.132 port 53406:11: &nbsp;[preauth]</div><div>Jan 24 16:04:50 wall sshd[80716]: Disconnected from 123.183.209.132 port 53406 [preauth]</div><div><br></div><div><br></div><div># I then changed sshd to accept password login, and restarted sshd.</div><div>Jan 24 16:05:22 wall sshd[75937]: Received signal 15; terminating.</div><div>Jan 24 16:05:22 wall sshd[73886]: Server listening on 0.0.0.0 port 22.</div><div>Jan 24 16:05:22 wall sshd[73886]: Server listening on :: port 22.</div><div><br></div><div># I continue o hammer from putty, at the sever. Now sshguard bans "attacker"</div><div><br></div><div>Jan 24 16:06:06 wall sshd[75413]: Failed password for xxx from 176.11.88.222 port 49945 ssh2</div><div>Jan 24 16:06:06 wall sshd[75413]: Received disconnect from 176.11.88.222 port 49945:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:06:06 wall sshd[75413]: Disconnected from 176.11.88.222 port 49945 [preauth]</div><div>Jan 24 16:06:06 wall sshd[18262]: Failed password for root from 123.183.209.132 port 61962 ssh2</div><div>Jan 24 16:06:07 wall sshd[18262]: Failed password for root from 123.183.209.132 port 61962 ssh2</div><div>Jan 24 16:06:09 wall sshd[35947]: Failed password for xxx from 176.11.88.222 port 49946 ssh2</div><div>Jan 24 16:06:09 wall sshd[35947]: Received disconnect from 176.11.88.222 port 49946:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:06:09 wall sshd[35947]: Disconnected from 176.11.88.222 port 49946 [preauth]</div><div>Jan 24 16:06:12 wall sshd[18262]: Received disconnect from 123.183.209.132 port 61962:11: &nbsp;[preauth]</div><div>Jan 24 16:06:12 wall sshd[18262]: Disconnected from 123.183.209.132 port 61962 [preauth]</div><div>Jan 24 16:06:12 wall sshd[29005]: Failed password for xxx from 176.11.88.222 port 49947 ssh2</div><div>Jan 24 16:06:12 wall sshd[29005]: Received disconnect from 176.11.88.222 port 49947:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:06:12 wall sshd[29005]: Disconnected from 176.11.88.222 port 49947 [preauth]</div><div>Jan 24 16:06:15 wall sshd[22704]: Failed password for xxx from 176.11.88.222 port 49948 ssh2</div><div>Jan 24 16:06:15 wall sshd[22704]: Received disconnect from 176.11.88.222 port 49948:11: Normal Shutdown, Thank you for playing [preauth]</div><div>Jan 24 16:06:15 wall sshd[22704]: Disconnected from 176.11.88.222 port 49948 [preauth]</div><div>Jan 24 16:06:15 wall sshguard[42310]: Blocking <a href="http://176.11.88.222:4" target="_blank">176.11.88.222:4</a> for &gt;630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses&nbsp;</div><div>over 9s)</div><div><br></div><div><br></div></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Jan 22, 2017 at 11:54 PM,  <span dir="ltr">&lt;<a href="mailto:li...@la..." target="_blank">li...@la...</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Ha, I am the only legitimate client. ;-) Besides, if I don't support the standard, nothing will get through. I caught some OVH VPS hammering my email server with an outmoded crypto, which was related to poodle and/or heartbleed.<br>
<a href="http://disablessl3.com/" rel="noreferrer" target="_blank">http://disablessl3.com/</a><br>
‎<br>
SHA1 is out of favor these days. Commercially they won't issue certs with SHA1.<br>
<a href="http://arstechnica.com/security/2016/05/microsoft-to-retire-support-for-sha1-certificates-in-the-next-4-months/" rel="noreferrer" target="_blank">http://arstechnica.com/securit<wbr>y/2016/05/microsoft-to-retire-<wbr>support-for-sha1-certificates-<wbr>in-the-next-4-months/</a><br>
<br>
One of those Chinese certs was "illegally" (as if certs have any legal standing) issuing SHA1 certs. WoSign I think.<br>
<br>
My philosophy is if someone is doing goofy stuff, block them. Today you can repel them, but tomorrow there may be a zero day. In any event, these clowns can flood a service.&nbsp;<br>
<br>
I've been reluctant to use the ipfw table 22 the sshguard generates for anything other than port 22, but I think I will add Web and email rules. Just not port 25 because that would probably block some legitimate email.&nbsp;<br>
<br>
‎I have a number of blocks on email other than port 25, and some days block 30 or so IP addresses trying to hack the ports. I traced one supposed hacker to a (cough cough) research team claiming to be doing a survey on email ports. They provided CIDRs, so I guess they were really doing research.‎ On the other hand, the University of Michigan attempts to &nbsp;mess with my imap on a daily basis, and attempts to contact them via email go nowhere. Obviously they get firewall blocked now except on 25.<br>
<br>
<br>
&nbsp; Original Message &nbsp;<br>
From: Daniel Aleksandersen<br>
Sent: Sunday, January 22, 2017 1:55 PM<br>
To: <a href="mailto:ssh...@li..." target="_blank">ssh...@li...urcefor<wbr>ge.net</a><br>
Subject: Re: [SSHGuard-users] Auth error ignored by sshguard<br>
<div class="m_-7452452538434328909HOEnZb"><div class="m_-7452452538434328909h5"><br>
On Sun, Jan 22, 2017, at 11:53, <a href="mailto:li...@la..." target="_blank">li...@la...</a> wrote:<br>
&gt; &gt;From FreeBsd auth.log:<br>
&gt; ------------------------------<wbr>----<br>
&gt; Jan 22 04:16:13 theranch sshd[48754]: fatal: Unable to negotiate with<br>
&gt; 198.50.142.115 port 57860: no matching key exchange method found. Their<br>
&gt; offer: diffie-hellman-group1-sha1 [pre auth]<br>
&gt; ---------------------<br>
&gt; I suppose this is an odd case for an ssh login attempt, but I figured<br>
&gt; I'd post it for what it is worth. Sshguard didn't block the IP. Now I<br>
&gt; suppose you can say if the key exchange method isn't supported, they<br>
&gt; will never get it, but it seems to me that could leave the system open<br>
&gt; to some exploit.<br>
<br>
Hm. Wouldn’t that potentially block some legitimate clients that are<br>
trying to negotiate a connection?<br>
<br>
&gt; I'm still on rev 1.7.<br>
&gt;<br>
&gt; IP is OVH. Oh, I'm shocked. ;-)<br>
--<br>
Daniel Aleksandersen<br>
<br>
------------------------------<wbr>------------------------------<wbr>------------------<br>
Check out the vibrant tech community on one of the world's most<br>
engaging tech sites, SlashDot.org! <a href="http://sdm.link/slashdot" rel="noreferrer" target="_blank">http://sdm.link/slashdot</a><br>
______________________________<wbr>_________________<br>
sshguard-users mailing list<br>
<a href="mailto:ssh...@li..." target="_blank">ssh...@li...urcefor<wbr>ge.net</a><br>
<a href="https://lists.sourceforge.net/lists/listinfo/sshguard-users" rel="noreferrer" target="_blank">https://lists.sourceforge.net/<wbr>lists/listinfo/sshguard-users</a><br>
<br>
------------------------------<wbr>------------------------------<wbr>------------------<br>
Check out the vibrant tech community on one of the world's most<br>
engaging tech sites, SlashDot.org! <a href="http://sdm.link/slashdot" rel="noreferrer" target="_blank">http://sdm.link/slashdot</a><br>
______________________________<wbr>_________________<br>
sshguard-users mailing list<br>
<a href="mailto:ssh...@li..." target="_blank">ssh...@li...urcefor<wbr>ge.net</a><br>
<a href="https://lists.sourceforge.net/lists/listinfo/sshguard-users" rel="noreferrer" target="_blank">https://lists.sourceforge.net/<wbr>lists/listinfo/sshguard-users</a><br>
</div></div></blockquote></div><br></div>
</div></div></div><br></div></div>
<br><!--end of _originalContent --></div></body></html>

[SSHGuard-users] Fwd: Auth error ignored by sshguard

[Reshey <re...@gm...>]

New to this mailing list thing. sorry if I sent it two times.

--Thank you for your replay

I got sshguard working in OpenBSD 6.0.
It seems the problem was, I had enforced key based login for ssh.

Question : Is it possible for sshguard to ban bruteforcer, while having
password login disabled?
sshguard bans user who fails password login, but does nothing to
brutforcers who is trying while password login is disabled.
Attached log:

# I hammer server from putty, with no key file. sshd is set to ONLY accept
key based login. sshguard does not ban this "attacker".

Jan 24 16:03:12 wall sshd[99571]: Received disconnect from 176.11.88.222
port 49902:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:12 wall sshd[99571]: Disconnected from 176.11.88.222 port
49902 [preauth]
Jan 24 16:03:16 wall sshd[25553]: Received disconnect from 176.11.88.222
port 49903:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:16 wall sshd[25553]: Disconnected from 176.11.88.222 port
49903 [preauth]
Jan 24 16:03:21 wall sshd[78292]: Received disconnect from 176.11.88.222
port 49904:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:21 wall sshd[78292]: Disconnected from 176.11.88.222 port
49904 [preauth]
Jan 24 16:03:25 wall sshd[61028]: Received disconnect from 176.11.88.222
port 49905:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:25 wall sshd[61028]: Disconnected from 176.11.88.222 port
49905 [preauth]
Jan 24 16:03:28 wall sshd[47277]: Received disconnect from 176.11.88.222
port 49907:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:28 wall sshd[47277]: Disconnected from 176.11.88.222 port
49907 [preauth]
Jan 24 16:03:31 wall sshd[3940]: Received disconnect from 176.11.88.222
port 49908:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:31 wall sshd[3940]: Disconnected from 176.11.88.222 port 49908
[preauth]
Jan 24 16:03:34 wall sshd[94581]: Received disconnect from 176.11.88.222
port 49909:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:34 wall sshd[94581]: Disconnected from 176.11.88.222 port
49909 [preauth]
Jan 24 16:03:35 wall sshd[61363]: Connection closed by 123.183.209.132 port
64750 [preauth]
Jan 24 16:03:40 wall sshd[31923]: Received disconnect from 176.11.88.222
port 49910:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:40 wall sshd[31923]: Disconnected from 176.11.88.222 port
49910 [preauth]
Jan 24 16:03:46 wall sshd[13880]: Received disconnect from 176.11.88.222
port 49911:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:03:46 wall sshd[13880]: Disconnected from 176.11.88.222 port
49911 [preauth]
Jan 24 16:04:50 wall sshd[80716]: Received disconnect from 123.183.209.132
port 53406:11:  [preauth]
Jan 24 16:04:50 wall sshd[80716]: Disconnected from 123.183.209.132 port
53406 [preauth]


# I then changed sshd to accept password login, and restarted sshd.
Jan 24 16:05:22 wall sshd[75937]: Received signal 15; terminating.
Jan 24 16:05:22 wall sshd[73886]: Server listening on 0.0.0.0 port 22.
Jan 24 16:05:22 wall sshd[73886]: Server listening on :: port 22.

# I continue o hammer from putty, at the sever. Now sshguard bans "attacker"

Jan 24 16:06:06 wall sshd[75413]: Failed password for xxx from
176.11.88.222 port 49945 ssh2
Jan 24 16:06:06 wall sshd[75413]: Received disconnect from 176.11.88.222
port 49945:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:06:06 wall sshd[75413]: Disconnected from 176.11.88.222 port
49945 [preauth]
Jan 24 16:06:06 wall sshd[18262]: Failed password for root from
123.183.209.132 port 61962 ssh2
Jan 24 16:06:07 wall sshd[18262]: Failed password for root from
123.183.209.132 port 61962 ssh2
Jan 24 16:06:09 wall sshd[35947]: Failed password for xxx from
176.11.88.222 port 49946 ssh2
Jan 24 16:06:09 wall sshd[35947]: Received disconnect from 176.11.88.222
port 49946:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:06:09 wall sshd[35947]: Disconnected from 176.11.88.222 port
49946 [preauth]
Jan 24 16:06:12 wall sshd[18262]: Received disconnect from 123.183.209.132
port 61962:11:  [preauth]
Jan 24 16:06:12 wall sshd[18262]: Disconnected from 123.183.209.132 port
61962 [preauth]
Jan 24 16:06:12 wall sshd[29005]: Failed password for xxx from
176.11.88.222 port 49947 ssh2
Jan 24 16:06:12 wall sshd[29005]: Received disconnect from 176.11.88.222
port 49947:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:06:12 wall sshd[29005]: Disconnected from 176.11.88.222 port
49947 [preauth]
Jan 24 16:06:15 wall sshd[22704]: Failed password for xxx from
176.11.88.222 port 49948 ssh2
Jan 24 16:06:15 wall sshd[22704]: Received disconnect from 176.11.88.222
port 49948:11: Normal Shutdown, Thank you for playing [preauth]
Jan 24 16:06:15 wall sshd[22704]: Disconnected from 176.11.88.222 port
49948 [preauth]
Jan 24 16:06:15 wall sshguard[42310]: Blocking 176.11.88.222:4 for
>630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses
over 9s)



On Sun, Jan 22, 2017 at 11:54 PM, <li...@la...> wrote:

> Ha, I am the only legitimate client. ;-) Besides, if I don't support the
> standard, nothing will get through. I caught some OVH VPS hammering my
> email server with an outmoded crypto, which was related to poodle and/or
> heartbleed.
> http://disablessl3.com/
> ‎
> SHA1 is out of favor these days. Commercially they won't issue certs with
> SHA1.
> http://arstechnica.com/security/2016/05/microsoft-to-retire-
> support-for-sha1-certificates-in-the-next-4-months/
>
> One of those Chinese certs was "illegally" (as if certs have any legal
> standing) issuing SHA1 certs. WoSign I think.
>
> My philosophy is if someone is doing goofy stuff, block them. Today you
> can repel them, but tomorrow there may be a zero day. In any event, these
> clowns can flood a service.
>
> I've been reluctant to use the ipfw table 22 the sshguard generates for
> anything other than port 22, but I think I will add Web and email rules.
> Just not port 25 because that would probably block some legitimate email.
>
> ‎I have a number of blocks on email other than port 25, and some days
> block 30 or so IP addresses trying to hack the ports. I traced one supposed
> hacker to a (cough cough) research team claiming to be doing a survey on
> email ports. They provided CIDRs, so I guess they were really doing
> research.‎ On the other hand, the University of Michigan attempts to  mess
> with my imap on a daily basis, and attempts to contact them via email go
> nowhere. Obviously they get firewall blocked now except on 25.
>
>
>   Original Message
> From: Daniel Aleksandersen
> Sent: Sunday, January 22, 2017 1:55 PM
> To: ssh...@li...
> Subject: Re: [SSHGuard-users] Auth error ignored by sshguard
>
> On Sun, Jan 22, 2017, at 11:53, li...@la... wrote:
> > >From FreeBsd auth.log:
> > ----------------------------------
> > Jan 22 04:16:13 theranch sshd[48754]: fatal: Unable to negotiate with
> > 198.50.142.115 port 57860: no matching key exchange method found. Their
> > offer: diffie-hellman-group1-sha1 [pre auth]
> > ---------------------
> > I suppose this is an odd case for an ssh login attempt, but I figured
> > I'd post it for what it is worth. Sshguard didn't block the IP. Now I
> > suppose you can say if the key exchange method isn't supported, they
> > will never get it, but it seems to me that could leave the system open
> > to some exploit.
>
> Hm. Wouldn’t that potentially block some legitimate clients that are
> trying to negotiate a connection?
>
> > I'm still on rev 1.7.
> >
> > IP is OVH. Oh, I'm shocked. ;-)
> --
> Daniel Aleksandersen
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> sshguard-users mailing list
> ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> sshguard-users mailing list
> ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

Re: [SSHGuard-users] FreeBSD still at rev 1.71

[jungle b. <jun...@gm...>]

On 01/23/2017 06:28 PM, li...@la... wrote:
> I just did a portsnap to double check. Rev 2 isn't in ports. I use
> sshguard-ipfw.
>

Makes sense. 2.0 is not released yet:
https://bitbucket.org/sshguard/sshguard/downloads?tab=tags

Re: [SSHGuard-users] FreeBSD still at rev 1.71

[Kevin Z. <kev...@gm...>]

On 01/23/17 18:28, li...@la... wrote:
> I just did a portsnap to double check. Rev 2 isn't in ports. I use
> sshguard-ipfw.

2.0.0 hasn't been released yet. Blocking on a pull request and keeping 
the configuration file format.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] FreeBSD still at rev 1.71

[<li...@la...>]

I just did a portsnap to double check. Rev 2 isn't in ports. I use
sshguard-ipfw.

Re: [SSHGuard-users] Auth error ignored by sshguard

[<li...@la...>]

Ha, I am the only legitimate client. ;-) Besides, if I don't support the standard, nothing will get through. I caught some OVH VPS hammering my email server with an outmoded crypto, which was related to poodle and/or heartbleed.
http://disablessl3.com/
‎
SHA1 is out of favor these days. Commercially they won't issue certs with SHA1.
http://arstechnica.com/security/2016/05/microsoft-to-retire-support-for-sha1-certificates-in-the-next-4-months/

One of those Chinese certs was "illegally" (as if certs have any legal standing) issuing SHA1 certs. WoSign I think.

My philosophy is if someone is doing goofy stuff, block them. Today you can repel them, but tomorrow there may be a zero day. In any event, these clowns can flood a service. 

I've been reluctant to use the ipfw table 22 the sshguard generates for anything other than port 22, but I think I will add Web and email rules. Just not port 25 because that would probably block some legitimate email. 

‎I have a number of blocks on email other than port 25, and some days block 30 or so IP addresses trying to hack the ports. I traced one supposed hacker to a (cough cough) research team claiming to be doing a survey on email ports. They provided CIDRs, so I guess they were really doing research.‎ On the other hand, the University of Michigan attempts to  mess with my imap on a daily basis, and attempts to contact them via email go nowhere. Obviously they get firewall blocked now except on 25.


  Original Message  
From: Daniel Aleksandersen
Sent: Sunday, January 22, 2017 1:55 PM
To: ssh...@li...
Subject: Re: [SSHGuard-users] Auth error ignored by sshguard

On Sun, Jan 22, 2017, at 11:53, li...@la... wrote:
> >From FreeBsd auth.log:
> ----------------------------------
> Jan 22 04:16:13 theranch sshd[48754]: fatal: Unable to negotiate with
> 198.50.142.115 port 57860: no matching key exchange method found. Their
> offer: diffie-hellman-group1-sha1 [pre auth]
> ---------------------
> I suppose this is an odd case for an ssh login attempt, but I figured
> I'd post it for what it is worth. Sshguard didn't block the IP. Now I
> suppose you can say if the key exchange method isn't supported, they
> will never get it, but it seems to me that could leave the system open
> to some exploit.

Hm. Wouldn’t that potentially block some legitimate clients that are
trying to negotiate a connection?

> I'm still on rev 1.7. 
> 
> IP is OVH. Oh, I'm shocked. ;-)
-- 
Daniel Aleksandersen

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] Auth error ignored by sshguard

[Daniel A. <co...@da...>]

On Sun, Jan 22, 2017, at 11:53, li...@la... wrote:
> >From FreeBsd auth.log:
> ----------------------------------
> Jan 22 04:16:13 theranch sshd[48754]: fatal: Unable to negotiate with
> 198.50.142.115 port 57860: no matching key exchange method found. Their
> offer: diffie-hellman-group1-sha1 [pre auth]
> ---------------------
> I suppose this is an odd case for an ssh login attempt, but I figured
> I'd post it for what it is worth. Sshguard didn't block the IP. Now I
> suppose you can say if the key exchange method isn't supported, they
> will never get it, but it seems to me that could leave the system open
> to some exploit.

Hm. Wouldn’t that potentially block some legitimate clients that are
trying to negotiate a connection?

> I'm still on rev 1.7. 
> 
> IP is  OVH. Oh, I'm shocked. ;-)
-- 
Daniel Aleksandersen

Re: [SSHGuard-users] sshguard fails to read and understand log?

[Daniel A. <co...@da...>]

On Sun, Jan 22, 2017, at 21:52, Reshey L. wrote:
> I have tried with 3x OpenBSD pc, to get sshguard working. I have
> manage to get bruteforce table to work with pf.conf and see blocked ip
> with pfctl -T show - bruteforce No result with pfctl -T show sshguard
> Only time I got result with pfctl -T show sshguard was wile haveing
> one xterm with sshguard in debuge mode and feed it attack signature
> from sshguard.org website example list, and before closing sshguard
> debuge mode running in another xterm pfctl cmd.  I have via OpenBSD
> irc channel at freenode heard a other using reporting just installing,
> copying the table into pf.conf, and update with pfctl, and rcctl
> enable sshguard, and rcctl start sshguard.  While running sshguard in
> debuge mode it got clear to me, It does manage to read
> /var/log/authlog ... but I have problem with the content of authlog..
> could this be something related to locals? These pc was setup during
> install with "no" norwegian keyboard, OpenBSD 6.0.


Could you please provide a log sample?



SSHGuard has no problem with my Norwegian locale under Linux, but I’m
using the 2.0 development branc. Could you please test your setup
against the current master branch? You can obtain the source and install
instructions from:
https://bitbucket.org/sshguard/sshguard/src



>  env SSHGUARD_DEBUG=foo /usr/local/sbin/sshguard -l /var/log/authlog
>  I then hammered ssh from putty on a windows pc, until this happend in
>  the debug window :  Stack now 0 Cleanup: discarding lookahead token
>  WORD () Stack now 0 Checking to refresh sources... Refreshing sources
>  showed 0 changes. Start polling. Searching for fd 4 in list. Starting
>  parse Entering state 0 Reading a token: --accepting rule at line 116
>  ("Jan 22 21:26:39 skylake su:") Next token is token SYSLOG_BANNER ()
>  Shifting token SYSLOG_BANNER () Entering state 3 Reading a token: --
>  accepting rule at line 221 (" ") --accepting rule at line 220
>  ("xxxxx") Next token is token WORD () Error: popping token
>  SYSLOG_BANNER () Stack now 0 Cleanup: discarding lookahead token WORD
>  () Stack now 0 Checking to refresh sources... Refreshing sources
>  showed 0 changes. Start polling.

>
-- 

Daniel Aleksandersen