sshguard-users — User questions and answers, bugs, and general support

Re: [SSHGuard-users] syslog-ng v3.5 with sshguard

[jungle B. <jun...@gm...>]

Hi Kevin,
On 12 August 2016 at 13:30, Kevin Zheng <kev...@gm...> wrote:
> On 08/08/2016 12:07, jungle Boogie wrote:
>> I'd like to use sshguard on a pine64 soc system with linux kernel
>> 3.10.102-2-pine64-longsleep.
>>
>> I have installed syslog-ng v3.5 from apt packages and I'm attempting
>> to configure sshguard + syslog-ng per this page:
>> http://www.sshguard.net/docs/setup/#syslog-ng
>
> I would recommend polling log files using sshg-logtail or the '-l'
> option instead. Syslog daemons have a habit of sending SIGHUP to
> SSHGuard at frequent intervals.
>

Where can I find information about sshg-logtail?
Do you have a working example of sshguard + iptables + persistent log
monitoring?

Right now I'm doing:
/usr/local/sbin/sshguard -a 10 -l /var/log/auth.log -p 6000 &

This works but won't work after rebooting.

> Best,
> Kevin

Thanks!

>
> --
> Kevin Zheng
> kev...@gm... | ke...@be... | PGP: 0xC22E1090
>

-------
inum: 883510009027723
sip: jun...@si...

Re: [SSHGuard-users] syslog-ng v3.5 with sshguard

[Kevin Z. <kev...@gm...>]

On 08/08/2016 12:07, jungle Boogie wrote:
> I'd like to use sshguard on a pine64 soc system with linux kernel
> 3.10.102-2-pine64-longsleep.
> 
> I have installed syslog-ng v3.5 from apt packages and I'm attempting
> to configure sshguard + syslog-ng per this page:
> http://www.sshguard.net/docs/setup/#syslog-ng

I would recommend polling log files using sshg-logtail or the '-l'
option instead. Syslog daemons have a habit of sending SIGHUP to
SSHGuard at frequent intervals.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] [OT] blocking TOR

[<li...@la...>]

I noticed some of the IP addresses blocked by SSHGUARD were TOR exit
nodes. Potentially some hacker could be switching between exit nodes or
maybe just using different IP addresses within the address space of the
CIDR. If so, that would get around the repetition needed to trigger
SSHGUARD.

This is a simple five line script to block TOR. Put the lines in a file
and then call the script from chron since the exit nodes are dynamic.
I run it hourly, though TOR does not indicate what schedule is
sufficient. 
----------------------
wget https://check.torproject.org/exit-addresses
sed '/ExitNode/d; /Published/d; /LastStatus/d; s/ExitAddress //' <exit-addresses | cut -w -f-1 >feedipfw
ipfw  table 2 flush
cat feedipfw | xargs -n1 echo ipfw table 2 add | bash
rm exit-addresses
-----------------------

The flow is you get the list from the TOR project, strip out everything
but the CIDR from the TOR list, put that data into a table. Use a
similar line in your firewall to how sshguard is implemented.
Obviously pick a table number you aren't using.

That funky use of "echo" in the 4th line is a trick to keep the xargs
running should there be something that cuases the ipfw command to
fail, such as a duplicate entry. 

[SSHGuard-users] syslog-ng v3.5 with sshguard

[jungle B. <jun...@gm...>]

Hi All,

I'd like to use sshguard on a pine64 soc system with linux kernel
3.10.102-2-pine64-longsleep.

I have installed syslog-ng v3.5 from apt packages and I'm attempting
to configure sshguard + syslog-ng per this page:
http://www.sshguard.net/docs/setup/#syslog-ng


I believe there may be an issue with this line:

log { source(src); filter(f_sshguard); destination(sshguard); };

When that line is present in /etc/syslog-ng/syslog-ng.conf, I get this
when restarting syslog-ng:

sudo /etc/init.d/syslog-ng restart
Restarting syslog-ng (via systemctl): syslog-ng.serviceJob for
syslog-ng.service failed. See 'systemctl status syslog-ng.service' and
'journalctl -xn' for details.
 failed!

$ sudo systemctl status syslog-ng.service
â syslog-ng.service - System Logger Daemon
   Loaded: loaded (/lib/systemd/system/syslog-ng.service; enabled)
   Active: failed (Result: start-limit) since Mon 2016-08-08 19:03:05
UTC; 27s ago
     Docs: man:syslog-ng(8)
  Process: 32137 ExecStart=/usr/sbin/syslog-ng -F (code=exited, status=2)
 Main PID: 32137 (code=exited, status=2)
   Status: "Starting up... (Mon Aug  8 19:03:05 2016"

Aug 08 19:03:05 pine64 systemd[1]: Unit syslog-ng.service entered failed state.
Aug 08 19:03:05 pine64 systemd[1]: syslog-ng.service holdoff time
over, scheduling restart.
Aug 08 19:03:05 pine64 systemd[1]: Stopping System Logger Daemon...
Aug 08 19:03:05 pine64 systemd[1]: Starting System Logger Daemon...
Aug 08 19:03:05 pine64 systemd[1]: syslog-ng.service start request
repeated too quickly, refusing to start.
Aug 08 19:03:05 pine64 systemd[1]: Failed to start System Logger Daemon.
Aug 08 19:03:05 pine64 systemd[1]: Unit syslog-ng.service entered failed state.



Anyone have a valid log entry I can use for syslog 3.5?

Thanks!

-- 
-------
inum: 883510009027723
sip: jun...@si...

[SSHGuard-users] SSHGuard 1.7.0 release announcement

[Kevin Z. <kev...@gm...>]

Greetings,

SSHGuard 1.7.0 is available:
https://sourceforge.net/projects/sshguard/files/sshguard/1.7.0/

Added
    Add sshg-logtail
    Add sshg-parser
    Control firewall using sshg-fw
    Match "no matching key exchange method" for SSH

Deprecated
    Hosts backend is deprecated
    Logsuck (-l option) is deprecated, use sshg-logtail instead
    Process validation (-f option) is deprecated

Removed
    Remove external hooks (-e option)
    Remove support for genfilt and ipfilter backends

Fixed
    Accept socklog messages without a timestamp
    Fix excessive logging causing endless looping in logsuck
    Fix undefined assignment of initial inode number

Note on deprecation: Deprecated features will be removed in the next
non-bugfix release. If you would like to nominate a feature to be
un-deprecated, contact the project mailing list.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Flush Blacklist

[Kevin Z. <kev...@gm...>]

On 08/05/2016 02:40, Jos Chrispijn wrote:
>> LogSuck is slated to be taken out as soon as the 1.7.0 release is out.
> 
> I too think that the less external/additional programs SSHGuard uses,
> the better you can handle your bugs and issues. For the use of certain
> programmers libraries I cannot speak as I am not a programmer :-)

LogSuck isn't an external program or library, but a nickname for the
part of SSHGuard that currently polls log files.

It's historically somewhat buggy and hard to get the platform-specific
parts right (kqueue, select, poll, etc.) and is essentially a glorified
implementation of what `tail` already does, so it'll be ripped out and
replaced with an exec to `tail`. I hope your system has one :)

> Btw: Is there any way that I can contribute by donation?

I don't know if anyone is taking donations. You should ask Michele
(mi...@ss..., CC'd).

Thanks,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Flush Blacklist

[Jos C. <ssh...@cl...>]

In een bericht van 4-8-2016 23:17:

> LogSuck is slated to be taken out as soon as the 1.7.0 release is out.

I too think that the less external/additional programs SSHGuard uses, 
the better you can handle your bugs and issues. For the use of certain 
programmers libraries I cannot speak as I am not a programmer :-)

Btw: Is there any way that I can contribute by donation?

Best regards,
Jos

Re: [SSHGuard-users] Flush Blacklist

[Kevin Z. <kev...@gm...>]

On 08/04/2016 14:08, mai...@ne... wrote:
> Do you have more information about this bug ?
> What exactly is Logsuck ?

LogSuck is essentially an internal implementation of `tail -n 0 -F`.
SSHGuard uses it when you pass the '-l' argument to monitor logs.

1.6.4 introduced a bug in LogSuck that will be fixed in the next
release, planned tentatively for August 12th.

The workaround is to avoid using LogSuck by piping `tail -n 0 -F` into
SSHGuard.

LogSuck is slated to be taken out as soon as the 1.7.0 release is out.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Flush Blacklist

[<mai...@ne...>]

Hello Kevin,

thank you very much for your fast reply.

> I remember this bug has come up before. What version of SSHGuard are you
> using? 

FreeBSD 10.3 uses SSHGuard 1.6.4.

Do you have more information about this bug ?
What exactly is Logsuck ?

BR Marc

Re: [SSHGuard-users] Flush Blacklist

[Kevin Z. <kev...@gm...>]

On 08/04/2016 13:04, mai...@ne... wrote:
> Right now I am not able to delete IP addresses from the blacklist. I
> already deleted the sshguard database at
> /var/db/sshguard/blacklist.db and I flushed the pf table „sshguard“.
> The problem is that as soon as I restart the sshguard service via
> „service sshguard restart“ it seems to be that sshguard inspect the
> old log file again and add the same old ip addresses to the database
> which leads to blocking the old ip addresses I deleted before.

I remember this bug has come up before. What version of SSHGuard are you
using? I suspect it's a bug that's since been fixed in LogSuck. You can
work around this issue until the next release by piping the logs to
SSHGuard (e.g. tail -F -n 0 /var/log/auth.log | sshguard ...).

> The suspect thing is that the blacklist is used even I didn’t set any
> parameter in the rc.conf.

Yes, the FreeBSD rc.d script (/usr/local/bin/rc.d/sshguard) enables
blacklisting by default.

> Is there any official way to permanent delete some IP addresses from
> the blacklist without manipulating the system log ?

No, because the behavior you're reporting is a bug :)

SSHGuard *should* never read log entries that came before it started.

Thanks,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Flush Blacklist

[<mai...@ne...>]

Hallo,

I use sshguard via rc.conf under FreeBSD 10.3.

Right now I am not able to delete IP addresses from the blacklist. I already deleted the sshguard database at /var/db/sshguard/blacklist.db and I flushed the pf table „sshguard“. The problem is that as soon as I restart the sshguard service via „service sshguard restart“ it seems to be that sshguard inspect the old log file again and add the same old ip addresses to the database which leads to blocking the old ip addresses I deleted before.

The suspect thing is that the blacklist is used even I didn’t set any parameter in the rc.conf.

Is there any official way to permanent delete some IP addresses from the blacklist without manipulating the system log ?


   BR Marc 

Re: [SSHGuard-users] Failed to block

[Mark F. <fe...@Fr...>]

On Tue, Aug 2, 2016, at 14:04, li...@la... wrote:
> But is their fu to insure the daemon is up an running before the next
> service is started?
> 

No, but I will add it in the next update.

-- 
  Mark Felder
  ports-secteam member
  fe...@Fr...

Re: [SSHGuard-users] Failed to block

[<li...@la...>]

But is their fu to insure the daemon is up an running before the next service is started?

I know initd and systemd, but it rcd

But in the end, does this matter? If some IP is hammering 22, it will eventually be caught. So maybe during startup it will take an extra "offense" or two before it gets blocked.

  Original Message  
From: Jos Chrispijn
Sent: Tuesday, August 2, 2016 9:59 AM
To: ssh...@li...
Subject: Re: [SSHGuard-users] Failed to block

In een bericht van 1-8-2016 22:38:

> As root, run: service -e

On BSD i ran it - ipfw comes for sshguard

-> /etc/rc.d/ipfw
/etc/rc.d/newsyslog
/etc/rc.d/syslogd
/etc/rc.d/ntpdate
/etc/rc.d/dmesg
/etc/rc.d/virecover
/etc/rc.d/motd
-> /usr/local/etc/rc.d/sshguard

--- cut ---

best, Jos

------------------------------------------------------------------------------
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] Failed to block

[Jos C. <ssh...@cl...>]

In een bericht van 1-8-2016 22:38:

> As root, run: service -e

On BSD i ran it - ipfw comes for sshguard

-> /etc/rc.d/ipfw
/etc/rc.d/newsyslog
/etc/rc.d/syslogd
/etc/rc.d/ntpdate
/etc/rc.d/dmesg
/etc/rc.d/virecover
/etc/rc.d/motd
-> /usr/local/etc/rc.d/sshguard

--- cut ---

best, Jos

Re: [SSHGuard-users] Failed to block

[Mark F. <fe...@Fr...>]

On Mon, Aug 1, 2016, at 13:00, Kevin Zheng wrote:
> On 08/01/2016 10:56, Jos Chrispijn wrote:
> > What is displayed in dmesg is the text that is display during a system 
> > restart - no address blocking required as the server is in its startup 
> > phase.
> 
> Ahh, so you're running 1.6.4 from ports? How are you starting SSHGuard?
> Via the rc.d script or syslog? Does this message only appear when the
> machine is starting up? Does it show up when you restart SSHGuard
> without restarting the system?
> 

Actually I'm seeing this now as well, but I have a well populated table
in IPFW so I'm not sure it's really failing to block these incidents.


-- 
  Mark Felder
  ports-secteam member
  fe...@Fr...

Re: [SSHGuard-users] Failed to block

[Gerard S. <car...@ou...>]

On Mon, 1 Aug 2016 13:10:28 -0700, li...@la... stated:

>Can yo‎u elaborate a bit more. I gather the idea is for sshguard not
>to start until ipfw is running. How is that enforced under freebsd?
>Shouldn't that already be set up in the script for the daemon? 

As root, run: service -e

Check the output. On my system, IPFW is started well before sshguard.

-- 
Carmel

Re: [SSHGuard-users] Failed to block

[Mark F. <fe...@Fr...>]

On Mon, Aug 1, 2016, at 15:10, li...@la... wrote:
> Can yo‎u elaborate a bit more. I gather the idea is for sshguard not to
> start until ipfw is running. How is that enforced under freebsd?
> Shouldn't that already be set up in the script for the daemon? 
> 

It's not currently enforced, so I will push a fix for that. It would be
odd for sshguard to be able to start before ipfw, but not impossible.


-- 
  Mark Felder
  ports-secteam member
  fe...@Fr...

Re: [SSHGuard-users] Failed to block

[<li...@la...>]

Can yo‎u elaborate a bit more. I gather the idea is for sshguard not to start until ipfw is running. How is that enforced under freebsd? Shouldn't that already be set up in the script for the daemon? 

  Original Message  
From: Mark Felder
Sent: Monday, August 1, 2016 12:53 PM
To: Jos Chrispijn
Cc: ssh...@li...
Subject: Re: [SSHGuard-users] Failed to block


> On Aug 1, 2016, at 14:24, Jos Chrispijn <ssh...@cl...> wrote:
> 
> In een bericht van 1-8-2016 20:50:
> 
>> I'll hazard a guess that SSHGuard is being started before the firewall
>> has been brought up.
>> 
>> Can you try adding 'ipfw' to the REQUIRE line in
>> /usr/local/etc/rc.d/sshguard and testing again?
> 
> I will and let you know, thanks.
> 
> BR, Jos
> 


Also check the order of services with "service -r" command. That will help identify what the system thinks the service order is going to be. We should probably add ipfw and pf to the REQUIRE line regardless.


--
Mark Felder
ports-secteam member
fe...@Fr...


------------------------------------------------------------------------------
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] Failed to block

[Mark F. <fe...@Fr...>]

> On Aug 1, 2016, at 14:24, Jos Chrispijn <ssh...@cl...> wrote:
> 
> In een bericht van 1-8-2016 20:50:
> 
>> I'll hazard a guess that SSHGuard is being started before the firewall
>> has been brought up.
>> 
>> Can you try adding 'ipfw' to the REQUIRE line in
>> /usr/local/etc/rc.d/sshguard and testing again?
> 
> I will and let you know, thanks.
> 
> BR, Jos
> 


Also check the order of services with "service -r" command. That will help identify what the system thinks the service order is going to be. We should probably add ipfw and pf to the REQUIRE line regardless.


--
  Mark Felder
  ports-secteam member
  fe...@Fr...

Re: [SSHGuard-users] Failed to block

[Jos C. <ssh...@cl...>]

In een bericht van 1-8-2016 20:50:

> I'll hazard a guess that SSHGuard is being started before the firewall
> has been brought up.
>
> Can you try adding 'ipfw' to the REQUIRE line in
> /usr/local/etc/rc.d/sshguard and testing again?

I will and let you know, thanks.

BR, Jos

Re: [SSHGuard-users] Failed to block

[Kevin Z. <kev...@gm...>]

On 08/01/2016 11:08, Jos Chrispijn wrote:
>> Ahh, so you're running 1.6.4 from ports? How are you starting SSHGuard?
>> Via the rc.d script or syslog?
> 
> sshguard_enable="YES"
> sshguard_blacklist="40:/var/db/sshguard/blacklist.db"
> sshguard_whitelistfile="/usr/local/etc/sshguard.whitelist"
> 
>> Does this message only appear when the machine is starting up?
> Yes that is correct. Only then (not on the system prompt after)
> 
> Does it show up when you restart SSHGuard without restarting the system?
> Nope

I'll hazard a guess that SSHGuard is being started before the firewall
has been brought up.

Can you try adding 'ipfw' to the REQUIRE line in
/usr/local/etc/rc.d/sshguard and testing again?

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Failed to block

[Jos C. <ssh...@cl...>]

In een bericht van 1-8-2016 20:00:

> Ahh, so you're running 1.6.4 from ports? How are you starting SSHGuard?
> Via the rc.d script or syslog?

sshguard_enable="YES"
sshguard_blacklist="40:/var/db/sshguard/blacklist.db"
sshguard_whitelistfile="/usr/local/etc/sshguard.whitelist"

> Does this message only appear when the machine is starting up?
Yes that is correct. Only then (not on the system prompt after)

Does it show up when you restart SSHGuard without restarting the system?
Nope

Best regards,
Jos

Re: [SSHGuard-users] Failed to block

[Kevin Z. <kev...@gm...>]

On 08/01/2016 10:56, Jos Chrispijn wrote:
> What is displayed in dmesg is the text that is display during a system 
> restart - no address blocking required as the server is in its startup 
> phase.

Ahh, so you're running 1.6.4 from ports? How are you starting SSHGuard?
Via the rc.d script or syslog? Does this message only appear when the
machine is starting up? Does it show up when you restart SSHGuard
without restarting the system?

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Failed to block

[Jos C. <ssh...@cl...>]

Hello Kevin,

In een bericht van 1-8-2016 17:46:
> On 08/01/2016 02:42, Jos Chrispijn wrote:
>> After restarting my server for maintenance, I saw this in dmesg file:
>>
>> /Jul 31 18:08:39 ares sshguard[720]: fw: failed to block (-1)/
>>
>> Can you tell me what this means?
>
> SSHGuard failed to flush its pipe to sshg-fw when trying to block an
> address. Did you run `make install`?
>
> Some more information like 'configure' command line would be useful for
> figuring out what went wrong.

What is displayed in dmesg is the text that is display during a system 
restart - no address blocking required as the server is in its startup 
phase.

How do I use the configure sshguard? I did install it running make 
config first (resulting in "No options to configure") and then running 
make install clean.

I have sshguard-ipfw-1.6.4_1 up-and-running currently.

Best regards,
Jos

Re: [SSHGuard-users] Failed to block

[Kevin Z. <kev...@gm...>]

On 08/01/2016 02:42, Jos Chrispijn wrote:
> After restarting my server for maintenance, I saw this in dmesg file:
> 
> /Jul 31 18:08:39 ares sshguard[720]: fw: failed to block (-1)/
> 
> Can you tell me what this means?

SSHGuard failed to flush its pipe to sshg-fw when trying to block an
address. Did you run `make install`?

Some more information like 'configure' command line would be useful for
figuring out what went wrong.

Thanks,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090