sshguard-users — User questions and answers, bugs, and general support

Re: [SSHGuard-users] Call for testing: SSHGuard 1.7.0

[Kevin Z. <kev...@gm...>]

On 07/26/2016 16:27, li...@la... wrote:
> You should probably state your OS and rev. I only got the strcpy
> warning. That was on freebsd 10.2 with the ipfw option.

It's a combination of Bison and GCC. I didn't get your strcpy warning
because I was using yacc. I didn't get the GCC warning because I was
running clang.

I'll have to remember to test with different yaccs and compilers.

Thanks,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Call for testing: SSHGuard 1.7.0

[<li...@la...>]

You should probably state your OS and rev. I only got the strcpy warning. That was on freebsd 10.2 with the ipfw option.

  Original Message  
From: Georg Lehner
Sent: Tuesday, July 26, 2016 3:59 PM
To: ssh...@li...
Subject: Re: [SSHGuard-users] Call for testing: SSHGuard 1.7.0

On 12/07/16 19:05, Kevin Zheng wrote:
> Hi there,
>
> Some non-trivial firewall backend changes have landed in the 'master'
> branch of SSHGuard. I've been able to test the pf and ipfw backends, but
> the iptables backend needs testing!
>
> Briefly, SSHGuard now controls the firewall using a script, 'sshg-fw'
> that reads commands from standard input (e.g. 'block 1.2.3.4') and runs
> the appropriate firewall commands. This should make adding new backends
> as well as custom hooks easier.
>
> If you're able and willing to test, your feedback is appreciated!
>
> Best,
> Kevin
>
Hello,

I tried to step forward with iptables testing, but am unable to compile 
sshguard. After following 
http://www.sshguard.net/docs/setup/compile-install/ I get the below errors.

Note: this has not been an issue about two weeks before.

Best Regards,

Georg Lehner

- - -
Making all in src
make[1]: Entering directory '/home/jorge/progs/sshguard/src'
make all-am
make[2]: Entering directory '/home/jorge/progs/sshguard/src'
CC parser/attack_parser.o
parser/attack_parser.y: In function ‘yyparse’:
parser/attack_parser.y:192:25: warning: implicit declaration of function 
‘strcpy’ [-Wimplicit-function-declaration]
strcpy(attack->address.value, $1);
^
parser/attack_parser.y:192:25: warning: incompatible implicit 
declaration of built-in function ‘strcpy’
parser/attack_parser.y:196:25: warning: incompatible implicit 
declaration of built-in function ‘strcpy’
strcpy(attack->address.value, $1);
^
parser/attack_parser.y: In function ‘yyerror’:
parser/attack_parser.y:299:1: error: number of arguments doesn’t match 
prototype
static void yyerror() { /* do nothing */ }
^
parser/attack_parser.y:34:13: error: prototype declaration
static void yyerror(attack_t *attack, const char *msg);
^
Makefile:606: recipe for target 'parser/attack_parser.o' failed
make[2]: *** [parser/attack_parser.o] Error 1
make[2]: Leaving directory '/home/jorge/progs/sshguard/src'
Makefile:342: recipe for target 'all' failed
make[1]: *** [all] Error 2
make[1]: Leaving directory '/home/jorge/progs/sshguard/src'
Makefile:335: recipe for target 'all-recursive' failed
make: *** [all-recursive] Error 1


------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] Call for testing: SSHGuard 1.7.0

[Kevin Z. <kev...@gm...>]

On 07/26/2016 15:57, Georg Lehner wrote:
> I tried to step forward with iptables testing, but am unable to compile 
> sshguard.  After following 
> http://www.sshguard.net/docs/setup/compile-install/ I get the below errors.
> 
> Note: this has not been an issue about two weeks before.

Thanks for the report. I've pushed some changes to 'master' that should
fix this issue. I have another report [1] that sshg-fw fails at run-time
with the iptables backend. Let me know if you hit this issue, and if you
know how to fix it.

Thanks,
Kevin

[1] https://bitbucket.org/sshguard/sshguard/issues/39/

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Call for testing: SSHGuard 1.7.0

[Georg L. <jor...@ma...>]

On 12/07/16 19:05, Kevin Zheng wrote:
> Hi there,
>
> Some non-trivial firewall backend changes have landed in the 'master'
> branch of SSHGuard. I've been able to test the pf and ipfw backends, but
> the iptables backend needs testing!
>
> Briefly, SSHGuard now controls the firewall using a script, 'sshg-fw'
> that reads commands from standard input (e.g. 'block 1.2.3.4') and runs
> the appropriate firewall commands. This should make adding new backends
> as well as custom hooks easier.
>
> If you're able and willing to test, your feedback is appreciated!
>
> Best,
> Kevin
>
Hello,

I tried to step forward with iptables testing, but am unable to compile 
sshguard.  After following 
http://www.sshguard.net/docs/setup/compile-install/ I get the below errors.

Note: this has not been an issue about two weeks before.

Best Regards,

   Georg Lehner

- - -
Making all in src
make[1]: Entering directory '/home/jorge/progs/sshguard/src'
make  all-am
make[2]: Entering directory '/home/jorge/progs/sshguard/src'
   CC       parser/attack_parser.o
parser/attack_parser.y: In function ‘yyparse’:
parser/attack_parser.y:192:25: warning: implicit declaration of function 
‘strcpy’ [-Wimplicit-function-declaration]
                          strcpy(attack->address.value, $1);
                          ^
parser/attack_parser.y:192:25: warning: incompatible implicit 
declaration of built-in function ‘strcpy’
parser/attack_parser.y:196:25: warning: incompatible implicit 
declaration of built-in function ‘strcpy’
                          strcpy(attack->address.value, $1);
                          ^
parser/attack_parser.y: In function ‘yyerror’:
parser/attack_parser.y:299:1: error: number of arguments doesn’t match 
prototype
  static void yyerror() { /* do nothing */ }
  ^
parser/attack_parser.y:34:13: error: prototype declaration
  static void yyerror(attack_t *attack, const char *msg);
              ^
Makefile:606: recipe for target 'parser/attack_parser.o' failed
make[2]: *** [parser/attack_parser.o] Error 1
make[2]: Leaving directory '/home/jorge/progs/sshguard/src'
Makefile:342: recipe for target 'all' failed
make[1]: *** [all] Error 2
make[1]: Leaving directory '/home/jorge/progs/sshguard/src'
Makefile:335: recipe for target 'all-recursive' failed
make: *** [all-recursive] Error 1

Re: [SSHGuard-users] Feedback needed on 1.7.0

[<li...@la...>]

Once the install to tmp is done, I should do a service sshguard stop. I gather I should find the options used by the daemon used by 1.6.4 and then run the binary in tmp using those options.

Here is a reminder on how to build for those who stumble on those auto tools that seem anything but auto to me:
http://www.sshguard.net/docs/setup/compile-install/‎

As an aside, I've seen a major uptick in hacking starting last Thursday. Without naming names, a country that recently thwarted a coup has been running masscan (something like zmap). I have obvious scripts been run on port 80. The exact same sequence of hacks originating from all over the place, which I assume are compromised systems. 

You should never have your guard down, but now seems like a bad time. So if there are problems, I want to switch back to the existing sshguard pronto.
‎

  Original Message  
From: Kevin Zheng
Sent: Monday, July 25, 2016 7:59 PM
To: li...@la...; ssh...@li...
Subject: Re: [SSHGuard-users] Feedback needed on 1.7.0

On 07/25/2016 19:51, li...@la... wrote:
> Since this is a major change, can 1.7.0 be tested without being the
> daemon? That build the code, but don't do the make install step, then
> run the code from where it was built.

You'll need to run `make install` because SSHGuard looks for the helper
script sshg-fw in PREFIX.

However, you can install to a different prefix:

$ ./configure --prefix /tmp/sshguard
$ make install

SSHGuard will be installed using /tmp/sshguard as a prefix, which means
you don't even have to be root to run `make install`. To test, running
/tmp/sshguard/sbin/sshguard will suffice.

> While I have your ear, is there some way to flush/reset table 22?
> Mine seems to be on permanent block.

As root, run:

# ipfw table 22 flush

If this results in an error we'll have to troubleshoot.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Feedback needed on 1.7.0

[Kevin Z. <kev...@gm...>]

On 07/25/2016 19:51, li...@la... wrote:
> Since this is a major change, can 1.7.0 be tested without being the
> daemon? That build the code, but don't do the make install step, then
> run the code from where it was built.

You'll need to run `make install` because SSHGuard looks for the helper
script sshg-fw in PREFIX.

However, you can install to a different prefix:

$ ./configure --prefix /tmp/sshguard
$ make install

SSHGuard will be installed using /tmp/sshguard as a prefix, which means
you don't even have to be root to run `make install`. To test, running
/tmp/sshguard/sbin/sshguard will suffice.

> While I have your ear, is there some way to flush/reset table 22?
> Mine seems to be on permanent block.

As root, run:

# ipfw table 22 flush

If this results in an error we'll have to troubleshoot.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Feedback needed on 1.7.0

[<li...@la...>]

Since this is a major change, can 1.7.0 be tested without being the daemon? That build the code, but don't do the make install step, then run the code from where it was built.

While I have your ear, is there some way to flush/reset table 22? Mine seems to be on permanent block.


  Original Message  
From: Kevin Zheng
Sent: Monday, July 25, 2016 4:23 PM
To: ssh...@li...
Subject: [SSHGuard-users] Feedback needed on 1.7.0

Dear SSHGuard users,

SSHGuard 1.7.0 was planned for August, bringing bug fixes, backend
changes, and minor attack signature improvements. Some of these changes
need feedback and testing, and the release won't happen without you!

In no particular order, items that need feedback:

Backends have been rewritten. PF is well-tested, IPFW should work, but
iptables is untested because I don't have a Linux box handy.

The hosts backend should work but needs more testing. If it turns out
that nobody cares about testing/running it I'll drop it from 1.7.0.

Does process validation still work? Should it be dropped from 1.7.0?

LogSucker is deprecated. If you're having issues, use sshg-logtail to
monitor your logs and pipe it into SSHGuard. In future releases "-l" may
just be a convenience flag that invokes sshg-logtail.

External hooks are gone. If you need hooks, edit the sshg-fw script.

sshg-fw and sshg-parser are installed in libexec. Only sshg-fw is
currently needed for SSHGuard to run, but sshg-parser is useful for
checking if your logs are correctly parsed.

To test, check out the 'master' branch from SSHGuard's Bitbucket
repository. If there's anything I can do to make testing easier, please
let me know.

Thanks,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

[SSHGuard-users] Feedback needed on 1.7.0

[Kevin Z. <kev...@gm...>]

Dear SSHGuard users,

SSHGuard 1.7.0 was planned for August, bringing bug fixes, backend
changes, and minor attack signature improvements. Some of these changes
need feedback and testing, and the release won't happen without you!

In no particular order, items that need feedback:

Backends have been rewritten. PF is well-tested, IPFW should work, but
iptables is untested because I don't have a Linux box handy.

The hosts backend should work but needs more testing. If it turns out
that nobody cares about testing/running it I'll drop it from 1.7.0.

Does process validation still work? Should it be dropped from 1.7.0?

LogSucker is deprecated. If you're having issues, use sshg-logtail to
monitor your logs and pipe it into SSHGuard. In future releases "-l" may
just be a convenience flag that invokes sshg-logtail.

External hooks are gone. If you need hooks, edit the sshg-fw script.

sshg-fw and sshg-parser are installed in libexec. Only sshg-fw is
currently needed for SSHGuard to run, but sshg-parser is useful for
checking if your logs are correctly parsed.

To test, check out the 'master' branch from SSHGuard's Bitbucket
repository. If there's anything I can do to make testing easier, please
let me know.

Thanks,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Odd block

[Georg L. <jor...@ma...>]

On 22/07/16 00:32, li...@la... wrote:
> I decided to dig into this block given the odd name of the domain. Now
> if I am reading this correctly, the getaddrinfo is part of sshd, not
> sshguard. The IP 188.166.242.102 comes back to Digital Ocean, a VPS
> company. Where did poke.diarbag.us come from?
>
> Jul 21 14:07:16 theranch sshd[73068]: Did not receive identification string from 188.166.242.102
> Jul 21 14:13:07 theranch sshd[73095]: reverse mapping checking getaddrinfo for poke.diarbag.us [188.166.242.102] failed - POSSIBLE BREAK-IN ATTEMPT!
> Jul 21 14:13:07 theranch sshd[73095]: Invalid user vagrant from 188.166.242.102
> Jul 21 14:13:07 theranch sshd[73095]: input_userauth_request: invalid user vagrant [preauth]
> Jul 21 14:13:08 theranch sshd[73095]: Received disconnect from 188.166.242.102: 11: Bye Bye [preauth]
> Jul 21 14:13:08 theranch sshguard[809]: blacklist: added 188.166.242.102
>
> ------------------------------------------------------------------------------
> What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
> patterns at an interface-level. Reveals which users, apps, and protocols are
> consuming the most bandwidth. Provides multi-vendor support for NetFlow,
> J-Flow, sFlow and other flows. Make informed decisions using capacity planning
> reports.http://sdm.link/zohodev2dev
> _______________________________________________
> sshguard-users mailing list
> ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>
Hi: reverse mapping does the following:

1. Get the DNS hostname of the IP address which is connecting to you.
2. From the DNS hostname get - via DNS again - the IP address.
3. Compare if it is the same, if not: POSSIBLE BREAK-IN ATTEMPT!

You can emulate this on the commandline, I'll show it with nslookup, 
which is available on Linux (unix) and Windows systems:
- - -
  jorge@pwx:~$ nslookup
 > 188.166.242.102
Server:		192.168.173.1
Address:	192.168.173.1#53

Non-authoritative answer:
102.242.166.188.in-addr.arpa	name = poke.diarbag.us.

Authoritative answers can be found from:
242.166.188.in-addr.arpa	nameserver = ns2.digitalocean.com.
242.166.188.in-addr.arpa	nameserver = ns3.digitalocean.com.
242.166.188.in-addr.arpa	nameserver = ns1.digitalocean.com.
ns2.digitalocean.com	internet address = 173.245.59.41
ns2.digitalocean.com	has AAAA address 2400:cb00:2049:1::adf5:3b29
ns3.digitalocean.com	internet address = 198.41.222.173
ns3.digitalocean.com	has AAAA address 2400:cb00:2049:1::c629:dead
ns1.digitalocean.com	internet address = 173.245.58.51
ns1.digitalocean.com	has AAAA address 2400:cb00:2049:1::adf5:3a33
 > poke.diarbag.us
Server:		192.168.173.1
Address:	192.168.173.1#53

Non-authoritative answer:
*** Can't find poke.diarbag.us: No answer
 >
- - -
Result is, that there doesn't even exist a DNS entry for poke.diarbag.us.

The owner of the attackers IP address has not set up correctly his/her 
DNS records.  The attack still could come from a different host on the 
Internet, spoofing to be 188.166.242.102.

Poor Diar Bagus most probably has nothing to do with the attack. 
Complaints should go to digitalocean, they should know to whom they lend 
the attackers IP address.

Best Regards,

   Georg Lehner

Re: [SSHGuard-users] Odd block

[Willem J. W. <wj...@di...>]

On 22-7-2016 09:07, li...@la... wrote:
> On Fri, 22 Jul 2016 08:51:03 +0200
> Willem Jan Withagen <wj...@di...> wrote:
> 
>> On 22-7-2016 08:32, li...@la... wrote:
>>> I decided to dig into this block given the odd name of the domain.
>>> Now if I am reading this correctly, the getaddrinfo is part of
>>> sshd, not sshguard. The IP 188.166.242.102 comes back to Digital
>>> Ocean, a VPS company. Where did poke.diarbag.us come from?
>>>
>>> Jul 21 14:07:16 theranch sshd[73068]: Did not receive
>>> identification string from 188.166.242.102 Jul 21 14:13:07 theranch
>>> sshd[73095]: reverse mapping checking getaddrinfo for
>>> poke.diarbag.us [188.166.242.102] failed - POSSIBLE BREAK-IN
>>> ATTEMPT! Jul 21 14:13:07 theranch sshd[73095]: Invalid user vagrant
>>> from 188.166.242.102 Jul 21 14:13:07 theranch sshd[73095]:
>>> input_userauth_request: invalid user vagrant [preauth] Jul 21
>>> 14:13:08 theranch sshd[73095]: Received disconnect from
>>> 188.166.242.102: 11: Bye Bye [preauth] Jul 21 14:13:08 theranch
>>> sshguard[809]: blacklist: added 188.166.242.102
>>
>> How about:
>> # host 188.166.242.102
>> 102.242.166.188.in-addr.arpa domain name pointer poke.diarbag.us.
>>
>> --WjW
>>
> 
> I see, but 
> http://www.ip2location.com/188.166.242.102
> leads to Digital Ocean. 
> 
> So on cloudflare, where diarbag.us has its DNS, they set up
> poke.diarbag.us to go to Digital Ocean? Does ip2location have some
> secret sauce? Does it pierce the reverse proxy of Cloudflare?
> 
> Doing a whois, the owners name is Diar Bagus, so the domain name is,
> well, clever. I don't think anyone knocks on port 22 using their
> real name, so maybe the server is hacked.

Different questions, Different tools, different answers :)
Host gives you DNS
whois gives you the owner of the IP-number
Which can be different as you found out.

--WjW

# whois 188.166.242.102
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object

refer:        whois.ripe.net

inetnum:      188.0.0.0 - 188.255.255.255
organisation: Administered by RIPE NCC
status:       LEGACY

whois:        whois.ripe.net

changed:      1993-05
source:       IANA

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '188.166.0.0 - 188.166.255.255'

% Abuse contact for '188.166.0.0 - 188.166.255.255' is
'ab...@di...'

inetnum:        188.166.0.0 - 188.166.255.255
netname:        EU-DIGITALOCEAN-20090605
country:        NL
org:            ORG-DOI2-RIPE
admin-c:        PT7353-RIPE
tech-c:         PT7353-RIPE
status:         ALLOCATED PA
mnt-by:         RIPE-NCC-HM-MNT
mnt-lower:      digitalocean
mnt-routes:     digitalocean
mnt-domains:    digitalocean
created:        2014-11-17T16:36:42Z
last-modified:  2016-04-14T09:45:15Z
source:         RIPE # Filtered

organisation:   ORG-DOI2-RIPE
org-name:       Digital Ocean, Inc.
org-type:       LIR
address:        101 Ave of the Americas
                10th Floor
address:        New York
address:        10013
address:        UNITED STATES
phone:          +1 888 890 6714
mnt-ref:        digitalocean
mnt-ref:        RIPE-NCC-HM-MNT
mnt-by:         RIPE-NCC-HM-MNT
abuse-mailbox:  ab...@di...
abuse-c:        AD10778-RIPE
created:        2012-11-29T14:59:01Z
last-modified:  2015-11-19T16:11:55Z
source:         RIPE # Filtered

person:         Network Operations
address:        101 Ave of the Americas, 10th Floor, New York, NY 10013
phone:          +13478756044
nic-hdl:        PT7353-RIPE
mnt-by:         digitalocean
created:        2015-03-11T16:37:07Z
last-modified:  2015-11-19T15:57:21Z
source:         RIPE # Filtered
org:            ORG-DOI2-RIPE

% This query was served by the RIPE Database Query Service version
1.87.4 (DB-1)

Re: [SSHGuard-users] Odd block

[<li...@la...>]

On Fri, 22 Jul 2016 08:51:03 +0200
Willem Jan Withagen <wj...@di...> wrote:

> On 22-7-2016 08:32, li...@la... wrote:
> > I decided to dig into this block given the odd name of the domain.
> > Now if I am reading this correctly, the getaddrinfo is part of
> > sshd, not sshguard. The IP 188.166.242.102 comes back to Digital
> > Ocean, a VPS company. Where did poke.diarbag.us come from?
> > 
> > Jul 21 14:07:16 theranch sshd[73068]: Did not receive
> > identification string from 188.166.242.102 Jul 21 14:13:07 theranch
> > sshd[73095]: reverse mapping checking getaddrinfo for
> > poke.diarbag.us [188.166.242.102] failed - POSSIBLE BREAK-IN
> > ATTEMPT! Jul 21 14:13:07 theranch sshd[73095]: Invalid user vagrant
> > from 188.166.242.102 Jul 21 14:13:07 theranch sshd[73095]:
> > input_userauth_request: invalid user vagrant [preauth] Jul 21
> > 14:13:08 theranch sshd[73095]: Received disconnect from
> > 188.166.242.102: 11: Bye Bye [preauth] Jul 21 14:13:08 theranch
> > sshguard[809]: blacklist: added 188.166.242.102
> 
> How about:
> # host 188.166.242.102
> 102.242.166.188.in-addr.arpa domain name pointer poke.diarbag.us.
> 
> --WjW
> 

I see, but 
http://www.ip2location.com/188.166.242.102
leads to Digital Ocean. 

So on cloudflare, where diarbag.us has its DNS, they set up
poke.diarbag.us to go to Digital Ocean? Does ip2location have some
secret sauce? Does it pierce the reverse proxy of Cloudflare?

Doing a whois, the owners name is Diar Bagus, so the domain name is,
well, clever. I don't think anyone knocks on port 22 using their
real name, so maybe the server is hacked.

[SSHGuard-users] Odd block

[<li...@la...>]

I decided to dig into this block given the odd name of the domain. Now
if I am reading this correctly, the getaddrinfo is part of sshd, not
sshguard. The IP 188.166.242.102 comes back to Digital Ocean, a VPS
company. Where did poke.diarbag.us come from?

Jul 21 14:07:16 theranch sshd[73068]: Did not receive identification string from 188.166.242.102
Jul 21 14:13:07 theranch sshd[73095]: reverse mapping checking getaddrinfo for poke.diarbag.us [188.166.242.102] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 21 14:13:07 theranch sshd[73095]: Invalid user vagrant from 188.166.242.102
Jul 21 14:13:07 theranch sshd[73095]: input_userauth_request: invalid user vagrant [preauth]
Jul 21 14:13:08 theranch sshd[73095]: Received disconnect from 188.166.242.102: 11: Bye Bye [preauth]
Jul 21 14:13:08 theranch sshguard[809]: blacklist: added 188.166.242.102

[SSHGuard-users] Call for testing: SSHGuard 1.7.0

[Kevin Z. <kev...@gm...>]

Hi there,

Some non-trivial firewall backend changes have landed in the 'master'
branch of SSHGuard. I've been able to test the pf and ipfw backends, but
the iptables backend needs testing!

Briefly, SSHGuard now controls the firewall using a script, 'sshg-fw'
that reads commands from standard input (e.g. 'block 1.2.3.4') and runs
the appropriate firewall commands. This should make adding new backends
as well as custom hooks easier.

If you're able and willing to test, your feedback is appreciated!

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Inconvenient logging with SSHGUARD_DEBUG=yes

[Kevin Z. <kev...@gm...>]

On 07/07/2016 22:20, Georg Lehner wrote:
> Information from the sshguard package:
> 
> Package: sshguard
> Version: 1.5-5
> Installed-Size: 333
> Maintainer: Julián Moreno Patiño <dar...@gm...>
> ...
> - - -
> 
> running sshguard -v:
> 
> shguard 1.5.0

I'm not exactly sure what happened between then and now that caused this
issue to surface. 1.5.0 didn't recognize socklog messages at all.

In any case, the issue should be fixed now. Thanks again!

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Inconvenient logging with SSHGUARD_DEBUG=yes

[Georg L. <jor...@ma...>]

On 07/07/16 23:15, Kevin Zheng wrote:
> On 07/07/2016 15:09, Georg Lehner wrote:
>> When testing the recent sshguard with debugging on it started to
>> feedback itself into an endless loop, by writing messages to the syslog
>> with facility auth.debug.
>>
>>    auth.debug: Jul  7 23:43:26 sshguard[5840]: Read line from
>> '/var/log/socklog/main/current'.
>>
>> This did not happen with the precompiled sshguard (Debian Squeeze).
>> Maybe debug logging should go to another facility, e.g. daemon, user or
>> local0.
>
> What version is the packaged SSHGuard? I wonder which change caused this
> issue to surface?
>
> I never caught this issue because my system syslog facility has a rule
> that sends all debug output to a separate file.
>
> A fix was committed in b89b706. Thanks for the report!
>
> Best,
> Kevin
>

Information from the sshguard package:

Package: sshguard
Version: 1.5-5
Installed-Size: 333
Maintainer: Julián Moreno Patiño <dar...@gm...>
...
- - -

running sshguard -v:

shguard 1.5.0

Copyright (c) 2007,2008 Mij <mi...@ss...>
This is free software; see the source for conditions on copying.

- - -

Best Regards,

   Georg Lehner

Re: [SSHGuard-users] Inconvenient logging with SSHGUARD_DEBUG=yes

[Kevin Z. <kev...@gm...>]

On 07/07/2016 15:09, Georg Lehner wrote:
> When testing the recent sshguard with debugging on it started to 
> feedback itself into an endless loop, by writing messages to the syslog 
> with facility auth.debug.
> 
>    auth.debug: Jul  7 23:43:26 sshguard[5840]: Read line from 
> '/var/log/socklog/main/current'.
> 
> This did not happen with the precompiled sshguard (Debian Squeeze). 
> Maybe debug logging should go to another facility, e.g. daemon, user or 
> local0.

What version is the packaged SSHGuard? I wonder which change caused this
issue to surface?

I never caught this issue because my system syslog facility has a rule
that sends all debug output to a separate file.

A fix was committed in b89b706. Thanks for the report!

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] socklog lines not captured

[Kevin Z. <kev...@gm...>]

Hi Georg,

On 07/07/2016 15:03, Georg Lehner wrote:
> After trying all else I checked out current sources. Where socklog is 
> mentioned attack_scanner.l gives example loglines:
> 
>    * "2015-05-27T04:31:28.10040 auth.info: May 27 04:31:28 sshd[30993]: "
>    * "2015-05-27T04:31:28.10040 auth.info: sshd[30993]: "
> 
> So, my socklog does not insert timestamps in front of the logged messages.

Thanks for reporting this issue and providing a patch. The fix was
committed in 1da08e5 and is attached here as well.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] socklog lines not captured

[Georg L. <jor...@ma...>]

Hello List!

I am operating some Debian/Linux servers (Squeeze/ 7.x) where Syslog is 
replaced by socklog.

This week I tried out sshguard, but got no matches on my logfiles.

My socklog's loglines look like this:
- - -
auth.info: Jul  7 20:54:30 sshd[24329]: User root from 218.205.161.10 
not allowed because not listed in AllowUsers
auth.info: Jul  7 20:54:30 sshd[24329]: input_userauth_request: invalid 
user root [preauth]
auth.info: Jul  7 20:54:30 sshd[24329]: Connection closed by 
218.205.161.10 [preauth]
- - -

After trying all else I checked out current sources. Where socklog is 
mentioned attack_scanner.l gives example loglines:

   * "2015-05-27T04:31:28.10040 auth.info: May 27 04:31:28 sshd[30993]: "
   * "2015-05-27T04:31:28.10040 auth.info: sshd[30993]: "

So, my socklog does not insert timestamps in front of the logged messages.

Find below a patch to make the timestamp optional.  Since I have an 
"old" iptables (1.4.14) I needed to remove the "-w" option for iptables 
in commands_iptables.h.

Best Regards,

   Georg Lehner

diff --git a/src/fwalls/command_iptables.h b/src/fwalls/command_iptables.h
index aea039c..9b659e4 100644
--- a/src/fwalls/command_iptables.h
+++ b/src/fwalls/command_iptables.h
@@ -26,8 +26,8 @@

  #include "../config.h"

-/* backwards compatible with -w  */
-#define IPTBLCMD "TBL=iptables; if [ x$SSHG_ADDRKIND = x6 ]; then 
TBL=ip6tables; fi; iptblscmd() { " IPTABLES_PATH "/$TBL -w $@; r=$?; if 
[ $r -eq 2 ]; then exec " IPTABLES_PATH "/$TBL $@; fi; exit $r; }; 
iptblscmd "
+/* removed -w for old iptables (1.4.14  */
+#define IPTBLCMD "TBL=iptables; if [ x$SSHG_ADDRKIND = x6 ]; then 
TBL=ip6tables; fi; iptblscmd() { " IPTABLES_PATH "/$TBL $@; r=$?; if [ 
$r -eq 2 ]; then exec " IPTABLES_PATH "/$TBL $@; fi; exit $r; }; iptblscmd "

  /* for initializing the firewall (+ make sure we have sufficient 
credentials) */
  #define COMMAND_INIT       IPTBLCMD "-L -n"
diff --git a/src/parser/attack_scanner.l b/src/parser/attack_scanner.l
index 9b43f31..9dc3382 100644
--- a/src/parser/attack_scanner.l
+++ b/src/parser/attack_scanner.l
@@ -113,13 +113,16 @@ FACLEVEL (<[a-zA-Z0-9]+\.[a-zA-Z0-9]+>)
    *
    * Some strip the redundant timestamp, eg
    * "2015-05-27T04:31:28.10040 auth.info: sshd[30993]: "
+  *
+  * Other don't timestamp lines at all:
+  * "auth.info: May 27 04:31:28 sshd[30993]: "
    */
-{TIMESTAMP_ISO8601}" "{WORD}.{WORD}": "({TIMESTAMP_SYSLOG}" 
")?{PROCESSNAME}("/"{PROCESSNAME})?"["{NUMBER}"]: "{SOLARIS_MSGID_TAG}? {
+({TIMESTAMP_ISO8601}" ")?{WORD}.{WORD}": "({TIMESTAMP_SYSLOG}" 
")?{PROCESSNAME}("/"{PROCESSNAME})?"["{NUMBER}"]: "{SOLARIS_MSGID_TAG}? {
          yylval.num = getsyslogpid(yytext, yyleng);
          return SOCKLOG_BANNER_PID;
          }

-{TIMESTAMP_ISO8601}" "{WORD}.{WORD}": "({TIMESTAMP_SYSLOG}" 
")?({PROCESSNAME}("/"{PROCESSNAME})?":")?   { return SOCKLOG_BANNER; }
+({TIMESTAMP_ISO8601}" ")?{WORD}.{WORD}": "({TIMESTAMP_SYSLOG}" 
")?({PROCESSNAME}("/"{PROCESSNAME})?":")?   { return SOCKLOG_BANNER; }


   /* SSH: invalid or rejected user (cross platform [generated by 
openssh]) */

[SSHGuard-users] Inconvenient logging with SSHGUARD_DEBUG=yes

[Georg L. <jor...@ma...>]

Hello List!

When testing the recent sshguard with debugging on it started to 
feedback itself into an endless loop, by writing messages to the syslog 
with facility auth.debug.

   auth.debug: Jul  7 23:43:26 sshguard[5840]: Read line from 
'/var/log/socklog/main/current'.

This did not happen with the precompiled sshguard (Debian Squeeze). 
Maybe debug logging should go to another facility, e.g. daemon, user or 
local0.

Best Regards,

    Georg Lehner

Re: [SSHGuard-users] Blocking IP with Postifx

[<li...@la...>]

Are these really events that you want to trigger a block? I see the "from unknown" message from time to time and haven't investigated it to see if it is associated with bad intent. What I would want to block are the password guessers. 

The thing with sshguard is it only has one blocking table. At the moment, I only block port 22 no matter what event triggered it. So how would you set up your firewall implementation of the block list? Would you block the IP address totally? Or just 22 and all mail ports? 

Postfix has a throttling feature to slow down traffic that is repeatably coming from one IP. I had set up a script to trigger it just to see if it works. This keeps the password guessers from flooding the server, but there is no blocking.

The thing with email is you don't want false positives. If you just block an IP address from a port, the sender doesn't get a message from the email server notifying that the email was rejected. They should eventually get a notice that the email didn't go through. 

People get cranky when email doesn't go through. It isn't like ssh, where only a small number of IP addresses should have access.

  Original Message  
From: Gerard Seibert
Sent: Sunday, June 26, 2016 4:29 AM
To: ssh...@li...
Reply To: ssh...@li...
Subject: [SSHGuard-users] Blocking IP with Postifx

Normally, sshguard works perfectly with Postfix. It detects new IPs and
blocks them as appropriate. However, there is one that it never blocks.
This is the Postfix log entry (one of many) that relate to this IP.

Jun 26 06:37:20 scorpio postfix/smtpd[98953]: warning: hostname
50-246-67-11-static.hfc.comcastbusiness.net does not resolve to address
50.246.67.11: hostname nor servname provided, or not known

Jun 26 06:37:20 scorpio postfix/smtpd[98953]: connect from
unknown[50.246.67.11]

Jun 26 06:37:21 scorpio postfix/smtpd[98953]: disconnect from
unknown[50.246.67.11] ehlo=1 quit=1 commands=2

Why is this particular IP not being added to the database and then
blocked.

I am running FreeBSD-11 / amd64 with Postfix: version 3.2-20160612 and
sshguard 1.6.4

Is there a way to manually add the IP to the sshguard database?

Thank you. :)

-- 
Carmel

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

[SSHGuard-users] Blocking IP with Postifx

[Gerard S. <car...@ou...>]

Normally, sshguard works perfectly with Postfix. It detects new IPs and
blocks them as appropriate. However, there is one that it never blocks.
This is the Postfix log entry (one of many) that relate to this IP.

Jun 26 06:37:20 scorpio postfix/smtpd[98953]: warning: hostname
50-246-67-11-static.hfc.comcastbusiness.net does not resolve to address
50.246.67.11: hostname nor servname provided, or not known

Jun 26 06:37:20 scorpio postfix/smtpd[98953]: connect from
unknown[50.246.67.11]

Jun 26 06:37:21 scorpio postfix/smtpd[98953]: disconnect from
unknown[50.246.67.11] ehlo=1 quit=1 commands=2

Why is this particular IP not being added to the database and then
blocked.

I am running FreeBSD-11 / amd64 with Postfix: version 3.2-20160612 and
sshguard 1.6.4

Is there a way to manually add the IP to the sshguard database?

Thank you. :)

-- 
Carmel

Re: [SSHGuard-users] Whether to install multiple binaries or not

[Henri S. <hen...@gm...>]

> SSHGuard currently ships as one executable. In considering some redesigns.

This is an interesting idea! It could work really well.

On the flip side, the advantage as you have already mentioned regarding the current developer controlled and maintained binary is that the people who maintain this  know what is going on and perhaps more importantly it is trivially simply for end users to install and upgrade.

I am all for flexibility. However, end user simplicity is also something to consider.

My 2ç

--------------------------------------------------------------------
InstallPKG, an open source installation system. Install multiple apple .pkg and .mpkg files via the command line : http://www.henri.shustak.org/tools/installpkg

[SSHGuard-users] Whether to install multiple binaries or not

[Kevin Z. <kev...@gm...>]

Hi all,

SSHGuard currently ships as one executable. In considering some
redesigns, one possibility is to segregate distinct functionality into
several different programs that are chained (piped) together. For
example, a common invocation could be:

# tail -F /var/log/auth.log ... | sshg-parser | \
    sshg-analyzer -a 30 -b 60:blacklist.db | sshg-fw

The value of this approach is its modularity, flexibility, and security.
These programs can be chained together in different ways to provide
different functionality. For example, to find out if SSHGuard is
detecting your attacks using saved logs, you could run:

# cat /var/log/auth.log.* | sshg-parser

If you wanted to replace the default blocking behavior, you could
replace sshg-analyzer with custom blocking rules.

If you wanted to instantly block attacks when the username matches
'root', you could insert another program in the pipeline that raises the
score that comes from sshg-parser before it reaches sshg-analyzer.

This pipeline is also intrinsically parallel and trivially sandboxable.
There are probably few bugs in `tail`, `sshg-parser` can be run without
privileges, `sshg-analyzer` needs only access to the blacklist, and
`sshg-fw` continues to require root access to configure the firewall.

Comments, suggestions, ideas?

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] SASL

[Kevin Z. <kev...@gm...>]

On 06/12/16 00:38, Jos Chrispijn wrote:
> Jun 11 01:06:33 ceto postfix/smtpd[39048]: warning:
> unknown[36.6.252.174]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Thanks, I'll add it when I get around to it.

> Just a question: how do you process these updates? Do you do this in the
> SSHGuard itself (new version update) or do you keep an online database
> with these examples that is inquired every time SSHGuard is activated on
> our side? Best, Jos Chrispijn

All attack signatures are built into the SSHGuard binary itself. You can
see for yourself how this is done in src/parser. This means that
updating attack signatures requires an SSHGuard update.

This was a design choice that prefers ease of setup and simplicity over
ease of configuration.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] SASL

[Jos C. <ssh...@cl...>]

Hi Kevin,

FYI - found another one:

Jun 11 01:06:33 ceto postfix/smtpd[39048]: warning: 
unknown[36.6.252.174]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 
Just a question: how do you process these updates? Do you do this in the 
SSHGuard itself (new version update) or do you keep an online database 
with these examples that is inquired every time SSHGuard is activated on 
our side? Best, Jos Chrispijn