Menu
▾
▴
sshguard-users — User questions and answers, bugs, and general support
You can subscribe to this list here.
| 2007 |
Jan
|
Feb
|
Mar
(10) |
Apr
(7) |
May
(6) |
Jun
(13) |
Jul
(4) |
Aug
|
Sep
|
Oct
(17) |
Nov
(5) |
Dec
(4) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2008 |
Jan
(2) |
Feb
|
Mar
|
Apr
(4) |
May
(2) |
Jun
(7) |
Jul
(10) |
Aug
(4) |
Sep
(14) |
Oct
|
Nov
(1) |
Dec
(7) |
| 2009 |
Jan
(17) |
Feb
(20) |
Mar
(11) |
Apr
(14) |
May
(8) |
Jun
(3) |
Jul
(22) |
Aug
(9) |
Sep
(8) |
Oct
(6) |
Nov
(4) |
Dec
(8) |
| 2010 |
Jan
(17) |
Feb
(9) |
Mar
(15) |
Apr
(24) |
May
(14) |
Jun
(1) |
Jul
(21) |
Aug
(6) |
Sep
(2) |
Oct
(2) |
Nov
(6) |
Dec
(9) |
| 2011 |
Jan
(11) |
Feb
(1) |
Mar
(3) |
Apr
(4) |
May
|
Jun
|
Jul
(2) |
Aug
(3) |
Sep
(2) |
Oct
(29) |
Nov
(1) |
Dec
(1) |
| 2012 |
Jan
(1) |
Feb
(1) |
Mar
|
Apr
(13) |
May
(4) |
Jun
(9) |
Jul
(2) |
Aug
(2) |
Sep
(1) |
Oct
(2) |
Nov
(11) |
Dec
(4) |
| 2013 |
Jan
(2) |
Feb
(2) |
Mar
(4) |
Apr
(13) |
May
(4) |
Jun
|
Jul
|
Aug
(1) |
Sep
(5) |
Oct
(3) |
Nov
(1) |
Dec
(3) |
| 2014 |
Jan
|
Feb
(3) |
Mar
(3) |
Apr
(6) |
May
(8) |
Jun
|
Jul
|
Aug
(1) |
Sep
(1) |
Oct
(3) |
Nov
(14) |
Dec
(8) |
| 2015 |
Jan
(16) |
Feb
(30) |
Mar
(20) |
Apr
(5) |
May
(33) |
Jun
(11) |
Jul
(15) |
Aug
(91) |
Sep
(23) |
Oct
(10) |
Nov
(7) |
Dec
(9) |
| 2016 |
Jan
(22) |
Feb
(8) |
Mar
(6) |
Apr
(23) |
May
(38) |
Jun
(29) |
Jul
(43) |
Aug
(43) |
Sep
(18) |
Oct
(8) |
Nov
(2) |
Dec
(25) |
| 2017 |
Jan
(38) |
Feb
(3) |
Mar
(1) |
Apr
|
May
(18) |
Jun
(2) |
Jul
(16) |
Aug
(2) |
Sep
|
Oct
(1) |
Nov
(4) |
Dec
(14) |
| 2018 |
Jan
(15) |
Feb
(2) |
Mar
(3) |
Apr
(5) |
May
(8) |
Jun
(12) |
Jul
(19) |
Aug
(16) |
Sep
(8) |
Oct
(13) |
Nov
(15) |
Dec
(10) |
| 2019 |
Jan
(9) |
Feb
(3) |
Mar
|
Apr
(2) |
May
|
Jun
(1) |
Jul
|
Aug
(5) |
Sep
(5) |
Oct
(12) |
Nov
(4) |
Dec
|
| 2020 |
Jan
(2) |
Feb
(6) |
Mar
|
Apr
|
May
(11) |
Jun
(1) |
Jul
(3) |
Aug
(22) |
Sep
(8) |
Oct
|
Nov
(2) |
Dec
|
| 2021 |
Jan
(7) |
Feb
|
Mar
(19) |
Apr
|
May
(10) |
Jun
(5) |
Jul
(7) |
Aug
(3) |
Sep
(1) |
Oct
|
Nov
(10) |
Dec
(4) |
| 2022 |
Jan
(17) |
Feb
|
Mar
(7) |
Apr
(3) |
May
|
Jun
(1) |
Jul
(3) |
Aug
|
Sep
|
Oct
(6) |
Nov
|
Dec
|
| 2023 |
Jan
|
Feb
(5) |
Mar
(1) |
Apr
(3) |
May
|
Jun
(3) |
Jul
(2) |
Aug
|
Sep
|
Oct
|
Nov
(6) |
Dec
|
| 2024 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(3) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2025 |
Jan
|
Feb
|
Mar
(15) |
Apr
(8) |
May
(10) |
Jun
|
Jul
|
Aug
|
Sep
(6) |
Oct
|
Nov
|
Dec
|
|
From: Kevin Z. <kev...@gm...> - 2016-01-02 01:36:25
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Greetings,
I am pleased to announce the release of SSHGuard 1.6.3 [1]. This
release brings stability and usability improvements, along with many
bug fixes and documentation updates. Highlights in this release include:
- Add sample systemd(8) unit file
- Disable blacklisting by default
- Fix `pfctl` command syntax with OpenBSD 5.8
- Implement logging as wrappers around syslog(2)
- Improve log and error messages
- Match sendmail authentication failures
- Remove PID file option
- Remove SIGTSTP and SIGCONT handler
- Remove reverse mapping attack signature
- Remove safe_fgets() and exit on interrupt
- Terminate state entries for hosts blocked with pf
- Update and shorten command-line usage
- Use 'configure' to set feature-test macros
As usual, please report any bugs, build failures, or other issues to
the mailing list or the Bitbucket tracker [2].
Happy 2016,
Kevin
[1] https://sourceforge.net/projects/sshguard/files/sshguard/1.6.3/
[2] https://bitbucket.org/sshguard/sshguard/issues/
- --
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJWhymOAAoJEOrPD3bCLhCQoEUIAI9lPTjbJ7WQ1dx/AQc8qLoL
dzbt3ZfxhC2QQLLU1OWYtrn3JVaVWSE3lm0+n9HPXfEDzxlU+e7h3wINFQWzFzfs
haVcbgAhIzKZgie0SMx2zwCJIIyLDdXOHEUc/gh2ribh15Wo8FmfsMfh2jg48yf4
j8dvVnw4NuTlQcRMlVcadtKFrz7dGsFOXuJPnrE+cePhyOl3k1FtHFdtx+5hz9QQ
RUuNPblOLy/ozstSfn7hC78UwVPxr3s+ULiNDeA4UoPmZRzGq2V7AdansuQossJk
mJ8KxK5Qb7lJr5j1oHC6XoGB1mFkGxC9A8GWxZRxw1iYuVwtUMJQEgV0gAPhO+A=
=bCg1
-----END PGP SIGNATURE-----
|
|
From: Kevin Z. <kev...@gm...> - 2015-12-27 03:58:29
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Greetings,
I hope this season finds everyone well.
SSHGuard 1.6.3 is just around the corner, bringing these changes:
- Add sample systemd(8) unit file
- Disable blacklisting by default
- Fix `pfctl` command syntax with OpenBSD 5.8
- Implement logging as wrappers around syslog(2)
- Improve log and error messages
- Match sendmail authentication failures
- Remove PID file option
- Remove SIGTSTP and SIGCONT handler
- Remove reverse mapping attack signature
- Remove safe_fgets() and exit on interrupt
- Terminate state entries for hosts blocked with pf
- Update and shorten command-line usage
- Use 'configure' to set feature-test macros
Starting in 1.6.3, releases will be cut from 'master'; there will not
be a separate release branch. The release is planned for January 1st,
2016. If you can, please help testing by cloning the 'master' branch
of the repository, building, running, and reporting issues you encounter
.
Very best,
Kevin
- --
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJWf2HWAAoJEOrPD3bCLhCQuygH/il8dn0BYz1pYJlfpeaZsxyu
iTFCqyRadJJ9KrnXf6wUOFQKkMvTuuxySOEfGsyzq2WkWs+rF0mg0ihCUdfpzeaO
hb9IuFR2Hs5R/D6Yh9wvSch1Z9rlGjv8UJlB1S/+mJ/CKqvcfBw+40tpaVaaJ49k
+v09pXqguURGbYKxyuZQsEwRxXFbL+KGWYvGKOF83rhqjMlNLJkfkfX4OL4jcO7a
aOecQ40hPAse/997LSLy+zoFhMBMAoLdJfz9bJVXWTRwcvOmeM1JzCXt5Pe3ZAah
wJ3iJYZgxmmNXtNjXp5iN5pEgPHPOJ6BFWOfBe224my1+dvR1xACPd3rAS7H1Fw=
=KbA4
-----END PGP SIGNATURE-----
|
|
From: Kevin Z. <kev...@gm...> - 2015-12-08 23:16:23
|
On 11/30/2015 12:46, Todd Eigenschink wrote: > It's pretty simple and might not be the best way to do it, but it > works and we've been using it for a couple months. Patch (attached) > against 1.6.2. Committed in f87dbf9, thanks! Best, Kevin -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 |
|
From: Kevin Z. <kev...@gm...> - 2015-12-08 22:29:45
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 12/01/2015 04:58, hildegard meier wrote:
> The only thing in the documentation for permanent blocking I found
> is with the black list option "-b" but I do not have that
> activated.
It looks like blacklisting is enabled by default. This is a bug. A fix
is in the works; meanwhile, you can work around this issue by setting
the blacklist threshold ('-b') to something high (up to UINT_MAX).
Thanks to everyone who reported this issue.
Best,
Kevin
- --
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJWZ1nXAAoJEOrPD3bCLhCQJmIIAMBpDanp0a+Zxgaw64bZOltk
+tQ1sEmEAQWc9GHPy3rCf+b9sNvB7bZrHu5WEqQ+OCDnHV5Z5S1d5+WrO4xD4hhy
F/0WLOPJ6rDwbMHugS8mOJ/AT2OHf8KXlkLJvjPQo4T53w8WtuJC+CUiCHhH4Ant
R4xEGEU6hZMB7BMFBtODloIduhhIbxHWJi8wPK8UvjG5CtKSYyu7p+XVvuzAYFdk
YZOPrvIMkA0vlI32aHRkohFYmJM2oxSZX3d825siBUYMZHFBKLjxP4MDPIxehagT
Cu+Pq9HmpPDGYw7g2MHlWfWQwVk44kqbGyuQRLDbUm9Dj4BoWLxnoQZI5aWIvNA=
=tS4D
-----END PGP SIGNATURE-----
|
|
From: Mark F. <fe...@Fr...> - 2015-12-08 16:27:38
|
On Sun, Dec 6, 2015, at 11:18, Doug Niven wrote: > Hello All, > > I’ve got a strange requirement of needing to whitelist a range of public > IP addresses except for about five specific addresses. > > Is there any way to do this with SSHGuard? I know this is possible using > PF, which is how SSHGuard interacts with our systems. > > Ideas, suggestions? > I never trust a tool like sshguard to whitelist. If I need a whitelist, I put it in the firewall rules and make sure they are *before* the sshguard block rules. -- Mark Felder ports-secteam member fe...@Fr... |
|
From: Doug N. <dn...@uc...> - 2015-12-06 17:49:25
|
Hello All, I’ve got a strange requirement of needing to whitelist a range of public IP addresses except for about five specific addresses. Is there any way to do this with SSHGuard? I know this is possible using PF, which is how SSHGuard interacts with our systems. Ideas, suggestions? Thanks in advance, Doug |
|
From: Kevin Z. <kev...@gm...> - 2015-12-02 07:23:53
|
Hi there, Thanks for the report. On 12/01/2015 04:58, hildegard meier wrote: > Does "Blocking for >0secs" mean blocking forever? I managed to reproduce this, but I'm not sure what it means. I'll be investigating and will let you know when I figure out. > Why it is blocked for more than three days now? Reading the > documentation the blocking time should double every time, and then > the IP should be released. This smells like a bug. Thanks, Kevin Zheng -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 |
|
From: <li...@la...> - 2015-12-02 06:38:44
|
Hey maybe this patch could be tweaked to work with postfix. ;-) Original Message From: Kevin Zheng Sent: Tuesday, December 1, 2015 9:34 PM To: ssh...@li... Reply To: ssh...@li... Subject: Re: [Sshguard-users] patch to add sendmail "AUTH failure" tracking Hi Todd, On 11/30/2015 12:46, Todd Eigenschink wrote: > It's pretty simple and might not be the best way to do it, but it > works and we've been using it for a couple months. Patch (attached) > against 1.6.2. Thanks for your patch. Do you have some sample log entries that I can use to test the new rules with? Best, Kevin -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 ------------------------------------------------------------------------------ Go from Idea to Many App Stores Faster with Intel(R) XDK Give your users amazing mobile app experiences with Intel(R) XDK. Use one codebase in this all-in-one HTML5 development environment. Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs. http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140 _______________________________________________ Sshguard-users mailing list Ssh...@li... https://lists.sourceforge.net/lists/listinfo/sshguard-users |
|
From: Kevin Z. <kev...@gm...> - 2015-12-02 05:33:40
|
Hi Todd, On 11/30/2015 12:46, Todd Eigenschink wrote: > It's pretty simple and might not be the best way to do it, but it > works and we've been using it for a couple months. Patch (attached) > against 1.6.2. Thanks for your patch. Do you have some sample log entries that I can use to test the new rules with? Best, Kevin -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 |
|
From: hildegard m. <dak...@gm...> - 2015-12-01 12:58:49
|
Hello, I am running sshguard 1.5 on Ubuntu 12.04.5 with iptables with the following parameters: /usr/sbin/sshguard -i /var/run/sshguard.pid -l /var/log/auth.log -w /etc/sshguard/whitelist -a 40 -p 420 -s 1200 There is a IP address block. Here the log entries: auth.log.4.gz:Nov 27 19:42:21 sshguard[26508]: Blocking 222.186.x.x:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s). auth.log.4.gz:Nov 27 19:53:49 sshguard[26508]: Blocking 222.186.x.x:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 696s). auth.log.4.gz:Nov 27 20:10:29 sshguard[26508]: Blocking 222.186.x.x:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 1696s). Since, then, that IP address keeps beeing blocked, it is not released, no new messages regarding that IP address in the log, and still blocked in iptables: iptables-save -A sshguard -s 222.186.x.x/32 -j DROP Does "Blocking for >0secs" mean blocking forever? Why it is blocked for more than three days now? Reading the documentation the blocking time should double every time, and then the IP should be released. The only thing in the documentation for permanent blocking I found is with the black list option "-b" but I do not have that activated. How can I disable the permanent blocking? I have the same behaviour also with another IP- it seems to be blocked forever on the third blocking event. |
|
From: Todd E. <to...@xy...> - 2015-11-30 20:58:54
|
It's pretty simple and might not be the best way to do it, but it works and we've been using it for a couple months. Patch (attached) against 1.6.2. Todd -- Todd Eigenschink Xymmetrix, LLC to...@xy... http://www.xymmetrix.com/ Non ex transverso sed deorsum 260-407-1584 |
|
From: Kevin Z. <kev...@gm...> - 2015-11-19 07:01:21
|
Hi Toni, On 11/18/2015 12:24, ton...@ni... wrote: > > One of my systems was undergoing an attack this morning where every 10 minutes > *one* attempt was made to a different non-existent account from a specific IP > address. The signature was 'Invalid user XXX from Y.Y.Y.Y'. None of the other > signatures was triggered. I don't want to increase the sensitivity for fear > of blocking innocent failures, and anyone who is is approved to this system > will *not* be triggering the 'Invalid user ...' signature. > > Is it possible to increase the 'dangerousness' value for the 'Invalid user ...' > signature? No. This should really be a bug, but the attack parser needs to be rewritten in order for different attacks to be given different values. It's on the to-do list, but I probably won't have time to look at it for some time. Unfortunately, I don't have a good workaround, either. Sorry. Best, Kevin -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 |
|
From: <ton...@ni...> - 2015-11-18 20:25:27
|
One of my systems was undergoing an attack this morning where every 10 minutes *one* attempt was made to a different non-existent account from a specific IP address. The signature was 'Invalid user XXX from Y.Y.Y.Y'. None of the other signatures was triggered. I don't want to increase the sensitivity for fear of blocking innocent failures, and anyone who is is approved to this system will *not* be triggering the 'Invalid user ...' signature. Is it possible to increase the 'dangerousness' value for the 'Invalid user ...' signature? Thanks, Toni |
|
From: <li...@la...> - 2015-11-14 19:02:03
|
Thanks. I guess I will just block the IP for a while. All my passwords are high entropy so nobody will get in, but the attempts clog up the logs. On a positive note, ssgguard runs like a Swiss watch. The table has gone as high as 600+ addresses without a hitch. Original Message From: Kevin Zheng Sent: Saturday, November 14, 2015 10:02 AM To: ssh...@li... Reply To: ssh...@li... Subject: Re: [Sshguard-users] Lockout for postfix abuse On 11/13/2015 21:02, li...@la... wrote: > Doing some internet searches, I see a patch was accepted to catch > failed SASL authentications, which in turn would catch postfix. > http://sourceforge.net/p/sshguard/patches/8/ These patches block SASL authentication failures only, not the messages that you asked about. They still need to be written and tested. Unfortunately I've been unusually busy lately so there's no ETA. > Does "accepted" confirm implementation? If not, is the patch > compatible with the current rev of sshguard. I'm using IPFW on > Freebsd 10.2. I can use ports, so I assume I can figure out how to > apply the patch. Yes, patches that are "accepted" have been committed. Best, Kevin Zheng -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 ------------------------------------------------------------------------------ _______________________________________________ Sshguard-users mailing list Ssh...@li... https://lists.sourceforge.net/lists/listinfo/sshguard-users |
|
From: Kevin Z. <kev...@gm...> - 2015-11-14 18:01:34
|
On 11/13/2015 21:02, li...@la... wrote: > Doing some internet searches, I see a patch was accepted to catch > failed SASL authentications, which in turn would catch postfix. > http://sourceforge.net/p/sshguard/patches/8/ These patches block SASL authentication failures only, not the messages that you asked about. They still need to be written and tested. Unfortunately I've been unusually busy lately so there's no ETA. > Does "accepted" confirm implementation? If not, is the patch > compatible with the current rev of sshguard. I'm using IPFW on > Freebsd 10.2. I can use ports, so I assume I can figure out how to > apply the patch. Yes, patches that are "accepted" have been committed. Best, Kevin Zheng -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 |
|
From: <li...@la...> - 2015-11-14 05:02:24
|
Doing some internet searches, I see a patch was accepted to catch failed SASL authentications, which in turn would catch postfix. http://sourceforge.net/p/sshguard/patches/8/ Does "accepted" confirm implementation? If not, is the patch compatible with the current rev of sshguard. I'm using IPFW on Freebsd 10.2. I can use ports, so I assume I can figure out how to apply the patch. Original Message From: li...@la... Sent: Thursday, November 12, 2015 7:02 PM To: ssh...@li... Reply To: ssh...@li... Subject: [Sshguard-users] Lockout for postfix abuse I see sshguard reads exim and Dovecot logs, but not postfix, based on the attack signature reference page. Is there something I can do to stop hackers such as the one listed below: Nov 13 01:10:53 theranch postfix/smtpd[16895]: connect from unknown[203.71.152.23] Nov 13 01:10:53 theranch postfix/smtpd[16895]: lost connection after EHLO from unknown[203.71.152.23] Nov 13 01:10:53 theranch postfix/smtpd[16895]: disconnect from unknown[203.71.152.23] Nov 13 01:14:13 theranch postfix/anvil[16897]: statistics: max connection rate 1/60s for (smtp:203.71.152.23) at Nov 1 3 01:10:53 Nov 13 01:14:13 theranch postfix/anvil[16897]: statistics: max connection count 1 for (smtp:203.71.152.23) at Nov 13 0 1:10:53 ------------------------------------------------------------------------------ _______________________________________________ Sshguard-users mailing list Ssh...@li... https://lists.sourceforge.net/lists/listinfo/sshguard-users |
|
From: <li...@la...> - 2015-11-13 03:01:44
|
I see sshguard reads exim and Dovecot logs, but not postfix, based on the attack signature reference page. Is there something I can do to stop hackers such as the one listed below: Nov 13 01:10:53 theranch postfix/smtpd[16895]: connect from unknown[203.71.152.23] Nov 13 01:10:53 theranch postfix/smtpd[16895]: lost connection after EHLO from unknown[203.71.152.23] Nov 13 01:10:53 theranch postfix/smtpd[16895]: disconnect from unknown[203.71.152.23] Nov 13 01:14:13 theranch postfix/anvil[16897]: statistics: max connection rate 1/60s for (smtp:203.71.152.23) at Nov 1 3 01:10:53 Nov 13 01:14:13 theranch postfix/anvil[16897]: statistics: max connection count 1 for (smtp:203.71.152.23) at Nov 13 0 1:10:53 |
|
From: Sistemisti <sis...@pr...> - 2015-10-21 11:38:08
|
Hi, I run sshguard without specifying the -p parameter, so the default blocking timeout must be 420 seconds. In the log I find the following rows: Oct 21 07:07:31 xxx sshguard[12004]: Blocking X.X.X.X:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s). Oct 21 07:19:58 xxx sshguard[12004]: Blocking X.X.X.X:4 for >945secs: 40 danger in 4 attacks over 13 seconds (all: 80d in 2 abuses over 754s). Oct 21 07:37:33 xxx sshguard[12004]: Blocking X.X.X.X:4 for >0secs: 40 danger in 4 attacks over 5 seconds (all: 120d in 3 abuses over 1809s) I cannot understand why I have a blocking timeout >630secs as first entry, and why in the third row sshguard reports a blocking timeout >0secs. Thanks Classification: Public [ ] Confidential [X] Restrict [ ] Matteo De Lazzari Information Technology PREVINET S.p.A. Via E. Forlanini, 24 - 31022 Preganziol (TV) - ITALY tel +39 - 0422 1745279 mat...@pr... [http://www.previnet.it/images/PrevinetOutlook.jpg] Ai sensi del D.Lgs. 196/2003 sulla tutela dei dati personali, la presente comunicazione e ogni suo allegato e' destinata esclusivamente al soggetto indicato quale destinatario o ad eventuali altri soggetti autorizzati a riceverla. L'utilizzo non autorizzato e' vietato e potrebbe costituire reato. Essa contiene informazioni strettamente confidenziali e riservate, la cui comunicazione o diffusione a terzi e' proibita, salvo che non sia stata espressamente autorizzata. Se avete ricevuto questa e-mail per errore, Vi preghiamo di comunicarlo senza indugio al mittente e di cancellarne ogni evidenza dai Vostri supporti. This message is intended only for the named recipient and may contain confidential, proprietary or legally privileged information. Unauthorized persons are not permitted access to this information. Any dissemination, distribution or copying of this information is strictly prohibited. If you have received this message in error, please advise the sender by reply e-mail and delete this message and any attachments. |
|
From: Sistemisti <sis...@pr...> - 2015-10-13 09:40:27
|
Thanks! CLASSIFICATION: PUBLIC [ ] CONFIDENTIAL [X] RESTRICT [ ] Matteo De Lazzari Information Technology PREVINET S.p.A. Via E. Forlanini, 24 - 31022 Preganziol (TV) - ITALY tel +39 - 0422 1745279 mat...@pr... Ai sensi del D.Lgs. 196/2003 sulla tutela dei dati personali, la presente comunicazione e ogni suo allegato e' destinata esclusivamente al soggetto indicato quale destinatario o ad eventuali altri soggetti autorizzati a riceverla. L'utilizzo non autorizzato e' vietato e potrebbe costituire reato. Essa contiene informazioni strettamente confidenziali e riservate, la cui comunicazione o diffusione a terzi e' proibita, salvo che non sia stata espressamente autorizzata. Se avete ricevuto questa e-mail per errore, Vi preghiamo di comunicarlo senza indugio al mittente e di cancellarne ogni evidenza dai Vostri supporti. This message is intended only for the named recipient and may contain confidential, proprietary or legally privileged information. Unauthorized persons are not permitted access to this information. Any dissemination, distribution or copying of this information is strictly prohibited. If you have received this message in error, please advise the sender by reply e-mail and delete this message and any attachments. -----Messaggio originale----- Da: Kevin Zheng [mailto:kev...@gm...] Inviato: lunedì 12 ottobre 2015 19:35 A: ssh...@li... Oggetto: Re: [Sshguard-users] problem running sshguard On 10/12/2015 03:51, Sistemisti wrote: > I'm trying to run sshguard on an redhat 6.6, but launching > /usr/local/sshguard-1.6.1/sbin/sshguard -l /var/log/secure, I get the > following error, and then iptables dies. > > iptables v1.4.7: option `-w' requires an argument > > Try `iptables -h' or 'iptables --help' for more information. > > Could not init firewall. Terminating. > > > > What is going wrong? Thanks SSHGuard uses the '-w' argument to iptables, however, the '-w' argument is fairly new and probably not available on your machine. A patch to fix this problem was committed in the development branch, but has not made it to a release. I've added this patch to the 1.6.2 release that's supposed to be coming imminently. Thanks, Kevin Zheng -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 ------------------------------------------------------------------------------ _______________________________________________ Sshguard-users mailing list Ssh...@li... https://lists.sourceforge.net/lists/listinfo/sshguard-users |
|
From: Kevin Z. <kev...@gm...> - 2015-10-12 23:47:06
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Greetings, It is my pleasure to announce the availability of the SSHGuard 1.6.2 release. This release backports a compatibility fix for the iptables backend and overhauls the ipfw backend. If you are not using either backend, you do not need to upgrade. If you are not currently experiencing issues with 'iptables', you do not need to upgrade. If you are running 'ipfw', you should definitely upgrad e. If you are running 'ipfw', you will need to make changes to your firewall configuration. SSHGuard will add addresses to table 22 (currently hard-coded in SSHGuard); you will need to write the firewall rule that uses the table to actually do something. This will most likely be the last release from the 1.6 branch. Developing in 'master' and backporting fixes for releases is too cumbersome at this point and prevents features from landing at a reasonable pace. Future releases will be cut from 'master', beginning with 1.7.0. I haven't figured out a version scheme, though. The source tarball, along with a GPG-signed checksum, is available from SourceForge. Only a XZ'ed tarball is available; if anyone still needs a gzip'ed tarball please let me know. As usual, please report issues on the Bitbucket tracker or mailing list. Best, Kevin Zheng - -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJWHEZwAAoJEOrPD3bCLhCQLRsH/jyyRTP3aXaKjEvHbJvImS9f OEEKz4VZel4iHPxqMcpeA4/qnWs5lyQCdCWC+C0Nt+etScRDfSOQ4bf3lVE8z0rV jT0n1yGtnXDu8W2sVednMlwC+EonMHHZeH+bmVDFb9FWT165Pgy5FuxXiPfxsvVz TnogaqiH3EJgUBtRNDcTNUdl/zWo5Z9ae3ejDqSBtKLnxUbrlWiRbLTndizT7xeS pgwEG+FSFh6nss1WSdJMDzC9vQIZ0BnNPBV5GcJMfwoN0N0CeONstguWB0POVZhj 5eMuxIIFXsIUuRMjgt28nrKr3wUfOYv8pZxDWe3nB9cGZEk5LbLpgUS0ks14lKU= =ee63 -----END PGP SIGNATURE----- |
|
From: Kevin Z. <kev...@gm...> - 2015-10-12 17:35:19
|
On 10/12/2015 03:51, Sistemisti wrote: > I’m trying to run sshguard on an redhat 6.6, but launching > /usr/local/sshguard-1.6.1/sbin/sshguard -l /var/log/secure, I get the > following error, and then iptables dies. > > iptables v1.4.7: option `-w' requires an argument > > Try `iptables -h' or 'iptables --help' for more information. > > Could not init firewall. Terminating. > > > > What is going wrong? Thanks SSHGuard uses the '-w' argument to iptables, however, the '-w' argument is fairly new and probably not available on your machine. A patch to fix this problem was committed in the development branch, but has not made it to a release. I've added this patch to the 1.6.2 release that's supposed to be coming imminently. Thanks, Kevin Zheng -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 |
|
From: Sistemisti <sis...@pr...> - 2015-10-12 10:51:42
|
Dear all, I'm trying to run sshguard on an redhat 6.6, but launching /usr/local/sshguard-1.6.1/sbin/sshguard -l /var/log/secure, I get the following error, and then iptables dies. iptables v1.4.7: option `-w' requires an argument Try `iptables -h' or 'iptables --help' for more information. Could not init firewall. Terminating. What is going wrong? Thanks Classification: Public [ ] Confidential [X] Restrict [ ] Matteo De Lazzari Information Technology PREVINET S.p.A. Via E. Forlanini, 24 - 31022 Preganziol (TV) - ITALY tel +39 - 0422 1745279 mat...@pr... [http://www.previnet.it/images/PrevinetOutlook.jpg] Ai sensi del D.Lgs. 196/2003 sulla tutela dei dati personali, la presente comunicazione e ogni suo allegato e' destinata esclusivamente al soggetto indicato quale destinatario o ad eventuali altri soggetti autorizzati a riceverla. L'utilizzo non autorizzato e' vietato e potrebbe costituire reato. Essa contiene informazioni strettamente confidenziali e riservate, la cui comunicazione o diffusione a terzi e' proibita, salvo che non sia stata espressamente autorizzata. Se avete ricevuto questa e-mail per errore, Vi preghiamo di comunicarlo senza indugio al mittente e di cancellarne ogni evidenza dai Vostri supporti. This message is intended only for the named recipient and may contain confidential, proprietary or legally privileged information. Unauthorized persons are not permitted access to this information. Any dissemination, distribution or copying of this information is strictly prohibited. If you have received this message in error, please advise the sender by reply e-mail and delete this message and any attachments. |
|
From: <li...@la...> - 2015-10-10 20:37:17
|
<html><head></head><body dir="auto" lang="en-US" style="background-color: rgb(255, 255, 255); line-height: initial;"> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">I've been running the development version with a table nearly 600 IP addresses long. It works great. No crashes.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">There is no indication of when IP addresses are freed (removed from table). That might be a future feature. </div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br style="display:initial"></div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"></div> <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;"> <div><b>From: </b>Greg Putrich</div><div><b>Sent: </b>Saturday, October 10, 2015 10:41 AM</div><div><b>To: </b>ssh...@li...</div><div><b>Reply To: </b>ssh...@li...</div><div><b>Subject: </b>Re: [Sshguard-users] core dump after upgrade due to blacklist</div></div></td></tr></tbody></table><div style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style=""><meta http-equiv="content-type" content="text/html; charset=utf-8"><div></div><div>Chris,</div><div><br></div><div>The blacklist is too big. Delete it all, or leave 3-4 entries.</div><div><br></div><div>The problem is that it tries to add all of them in one big long ipfw rule and its too long.</div><div><br></div><div>There was a patch in 1.6.0 in the FreeBSD port to deal with that. There's a far better fix coming in sshguard that uses an ipfw table instead of individual rules. And that fix will handle the blacklist file.</div><div><br></div><div><br></div><div>Kevin, </div><div>Do you have an idea when the version with the new ipfw method will be released? If its going to a bit yet, I can look into getting that previous patch into the FreeBSD port again.</div><div><br></div><div><br></div><div>Greg</div><div><br></div><div><br></div><div><br></div><div><br>On Sep 25, 2015, at 14:02, Chris St Denis <<a href="mailto:ch...@ct...">ch...@ct...</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
I upgraded from 1.6.0 to 1.6.1 and it started crashing on load. <br>
<blockquote>Bus error (core dumped)<br>
</blockquote>
Here is a backtrace, tho it doesn't look that useful. I still have
the core file so I can generate better ones with instructions.<br>
<blockquote>#0 0x0000000800c24b33 in getenv () from /lib/libc.so.7<br>
[New Thread 801406800 (LWP 101216/sshguard)]<br>
[New Thread 801406400 (LWP 101479/sshguard)]<br>
(gdb) bt<br>
#0 0x0000000800c24b33 in getenv () from /lib/libc.so.7<br>
#1 0x0000000800c04479 in tzset () from /lib/libc.so.7<br>
#2 0x0000000800c04c56 in ctime_r () from /lib/libc.so.7<br>
#3 0x0000000800c01ca1 in vsyslog () from /lib/libc.so.7<br>
#4 0x0000000800c01b7b in syslog () from /lib/libc.so.7<br>
#5 0x0000000000404125 in ?? ()<br>
#6 0x00000000004028a6 in ?? ()<br>
#7 0x000000000040236f in ?? ()<br>
#8 0x00000008006c4000 in ?? ()<br>
#9 0x0000000000000000 in ?? ()<br>
</blockquote>
A little experimenting showed that it was being caused by something
in the blacklist file. Renaming the file and letting it create a new
one fixed it. <br>
<br>
Here is a copy of the file. Hopefully a dev can reproduce the crash
with it.<br>
<blockquote># SSHGuard blacklist file ( <a class="moz-txt-link-freetext" href="http://www.sshguard.net/">http://www.sshguard.net/</a> ).<br>
# Format of entries:
BLACKLIST_TIMESTAMP|SERVICE|ADDRESS_TYPE|ADDRESS<br>
1437287630|100|4|5.231.228.91<br>
1437315019|100|4|222.186.52.213<br>
1437516671|100|4|58.52.134.5<br>
1437651459|100|4|222.186.42.218<br>
1438097148|100|4|104.149.197.97<br>
1438128829|100|4|222.186.56.112<br>
1438296390|100|4|5.255.144.81<br>
1438391422|100|4|125.39.170.138<br>
1438435051|100|4|169.54.233.117<br>
1438538121|100|4|111.73.46.231<br>
1438547318|100|4|111.20.145.210<br>
1438584253|100|4|222.186.34.86<br>
1438786729|100|4|203.124.106.16<br>
1438924282|100|4|218.2.22.36<br>
1439138420|100|4|117.21.191.209<br>
1439162584|100|4|222.186.21.46<br>
1439215230|100|4|222.186.30.21<br>
1439247605|100|4|114.241.155.156<br>
1439247705|100|4|114.241.130.204<br>
1439247740|100|4|114.241.137.4<br>
1439247948|100|4|123.123.213.36<br>
1439247981|100|4|114.241.157.237<br>
1439248058|100|4|114.241.135.160<br>
1439248113|100|4|123.123.215.187<br>
1439248458|100|4|123.123.214.60<br>
1439468360|100|4|61.186.245.211<br>
1439468360|100|4|113.204.53.134<br>
1439540283|100|4|169.54.233.126<br>
1439811166|100|4|211.37.45.100<br>
1439948790|100|4|119.254.16.13<br>
1440049115|100|4|103.254.110.52<br>
1440349237|100|4|219.235.4.119<br>
1440558369|100|4|61.160.212.144<br>
1440810164|100|4|169.54.233.120<br>
1441038197|100|4|61.183.35.86<br>
1441257970|100|4|222.186.15.92<br>
1441346100|100|4|221.12.5.107<br>
1441599273|100|4|221.231.6.245<br>
1441780504|100|4|222.186.190.55<br>
1442222411|100|4|222.186.56.107<br>
1442434123|100|4|222.186.56.114<br>
1442490491|100|4|169.54.233.121<br>
1443104332|100|4|222.186.30.202<br>
</blockquote>
Other info<br>
<blockquote>root@Rin:/ # sshguard -v<br>
sshguard 1.6.1<br>
<br>
root@Rin:/ # uname -a<br>
FreeBSD <a href="http://rin.ctgameinfo.com">Rin.ctgameinfo.com</a> 10.1-RELEASE-p15 FreeBSD
10.1-RELEASE-p15 #0: Tue Jul 21 18:00:00 UTC 2015
<a class="moz-txt-link-abbreviated" href="mailto:ro...@am...:/usr/obj/usr/src/sys/GENERIC">ro...@am...:/usr/obj/usr/src/sys/GENERIC</a>
amd64<br>
</blockquote>
</div></blockquote><blockquote type="cite"><div><span>------------------------------------------------------------------------------</span><br></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Sshguard-users mailing list</span><br><span><a href="mailto:Ssh...@li...">Ssh...@li...</a></span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/sshguard-users">https://lists.sourceforge.net/lists/listinfo/sshguard-users</a></span><br></div></blockquote><br><!--end of _originalContent --></div></body></html>
|
|
From: Kevin Z. <kev...@gm...> - 2015-10-10 17:44:08
|
On 10/10/2015 10:25, Greg Putrich wrote: > Do you have an idea when the version with the new ipfw method will be > released? If its going to a bit yet, I can look into getting that > previous patch into the FreeBSD port again. Yeah, sorry for dragging my feet. I'll try to get 1.6.2 out by the end of this weekend. The only change will probably be the fix for ipfw. Thanks, Kevin Zheng -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 |
|
From: Greg P. <gr...@n0...> - 2015-10-10 17:41:01
|
Chris, The blacklist is too big. Delete it all, or leave 3-4 entries. The problem is that it tries to add all of them in one big long ipfw rule and its too long. There was a patch in 1.6.0 in the FreeBSD port to deal with that. There's a far better fix coming in sshguard that uses an ipfw table instead of individual rules. And that fix will handle the blacklist file. Kevin, Do you have an idea when the version with the new ipfw method will be released? If its going to a bit yet, I can look into getting that previous patch into the FreeBSD port again. Greg > On Sep 25, 2015, at 14:02, Chris St Denis <ch...@ct...> wrote: > > I upgraded from 1.6.0 to 1.6.1 and it started crashing on load. > Bus error (core dumped) > Here is a backtrace, tho it doesn't look that useful. I still have the core file so I can generate better ones with instructions. > #0 0x0000000800c24b33 in getenv () from /lib/libc.so.7 > [New Thread 801406800 (LWP 101216/sshguard)] > [New Thread 801406400 (LWP 101479/sshguard)] > (gdb) bt > #0 0x0000000800c24b33 in getenv () from /lib/libc.so.7 > #1 0x0000000800c04479 in tzset () from /lib/libc.so.7 > #2 0x0000000800c04c56 in ctime_r () from /lib/libc.so.7 > #3 0x0000000800c01ca1 in vsyslog () from /lib/libc.so.7 > #4 0x0000000800c01b7b in syslog () from /lib/libc.so.7 > #5 0x0000000000404125 in ?? () > #6 0x00000000004028a6 in ?? () > #7 0x000000000040236f in ?? () > #8 0x00000008006c4000 in ?? () > #9 0x0000000000000000 in ?? () > A little experimenting showed that it was being caused by something in the blacklist file. Renaming the file and letting it create a new one fixed it. > > Here is a copy of the file. Hopefully a dev can reproduce the crash with it. > # SSHGuard blacklist file ( http://www.sshguard.net/ ). > # Format of entries: BLACKLIST_TIMESTAMP|SERVICE|ADDRESS_TYPE|ADDRESS > 1437287630|100|4|5.231.228.91 > 1437315019|100|4|222.186.52.213 > 1437516671|100|4|58.52.134.5 > 1437651459|100|4|222.186.42.218 > 1438097148|100|4|104.149.197.97 > 1438128829|100|4|222.186.56.112 > 1438296390|100|4|5.255.144.81 > 1438391422|100|4|125.39.170.138 > 1438435051|100|4|169.54.233.117 > 1438538121|100|4|111.73.46.231 > 1438547318|100|4|111.20.145.210 > 1438584253|100|4|222.186.34.86 > 1438786729|100|4|203.124.106.16 > 1438924282|100|4|218.2.22.36 > 1439138420|100|4|117.21.191.209 > 1439162584|100|4|222.186.21.46 > 1439215230|100|4|222.186.30.21 > 1439247605|100|4|114.241.155.156 > 1439247705|100|4|114.241.130.204 > 1439247740|100|4|114.241.137.4 > 1439247948|100|4|123.123.213.36 > 1439247981|100|4|114.241.157.237 > 1439248058|100|4|114.241.135.160 > 1439248113|100|4|123.123.215.187 > 1439248458|100|4|123.123.214.60 > 1439468360|100|4|61.186.245.211 > 1439468360|100|4|113.204.53.134 > 1439540283|100|4|169.54.233.126 > 1439811166|100|4|211.37.45.100 > 1439948790|100|4|119.254.16.13 > 1440049115|100|4|103.254.110.52 > 1440349237|100|4|219.235.4.119 > 1440558369|100|4|61.160.212.144 > 1440810164|100|4|169.54.233.120 > 1441038197|100|4|61.183.35.86 > 1441257970|100|4|222.186.15.92 > 1441346100|100|4|221.12.5.107 > 1441599273|100|4|221.231.6.245 > 1441780504|100|4|222.186.190.55 > 1442222411|100|4|222.186.56.107 > 1442434123|100|4|222.186.56.114 > 1442490491|100|4|169.54.233.121 > 1443104332|100|4|222.186.30.202 > Other info > root@Rin:/ # sshguard -v > sshguard 1.6.1 > > root@Rin:/ # uname -a > FreeBSD Rin.ctgameinfo.com 10.1-RELEASE-p15 FreeBSD 10.1-RELEASE-p15 #0: Tue Jul 21 18:00:00 UTC 2015 ro...@am...:/usr/obj/usr/src/sys/GENERIC amd64 > ------------------------------------------------------------------------------ > _______________________________________________ > Sshguard-users mailing list > Ssh...@li... > https://lists.sourceforge.net/lists/listinfo/sshguard-users |
2 messages has been excluded from this view by a project administrator.
