sshguard-users — User questions and answers, bugs, and general support

Re: [SSHGuard-users] Results from running 1.6.4

[<li...@la...>]

Regarding reset or deny, who is the user here? The clown trying to log into the server, or the sysadmin?

My first priority would be which uses the least resources of my server. If equal, then I would pick which method wastes the time of the clown trying to break into the network.

  Original Message  
From: Kevin Zheng
Sent: Saturday, May 7, 2016 11:36 PM
To: Carmel; ssh...@li...
Subject: Re: [SSHGuard-users] Results from running 1.6.4

On 05/07/2016 06:00, Carmel wrote:
> I am running sshguard-ipfw,ver 1.6.4 on a FreeBSD-11 / amd64 machine. I
> installed the program via the ports system.
> 
> I was just wondering where you located this new documentation? I have
> been interested in exactly what and where to put entries in my "ipfw"
> file, or if I even needed them at all.

As mentioned before, the setup documentation is here:
http://www.sshguard.net/docs/setup/

You need to understand your own firewall to set up SSHGuard. Copying and
pasting might work if you're lucky.

The 'reset' instead of 'deny' was chosen as a more reasonable default to
give users better feedback. Dropping the connection will cause the
client to wait for a timeout, while resetting the connection will give
the user more meaningful feedback (connection reset by peer).

The rule number depends entirely on your ruleset. IPFW is a
first-rule-wins firewall, so the rule that allows SSH should have a
higher rule number than SSHGuard's rule number.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] Results from running 1.6.4

[Kevin Z. <kev...@gm...>]

On 05/07/2016 06:00, Carmel wrote:
> I am running sshguard-ipfw,ver 1.6.4 on a FreeBSD-11 / amd64 machine. I
> installed the program via the ports system.
> 
> I was just wondering where you located this new documentation? I have
> been interested in exactly what and where to put entries in my "ipfw"
> file, or if I even needed them at all.

As mentioned before, the setup documentation is here:
http://www.sshguard.net/docs/setup/

You need to understand your own firewall to set up SSHGuard. Copying and
pasting might work if you're lucky.

The 'reset' instead of 'deny' was chosen as a more reasonable default to
give users better feedback. Dropping the connection will cause the
client to wait for a timeout, while resetting the connection will give
the user more meaningful feedback (connection reset by peer).

The rule number depends entirely on your ruleset. IPFW is a
first-rule-wins firewall, so the rule that allows SSH should have a
higher rule number than SSHGuard's rule number.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Automake and sshguard source

[Kevin Z. <kev...@gm...>]

On 05/06/2016 17:47, li...@la... wrote:
> I got this line a number of times, but I think it means the IP addresses
> are already in the blocked database.
> 
> ipfw: setsockopt(IP_FW_TABLE_XADD): File exists
> 
> Hmmh, no new blocked IPs in the last 12 minutes. Maybe the hackers
> are taking a coffee break. I will give this an hour and then check the
> log.

What happens if you manually flush table 22 before starting SSHGuard?

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Results from running 1.6.4

[<li...@la...>]

‎The entry into rc.firewall is on this page:
http://www.sshguard.net/docs/setup/
You certainly need the line and there was a thread sometime back regarding where in the file to place it.

Sorry for the top posting, but I'm on the "phone."


  Original Message  
From: Carmel
Sent: Saturday, May 7, 2016 6:00 AM
To: ssh...@li...
Subject: Re: [SSHGuard-users] Results from running 1.6.4

On Fri, 6 May 2016 19:56:17 -0700, li...@la... stated:

>Old ipfw line:
>${fwcmd} add 550 deny log all from 'table(22)' to any
>
>Suggested line from current docuemntation
># ipfw add 5000 reset ip from table\(22\) to me

I am running sshguard-ipfw,ver 1.6.4 on a FreeBSD-11 / amd64 machine. I
installed the program via the ports system.

I was just wondering where you located this new documentation? I have
been interested in exactly what and where to put entries in my "ipfw"
file, or if I even needed them at all.

Thanks!

-- 
Carmel

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] Results from running 1.6.4

[Carmel <car...@ou...>]

On Fri, 6 May 2016 19:56:17 -0700, li...@la... stated:

>Old ipfw line:
>${fwcmd} add  550 deny log all  from 'table(22)' to any
>
>Suggested line from current docuemntation
># ipfw add 5000 reset ip from table\(22\) to me

I am running sshguard-ipfw,ver 1.6.4 on a FreeBSD-11 / amd64 machine. I
installed the program via the ports system.

I was just wondering where you located this new documentation? I have
been interested in exactly what and where to put entries in my "ipfw"
file, or if I even needed them at all.

Thanks!

-- 
Carmel

[SSHGuard-users] Results from running 1.6.4

[<li...@la...>]

Old ipfw line:
${fwcmd} add  550 deny log all  from 'table(22)' to any

Suggested line from current docuemntation
# ipfw add 5000 reset ip from table\(22\) to me
-------------------------------------------------------------
I noticed the updated sshguard made it to /usr/ports, so I compiled the
code there and did a reinstall so it would be more like a typical user
installation.
--------------------------------------------------------
This is the error message when starting sshguard:
# service sshguard restart
Stopping sshguard.
Starting sshguard.
# 
# ipfw: setsockopt(IP_FW_TABLE_XADD): File exists
ipfw: setsockopt(IP_FW_TABLE_XADD): File exists
ipfw: setsockopt(IP_FW_TABLE_XADD): File exists
-----------------------------------------------------------------
The standard daemon file doesn't include dovecot. I added the dovecot
log, but I don't see it mentioned in the auth.log. Also should I delete
the old block list?

May  7 02:53:13 theranch sshguard[21444]: Exiting on signal
May  7 02:53:13 theranch sshguard[23159]: blacklist: blocking 1644 addresses
May  7 02:53:16 theranch sshguard[23159]: Monitoring attacks from log files
May  7 02:53:16 theranch sshguard[23159]: Reloading rotated file /var/log/auth.log.
May  7 02:53:16 theranch sshguard[23159]: Reloading rotated file /var/log/maillog.
May  7 02:53:16 theranch sshguard[23159]: blacklist: 217.199.161.135 is already blacklisted
May  7 02:53:16 theranch sshguard[23159]: 217.199.161.135: blocking forever (3 attacks in 0 secs, after 1 abuses over
0 secs)
May  7 02:53:16 theranch sshguard[23159]: fw: failed to block (-1)
May  7 02:53:16 theranch sshguard[23159]: blacklist: 185.103.109.70 is already blacklisted
May  7 02:53:16 theranch sshguard[23159]: 185.103.109.70: blocking forever (3 attacks in 0 secs, after 1 abuses over 0
 secs)
May  7 02:53:16 theranch sshguard[23159]: fw: failed to block (-1)
May  7 02:53:16 theranch sshguard[23159]: blacklist: 155.133.82.69 is already blacklisted
May  7 02:53:16 theranch sshguard[23159]: 155.133.82.69: blocking forever (3 attacks in 0 secs, after 1 abuses over 0
secs)
May  7 02:53:16 theranch sshguard[23159]: fw: failed to block (-1)
May  7 02:53:16 theranch sshguard[23159]: 155.133.82.69: should already have been blocked
May  7 02:53:16 theranch sshguard[23159]: 155.133.82.69: should already have been blocked
May  7 02:53:16 theranch sshguard[23159]: 155.133.82.69: should already have been blocked


---------------------------------------------------------
May  7 02:53:13 theranch sshguard[21444]: Exiting on signal
May  7 02:53:13 theranch sshguard[23159]: blacklist: blocking 1644
addresses
May  7 02:53:16 theranch sshguard[23159]: Monitoring attacks from log
files
May  7 02:53:16 theranch sshguard[23159]: Reloading rotated
file /var/log/auth.log.
May  7 02:53:16 theranch sshguard[23159]: Reloading rotated
file /var/log/maillog.
May  7 02:53:16 theranch sshguard[23159]: blacklist: 217.199.161.135 is
already blacklisted
May  7 02:53:16 theranch sshguard[23159]: 217.199.161.135: blocking
forever (3 attacks in 0 secs, after 1 abuses over
0 secs)
May  7 02:53:16 theranch sshguard[23159]: fw: failed to block (-1)
May  7 02:53:16 theranch sshguard[23159]: blacklist: 185.103.109.70 is
already blacklisted
May  7 02:53:16 theranch sshguard[23159]: 185.103.109.70: blocking
forever (3 attacks in 0 secs, after 1 abuses over 0
 secs)
May  7 02:53:16 theranch sshguard[23159]: fw: failed to block (-1)
May  7 02:53:16 theranch sshguard[23159]: blacklist: 155.133.82.69 is
already blacklisted
May  7 02:53:16 theranch sshguard[23159]: 155.133.82.69: blocking
forever (3 attacks in 0 secs, after 1 abuses over 0
secs)
May  7 02:53:16 theranch sshguard[23159]: fw: failed to block (-1)
May  7 02:53:16 theranch sshguard[23159]: 155.133.82.69: should already
have been blocked
May  7 02:53:16 theranch sshguard[23159]: 155.133.82.69: should already
have been blocked
May  7 02:53:16 theranch sshguard[23159]: 155.133.82.69: should already
have been blocked




-----------------------------------------
My recollection is it was suggested to change the regex in the daemon a
bit. Is this still valid?
-----------------------------------------------




The daemon file /usr/local/etc/rc.d/sshguard (well
truncatred a bit) follows. 

#!/bin/sh


#
# Add the following lines to /etc/rc.conf to enable sshguard:
# sshguard_enable (bool):       Set to "NO" by default.
#                               Set it to "YES" to enable sshguard
# sshguard_pidfile (str):       Path to PID file.
#                               Set to "/var/run/sshguard.pid" by default
# sshguard_watch_logs (str):    Colon splitted list of logs to watch.
#                               Set to "/var/log/auth.log:/var/log/maillog"
#                               by default.
# The following options directly maps to their command line options,
# please read manual page sshguard(8) for detailed information:
# sshguard_blacklist (str):     [thr:]/path/to/blacklist.
#                               Set to "30:/var/db/sshguard/blacklist.db"
#                               by default.
# sshguard_danger_thresh (int): Danger threshold.  Set to "30" by default.
# sshguard_release_interval (int):
#                               Minimum interval an address remains
#                               blocked.  Set to "120" by default.
# sshguard_reset_interval (int):
#                               Interval before a suspected attack is
#                               forgotten and danger is reset to 0.
#                               Set to "1800" by default.
# sshguard_whitelistfile (str): Path to the whitelist.
#                               Set to "/usr/local/etc/sshguard.whitelist"
#                               by default.
# sshguard_flags (str):         Set additional command line arguments.
#


. /etc/rc.subr

name=sshguard
rcvar=sshguard_enable

load_rc_config sshguard

: ${sshguard_enable:=NO}
: ${sshguard_blacklist=30:/var/db/sshguard/blacklist.db}
: ${sshguard_danger_thresh=30}
: ${sshguard_release_interval=120}
: ${sshguard_reset_interval=1800}
: ${sshguard_whitelistfile="/usr/local/etc/sshguard.whitelist"}
: ${sshguard_watch_logs=/var/log/auth.log:/var/log/maillog}

pidfile=${sshguard_pidfile:="/var/run/sshguard.pid"}

command=/usr/sbin/daemon
actual_command="/usr/local/sbin/sshguard"
procname="${actual_command}"
start_precmd=sshguard_prestart
command_args="-c ${actual_command} \${sshguard_flags} \${sshguard_blacklist_params} \${sshguard_watch_params} -a ${sshguard_danger_thresh} -p ${sshguard_release_interval} -s ${sshguard_reset_interval} -w ${sshguard_whitelistfile} -i ${pidfile}"

sshguard_prestart()
{
        # Clear rc_flags so sshguard_flags can be passed to sshguard
        # instaed of daemon(8)
        rc_flags=""

        if [ ! -z ${sshguard_blacklist} ]; then
            mkdir -p $(dirname ${sshguard_blacklist##*:})
            sshguard_blacklist_params="-b ${sshguard_blacklist}"
        fi

        [ -e ${sshguard_whitelistfile} ] || touch ${sshguard_whitelistfile}

        sshguard_watch_params=$(echo ${sshguard_watch_logs} | tr : \\\n | sed -e s/^/-l\ /g | tr \\\n \ )
}

run_rc_command "$1

Re: [SSHGuard-users] Automake and sshguard source

[<li...@la...>]

On Thu, 5 May 2016 23:32:49 -0700
Kevin Zheng <kev...@gm...> wrote:

> On 05/05/2016 23:31, li...@la... wrote:
> > Can someone put the instructions for compiling sshguard using
> > automake on the website?
> 
> Building from source:
> 
> http://www.sshguard.net/docs/setup/compile-install/
> 
> Hope that helps.
> 
> Best,
> Kevin
> 
No issues in compilation. Verification new version running:
# sshguard -v
sshguard 1.6.4

I got this line a number of times, but I think it means the IP addresses
are already in the blocked database.

ipfw: setsockopt(IP_FW_TABLE_XADD): File exists

Hmmh, no new blocked IPs in the last 12 minutes. Maybe the hackers
are taking a coffee break. I will give this an hour and then check the
log.

Re: [SSHGuard-users] Automake and sshguard source

[<li...@la...>]

That looks great. It is a bit embarrassing since you emailed that to me, but I couldn't find the message. I will build it later today. 

‎I guess it would be stating the obvious that you have to rename the old sshguard directory else git will complain.

  Original Message  
From: Kevin Zheng
Sent: Thursday, May 5, 2016 11:33 PM
To: ssh...@li...
Subject: Re: [SSHGuard-users] Automake and sshguard source

On 05/05/2016 23:31, li...@la... wrote:
> Can someone put the instructions for compiling sshguard using automake
> on the website?

Building from source:

http://www.sshguard.net/docs/setup/compile-install/

Hope that helps.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
sshguard-users mailing list
ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [SSHGuard-users] Automake and sshguard source

[Kevin Z. <kev...@gm...>]

On 05/05/2016 23:31, li...@la... wrote:
> Can someone put the instructions for compiling sshguard using automake
> on the website?

Building from source:

http://www.sshguard.net/docs/setup/compile-install/

Hope that helps.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Automake and sshguard source

[<li...@la...>]

<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><style> body {  font-family: "Calibri","Slate Pro",sans-serif,"sans-serif"; color:#262626 }</style> </head> <body lang="en-US"><div>Can someone put the instructions for compiling sshguard using automake on the website?</div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif, sans-serif;"><br></span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif, sans-serif;"><br></span></div><div><br></div><div></div></body></html>

[SSHGuard-users] Submission page

[Jos C. <ssh...@cl...>]

Can you pls update the content of the SSHGuard submission page?

Right frame shows


      Lates ReleasesView all» <http://www.sshguard.net/download/releases/>

  * sshguard 1.5
    <http://freshmeat.net/projects/sshguard#release_328284>This is a
    milestone release, coming after 18 months ...
  * sshguard 1.5
    <http://freecode.com/projects/sshguard#release_328284>Sshguard
    monitors services through their logging activity. It reacts ...
  * sshguard 1.5rc4
    <http://freshmeat.net/projects/sshguard#release_320398>This release
    candidate fixes the last known bugs submitted ...

on which View all starts with the 1.5 Feb 2011 release/version.

thanks,
Jos Chrispijn

Re: [SSHGuard-users] Portscanners

[Willem J. W. <wj...@di...>]

On 4-5-2016 06:16, Kevin Zheng wrote:
> On 05/03/2016 08:36, Jos Chrispijn wrote:
>> Is there a way of blocking port scanners and treat them as false login?
>
> Yes, by adding these signatures and monitoring 'all.log'. But this
> wouldn't stop these log messages from showing up, because the attackers
> would still hit the firewall. It doesn't make sense to have a firewall
> protecting the firewall.
>
>> May  3 17:24:18 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712
>> x.x.x.x:28997 in via re0
>> May  3 17:24:26 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712
>> x.x.x.x:11505 in via re0
>> May  3 17:24:31 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712
>> x.x.x.x:21643 in via re0
>> May  3 17:24:33 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712
>> x.x.x.x:28800 in via re0
>
> I think this is beyond the scope of SSHGuard. SSHGuard protects against
> service attacks, not port scans. The intent of SSHGuard is to use a
> firewall to prevent rapid attacks against services (that takes up CPU
> and memory resources).

As a blunt tools I use portsentry.
If you hit any of the ports normlly used with backdoors, p2p, ... all
kinds of things I do not serve and do not want to be accessed.

I'm using it in the same way as sshguard:
	ipfw table <nr of choice> add <ipnr>

And then build a list of tables that are being blocked....

01050 deny ip from table(10) to any
01060 deny ip from table(21) to any
01070 deny ip from table(22) to any
01080 deny ip from table(25) to any
01090 deny ip from table(26) to any
01100 deny ip from table(40) to any
01110 deny ip from table(41) to any
01120 deny ip from table(42) to any
01130 deny ip from table(43) to any
01140 deny ip from table(50) to any
01150 deny ip from table(53) to any
01160 deny ip from table(54) to any
01170 deny ip from table(55) to any
01180 deny ip from table(56) to any
01190 deny ip from table(57) to any
01200 deny ip from table(58) to any
01210 deny ip from table(59) to any
01220 deny ip from table(60) to any
01230 deny ip from table(70) to any
01240 deny ip from table(75) to any
01250 deny ip from table(80) to any
01260 deny ip from table(81) to any
01270 deny ip from table(86) to any

--WjW

Re: [SSHGuard-users] Portscanners

[Kevin Z. <kev...@gm...>]

On 05/03/2016 08:36, Jos Chrispijn wrote:
> Is there a way of blocking port scanners and treat them as false login?

Yes, by adding these signatures and monitoring 'all.log'. But this
wouldn't stop these log messages from showing up, because the attackers
would still hit the firewall. It doesn't make sense to have a firewall
protecting the firewall.

> May  3 17:24:18 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712
> x.x.x.x:28997 in via re0
> May  3 17:24:26 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712
> x.x.x.x:11505 in via re0
> May  3 17:24:31 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712
> x.x.x.x:21643 in via re0
> May  3 17:24:33 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712
> x.x.x.x:28800 in via re0

I think this is beyond the scope of SSHGuard. SSHGuard protects against
service attacks, not port scans. The intent of SSHGuard is to use a
firewall to prevent rapid attacks against services (that takes up CPU
and memory resources).

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Portscanners

[Jos C. <ssh...@cl...>]

Is there a way of blocking port scanners and treat them as false login?

 From my FreeBSD all.log

May  3 17:24:18 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712 
x.x.x.x:28997 in via re0
May  3 17:24:26 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712 
x.x.x.x:11505 in via re0
May  3 17:24:31 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712 
x.x.x.x:21643 in via re0
May  3 17:24:33 ceto kernel: ipfw: 7300 Deny TCP 163.172.31.102:41712 
x.x.x.x:28800 in via re0

Best regards,
Jos Chrispijn

Re: [SSHGuard-users] SSHGuard 1.6.4 release announcement

[Mark F. <fe...@Fr...>]

On Mon, May 2, 2016, at 11:42, Kevin Zheng wrote:
> On 05/02/2016 08:56, Mark Felder wrote:
> >> Most notably, some default options have changed. The abuse threshold has
> >> been reduced to 30 (3 attacks) and the initial block time has been
> >> lowered to 2 minutes (from 7). These settings can be overridden from the
> >> command line. Package maintainers should check their scripts.
> >>
> > 
> > The man page has not been updated to reflect these changes.
> 
> Oops, thanks for catching the issue. An updated man page has been
> committed, and the diff between 1.6.4 is attached.
> 

This was not noted in the release notes, but I will make sure this is
reflected in the FreeBSD port

+.B \fB\-s\fP \fIinterval\fP (default 1800 secs, or 30 minutes)


-- 
  Mark Felder
  ports-secteam member
  fe...@Fr...

Re: [SSHGuard-users] SSHGuard 1.6.4 release announcement

[Kevin Z. <kev...@gm...>]

On 05/02/2016 08:56, Mark Felder wrote:
>> Most notably, some default options have changed. The abuse threshold has
>> been reduced to 30 (3 attacks) and the initial block time has been
>> lowered to 2 minutes (from 7). These settings can be overridden from the
>> command line. Package maintainers should check their scripts.
>>
> 
> The man page has not been updated to reflect these changes.

Oops, thanks for catching the issue. An updated man page has been
committed, and the diff between 1.6.4 is attached.

Thanks,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] SSHGuard 1.6.4 release announcement

[Mark F. <fe...@Fr...>]

On Thu, Apr 28, 2016, at 20:24, Kevin Zheng wrote:
> 
> Most notably, some default options have changed. The abuse threshold has
> been reduced to 30 (3 attacks) and the initial block time has been
> lowered to 2 minutes (from 7). These settings can be overridden from the
> command line. Package maintainers should check their scripts.
> 

The man page has not been updated to reflect these changes.


-- 
  Mark Felder
  ports-secteam member
  fe...@Fr...

Re: [SSHGuard-users] Exception to be added

[Jos C. <ssh...@cl...>]

In een bericht van 29-4-2016 2:53:

> This attack will be detected in 1.6.4.

Thanks for this and letting us use your program - it saves me a lot of 
time (earlier blocked ip's by hand)...

Best regards,
Jos Chrispijn

Re: [SSHGuard-users] SSHGuard 1.6.4 release announcement

[Jos C. <ssh...@cl...>]

Dear team,

> I am pleased to announce the release of SSHGuard 1.6.4 [1]. This release
> brings updated signatures, usability improvements, and bug fixes.
> Highlights in this release include:

Great news!
Can you pls put this version in de FreeBSD Ports collection?

thanks,
Jos Chrispijn

[SSHGuard-users] SSHGuard 1.6.4 release announcement

[Kevin Z. <kev...@gm...>]

Greetings,

I am pleased to announce the release of SSHGuard 1.6.4 [1]. This release
brings updated signatures, usability improvements, and bug fixes.
Highlights in this release include:

    - Match Postfix pre-authentication disconnects
    - Fix bashisms in iptables backend
    - Fix size argument in inet_ntop() call
    - Remove excessive logging when polling from files
    - Keep looking for unreadable files while polling
    - Update Dovecot signature for POP3
    - Match "Connection reset" message for SSH
    - Resurrect PID file option by popular demand
    - Adjust default abuse threshold

Most notably, some default options have changed. The abuse threshold has
been reduced to 30 (3 attacks) and the initial block time has been
lowered to 2 minutes (from 7). These settings can be overridden from the
command line. Package maintainers should check their scripts.

The PID file option (-p) has been resurrected.

As usual, please report any bugs, build failures, or other issues to
the mailing list or the Bitbucket tracker [2].

If you haven't already, please take 2-3 minutes to complete a survey
about how you use SSHGuard:

https://docs.google.com/forms/d/1UQHrtq7uhpopWDsNmvYyVbwKpupkgHAwcd3SwmTMaNc/viewform?usp=send_form

Best,
Kevin

[1] https://sourceforge.net/projects/sshguard/files/sshguard/1.6.4/
[2] https://bitbucket.org/sshguard/sshguard/issues/

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] Exception to be added

[Kevin Z. <kev...@gm...>]

On 04/27/2016 11:11, Jos Chrispijn wrote:
> Just to inform you that this line is ignored in your scan:
> 
> Apr 27 13:45:26 ceto postfix/smtpd[71252]: warning:
> unknown[115.159.143.169]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
> 
> Can you fix and/or let me know how to configure? Thanks.

This attack will be detected in 1.6.4.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

[SSHGuard-users] Exception to be added

[Jos C. <ssh...@cl...>]

[sshguard-ipfw-1.6.3_1]

Dear team,

Just to inform you that this line is ignored in your scan:

Apr 27 13:45:26 ceto postfix/smtpd[71252]: warning: 
unknown[115.159.143.169]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Can you fix and/or let me know how to configure? Thanks.

/JosC

--

[SSHGuard-users] SSHGuard 1.6.4 landing soon

[Kevin Z. <kev...@gm...>]

Greetings,

SSHGuard 1.6.4 is just around the corner, bringing these changes:

    - Match Postfix pre-authentication disconnects
    - Fix bashisms in iptables backend
    - Fix size argument in inet_ntop() call
    - Remove excessive logging when polling from files
    - Keep looking for unreadable files while polling
    - Update Dovecot signature for POP3
    - Match "Connection reset" message for SSH
    - Resurrect PID file option by popular demand
    - Adjust default abuse threshold

Most notably, some default options have changed. The abuse threshold has
been reduced to 30 (3 attacks) and the initial block time has been
lowered to 2 minutes (from 7). These settings can be overridden from the
command line. Package maintainers should check their scripts.

The PID file option (-p) has been resurrected.

If no major issues come up, the 1.6.4 tarball will be released in the
coming week. You can test-drive this release by cloning from the
'master' branch in the Bitbucket repository.

Cheers,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [Sshguard-users] protecting a server with password authentication disabled

[Henri S. <hen...@gm...>]

> This issue was fixed right after the 1.6.3 release. So it hasn't been released yet.


I can check out from the git repository / wait until it is main stream.

Just glad to know that the attack is detected as an attack in the current versions! 

I am glad I decided to contact the list rather than start editing the code manually trying to add this particular attack detection if the problem had already been resolved. I guessed it was an attack that should be detected. Thank you for all your help and in particular taking the time to look at the problem. No need to issue a patch just for me!

Thanks again!


--------------------------------------------------------------------
This email is protected by LBackup, an open source backup solution
http://www.lbackup.org

Re: [Sshguard-users] protecting a server with password authentication disabled

[Kevin Z. <kev...@gm...>]

On 04/19/2016 19:18, Henri Shustak wrote:
>> What version of SSHGuard are you using?
> 
> SSHGuard version : 1.6.1 : OK, not the latest but it is fairly recent
> right?

Oops, this is embarassing. This issue was fixed right after the 1.6.3
release. So it hasn't been released yet.

> Note : This is SSHGuard was installed via brew on a Mac OS X system.
> I have confirmed that if password authentication enabled and you do
> not connect with a key and instead try to use a password, then it
> SSHGuard works great!
> 
>> What pre-auth disconnect message showed up in the logs?
> 
> Connection closed by 123.255.41.127 [preauth]

The development version in Git recognizes this attack. Next release is
planned for early May, but in the meantime I can provide a patch against
1.6.3.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090