sshguard-users — User questions and answers, bugs, and general support

[Sshguard-users] New install

[LuKreme <kr...@kr...>]

I have sshguard installed and running, but I still have a few questions.

When does it block an IP? How many failed attempts does it take, and is that configurable,. Do IPs ever expire from the block list?

Do I need to be concerned about the following?

No ALTQ support in kernel
ALTQ related functions disabled


(OS X 10.10, macports install of sshguard 1.5)

-- 
The real world was far too real to leave neat little hints. It was full
of too many things. It wasn't by eliminating the impossible that you got
at the truth, however improbable; it was by the much harder process of
eliminating the possibilities. --Feet of Clay

Re: [Sshguard-users] Blacklisting option causes 'exited with status 1'

[Jonathan G. <Jon...@ir...>]

Yes, using from ports.

Thank you.

-----Original Message-----
From: Kevin Zheng [mailto:kev...@gm...] 
Sent: Tuesday, December 09, 2014 4:51 PM
To: ssh...@li...
Subject: Re: [Sshguard-users] Blacklisting option causes 'exited with status 1'

Hi Jonathan,

On 12/09/2014 16:28, Jonathan Green wrote:
> We are running sshguard 1.5, with BSD 9.1, and pf .  When a violation 
> occurs, instead of blacklisting the IP, we get 'logging subprocess ... 
> exited with status 1'.

It sounds like you're using FreeBSD, is that correct? If so, are you using the sshguard from ports or compiling from source?

Thanks,
Kevin Zheng

--
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server from Actuate! Instantly Supercharge Your Business Reports and Dashboards with Interactivity, Sharing, Native Excel Exports, App Integration & more Get technology previously reserved for billion-dollar corporations, FREE http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk
_______________________________________________
Sshguard-users mailing list
Ssh...@li...
https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] Blacklisting option causes 'exited with status 1'

[Kevin Z. <kev...@gm...>]

Hi Jonathan,

On 12/09/2014 16:28, Jonathan Green wrote:
> We are running sshguard 1.5, with BSD 9.1, and pf .  When a violation
> occurs, instead of blacklisting the IP, we get ‘logging subprocess … 
> exited with status 1’.

It sounds like you're using FreeBSD, is that correct? If so, are you
using the sshguard from ports or compiling from source?

Thanks,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

Re: [Sshguard-users] Blacklisting option causes 'exited with status 1'

[Jonathan G. <Jon...@ir...>]

Hello there:

We are running sshguard 1.5, with BSD 9.1, and pf .  When a violation occurs, instead of blacklisting the IP, we get 'logging subprocess ...  exited with status 1'.

In /etc/pf.conf:

table <sshguard> persist
block in quick on $ext_if proto tcp from <sshguard> to any port 22 label "ssh bruteforce"

In /etc/syslog.conf:

auth.info;authpriv.info     |exec /usr/local/sbin/sshguard  -b 5:/usr/local/etc/sshguard.db   -w /usr/local/etc/sshguard.whitelist


If we remove the -b option, sshguard works just fine.  However we would like to use the blacklisting feature.

Any help would be greatly appreciated.

Thank you.

Re: [Sshguard-users] Problem with blocking "strings" not being IPs

[Kevin Z. <kev...@gm...>]

Hi Peter,

Sorry for the follow-up email.

SSHGuard uses regular expressions in its lexer to match attack
signatures and IP addresses. This means that if you feed it an invalid
IP address it shouldn't even try to block it.

Would it be possible for you to try using the "log sucker" option by
specifying a log file on the command line? I'm wondering if this is
something funny happening with syslog-ng.

Incorrect string handling sounds troubling; do you have snippets of logs
that we can take a look at and test?

Thanks,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

Re: [Sshguard-users] Problem with blocking "strings" not being IPs

[Kevin Z. <kev...@gm...>]

Hi Peter,

Sorry I haven't gotten back to you on an earlier email.

On 11/27/2014 16:54, Peter Viskup wrote:
> todays messages:
> Nov 27 23:31:25 server sshguard[25526]: Releasing  after 450 seconds.
> Nov 27 23:31:25 server sshguard[25526]: Setting environment:
> SSHG_ADDR=SSHG_ADDR=<E8>~a^GL^?;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
> Nov 27 23:31:25 server sshguard[25526]: Run command "case $SSHG_ADDRKIND
> in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;; 6) exec
> /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2 ;;
> esac": exited 2.
> Nov 27 23:31:25 server sshguard[25526]: Release command failed. Exited: -1

If random characters made it in, this failure isn't surprising since the
code uses the system(3) call.

> Other strange messages:
> Nov 27 23:34:16 server sshguard[25526]: Releasing  after 621 seconds.
> Nov 27 23:34:16 server sshguard[25526]: Setting environment:
> SSHG_ADDR=0;SSHG_ADDRKIND=0;SSHG_SERVICE=0.
> Nov 27 23:34:16 server sshguard[25526]: Run command "case $SSHG_ADDRKIND
> in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;; 6) exec
> /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2 ;;
> esac": exited 2.
> Nov 27 23:34:16 server sshguard[25526]: Release command failed. Exited: -1

This seems like the same problem as above.

> Both examples are for rules removal. There are no messages for
> corresponding iptables inserts.

I'm baffled that there are no inserts, but removals. I'm not very
familiar with the iptables backend; if this happens frequently try
flushing the rules or the blacklist file (if any).

> I do see some strange users as inputs.
> "Failed password for invalid user rock123\r"

I'm not sure if these characters make it in or not; if they do, then
this is the culprit. This sounds dangerous, too.

> Could be that message strings are not handled appropriately and
> specially crafted user accounts lead to unexpected results. Could
> anybody have a look on that?

I'll be taking a look!

Thanks,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

Re: [Sshguard-users] Problem with blocking "strings" not being IPs

[Peter V. <sku...@gm...>]

Hi all,
todays messages:
Nov 27 23:31:25 server sshguard[25526]: Releasing  after 450 seconds.
Nov 27 23:31:25 server sshguard[25526]: Setting environment:
SSHG_ADDR=SSHG_ADDR=<E8>~a^GL^?;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
Nov 27 23:31:25 server sshguard[25526]: Run command "case $SSHG_ADDRKIND in
4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;; 6) exec
/sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2 ;; esac":
exited 2.
Nov 27 23:31:25 server sshguard[25526]: Release command failed. Exited: -1

Other strange messages:
Nov 27 23:34:16 server sshguard[25526]: Releasing  after 621 seconds.
Nov 27 23:34:16 server sshguard[25526]: Setting environment:
SSHG_ADDR=0;SSHG_ADDRKIND=0;SSHG_SERVICE=0.
Nov 27 23:34:16 server sshguard[25526]: Run command "case $SSHG_ADDRKIND in
4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;; 6) exec
/sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2 ;; esac":
exited 2.
Nov 27 23:34:16 server sshguard[25526]: Release command failed. Exited: -1

Both examples are for rules removal. There are no messages for
corresponding iptables inserts.

I do see some strange users as inputs.
"Failed password for invalid user rock123\r"

Could be that message strings are not handled appropriately and specially
crafted user accounts lead to unexpected results. Could anybody have a look
on that?

sshguard 1.4-2
syslog-ng 3.1.3-3

-- 
Peter Viskup

On Fri, Nov 14, 2014 at 9:09 PM, Peter Viskup <sku...@gm...> wrote:

> Hi Kevin,
> thanks for quick reply. Running syslog-ng version 3.1.3-3.
>
> filter sshlogs { facility(auth, authpriv) and not match("sshguard"
> value("MESSAGE")); };
> destination sshguardproc {
>         program("/usr/sbin/sshguard -w <some_IP>/24"
> log { source(s_src); filter(sshlogs); destination(sshguardproc); };
>
> No other [white,black]listing.
>
>
> On Fri, Nov 14, 2014 at 9:02 PM, Kevin Zheng <kev...@gm...> wrote:
>
>> Hi Peter,
>>
>> On 11/14/2014 13:51, Peter Viskup wrote:
>> > anybody seeing/saw similar messages? Once this occur the SSH isn't
>> > accessible at least our Zabbix monitoring reporting that.
>> >
>> > Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after
>> 1372366479 seconds.
>> > Jun  4 21:31:43 server sshguard[8003]: Setting environment:
>> SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
>> > Jun  4 21:31:43 server sshguard[8003]: Run command "case $SSHG_ADDRKIND
>> in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;;
>> >  6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit
>> -2 ;; esac": exited 1.
>> > Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited:
>> -1
>>
>> This sounds like SSHGuard picking up some invalid IP addresses and
>> passing them on. Are you using Log Sucker or syslog?
>>
>> Additionally, something could have been happening with the blacklist
>> database. What whitelist/blacklist settings are you using?
>>
>> Thanks,
>> Kevin Zheng
>>
>> --
>> Kevin Zheng
>> kev...@gm... | ke...@kd... | PGP: 0xC22E1090
>>
>>
>> ------------------------------------------------------------------------------
>> Comprehensive Server Monitoring with Site24x7.
>> Monitor 10 servers for $9/Month.
>> Get alerted through email, SMS, voice calls or mobile push notifications.
>> Take corrective actions from your mobile device.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Sshguard-users mailing list
>> Ssh...@li...
>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>>
>
>

Re: [Sshguard-users] Problem with blocking "strings" not being IPs

[Peter V. <sku...@gm...>]

Hi Kevin,
thanks for quick reply. Running syslog-ng version 3.1.3-3.

filter sshlogs { facility(auth, authpriv) and not match("sshguard"
value("MESSAGE")); };
destination sshguardproc {
        program("/usr/sbin/sshguard -w <some_IP>/24"
log { source(s_src); filter(sshlogs); destination(sshguardproc); };

No other [white,black]listing.


On Fri, Nov 14, 2014 at 9:02 PM, Kevin Zheng <kev...@gm...> wrote:

> Hi Peter,
>
> On 11/14/2014 13:51, Peter Viskup wrote:
> > anybody seeing/saw similar messages? Once this occur the SSH isn't
> > accessible at least our Zabbix monitoring reporting that.
> >
> > Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after
> 1372366479 seconds.
> > Jun  4 21:31:43 server sshguard[8003]: Setting environment:
> SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
> > Jun  4 21:31:43 server sshguard[8003]: Run command "case $SSHG_ADDRKIND
> in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;;
> >  6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2
> ;; esac": exited 1.
> > Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited: -1
>
> This sounds like SSHGuard picking up some invalid IP addresses and
> passing them on. Are you using Log Sucker or syslog?
>
> Additionally, something could have been happening with the blacklist
> database. What whitelist/blacklist settings are you using?
>
> Thanks,
> Kevin Zheng
>
> --
> Kevin Zheng
> kev...@gm... | ke...@kd... | PGP: 0xC22E1090
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

Re: [Sshguard-users] Problem with blocking "strings" not being IPs

[Kevin Z. <kev...@gm...>]

Hi Peter,

On 11/14/2014 13:51, Peter Viskup wrote:
> anybody seeing/saw similar messages? Once this occur the SSH isn't
> accessible at least our Zabbix monitoring reporting that.
> 
> Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after 1372366479 seconds.
> Jun  4 21:31:43 server sshguard[8003]: Setting environment: SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
> Jun  4 21:31:43 server sshguard[8003]: Run command "case $SSHG_ADDRKIND in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;;
>  6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2 ;; esac": exited 1.
> Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited: -1

This sounds like SSHGuard picking up some invalid IP addresses and
passing them on. Are you using Log Sucker or syslog?

Additionally, something could have been happening with the blacklist
database. What whitelist/blacklist settings are you using?

Thanks,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

[Sshguard-users] Problem with blocking "strings" not being IPs

[Peter V. <sku...@gm...>]

Hi all,
anybody seeing/saw similar messages? Once this occur the SSH isn't
accessible at least our Zabbix monitoring reporting that.

Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after
1372366479 seconds.
Jun  4 21:31:43 server sshguard[8003]: Setting environment:
SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
Jun  4 21:31:43 server sshguard[8003]: Run command "case
$SSHG_ADDRKIND in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j
DROP ;;
 6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit
-2 ;; esac": exited 1.
Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited: -1

System information:
 - Debian Squeeze LTS
 - iptables 1.4.8-3
 - sshguard 1.4-2
 - linux-image 2.6.32-48squeeze8

Was this bug fixed already? Are the IPs checked for validity before
they are blocked? Could be that it was related to some bug in kernel.
Sorry for a little late reporting. Hope that somebody would be able to
explain what could happen and make us sure all is fixed in new
versions.

-- 
Peter Viskup

[Sshguard-users] Problem with blocking "strings" not being IPs

[Peter V. <sku...@gm...>]

Hi all,
[keep me in copy, I'm not subscribed]
anybody seeing similar messages? Once this occur the SSH isn't
accessible at least our Zabbix monitoring reporting that.

Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after
1372366479 seconds.
Jun  4 21:31:43 server sshguard[8003]: Setting environment:
SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
Jun  4 21:31:43 server sshguard[8003]: Run command "case
$SSHG_ADDRKIND in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j
DROP ;;
 6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit
-2 ;; esac": exited 1.
Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited: -1

System information:
 - Debian Squeeze LTS
 - iptables 1.4.8-3
 - sshguard 1.4-2
 - linux-image 2.6.32-48squeeze8

Was this bug fixed already? Are the IPs checked for validity before
they are blocked? Could be that it was related to some bug in kernel.
Sorry for a little late reporting. Hope that somebody would be able to
explain what could happen and make us sure all is fixed in new
versions.


-- 
Peter Viskup

Re: [Sshguard-users] OpenBSD/pf Bug

[Kevin Z. <kev...@gm...>]

On 10/28/2014 08:17, Libertas wrote:
> I just wanted to mention a potential bug I encountered on a generic
> up-to-date installation of OpenBSD 5.5, using the current SSHGuard
> version in the ports tree (I think... otherwise it came from the
> packages tree). When I tried to whitelist an IP address with "sshguard
> -w <ip>", it hung indefinitely. When I came back half an hour later and
> saw it still hanging, I used ^C to kill it and saw something like
> "Permission denied: /bin/pfctl".

I will try to reproduce this issue on my machine (FreeBSD). What user
was `sshguard` running as?

> It seems that this permission denied report should be immediate, and
> that the program shouldn't hang indefinitely.

I agree; if the program needs to bail out it should do so immediately.

Best,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

Re: [Sshguard-users] help configuring sshguard with ufw

[<jo...@te...>]

Le dimanche, 02 novembre 2014 11:10:05 +0100,
Laurent Alebarde <l.a...@fr...> a écrit :

> Anyway, here is how I did it with fail2ban:

The anyway is relative.  With some devices, it is important to run
binaries instead of scripts.  You'd be amazed to see how many of these
devices actually provide services to the population, such as electricty
and transports.

Re: [Sshguard-users] help configuring sshguard with ufw

[<jo...@te...>]

Le dimanche, 2 novembre 2014 10:07:37 +0100,
"Micheal Blue" <mb...@gm...> a écrit :

Your original query is:

> Can someone point
> > me to a guide that shows how to configure ufw with sshguard or is
> > this not possible? 

So I basically replied that there's nothing to do.  What I meant is, of
course, that there's nothing to do *extra* to regular configuration.
With your query specifically, there is no guide to search for.

Because ufw uses iptables.  And sshguard also works with iptables.
They both use the same.  So nothing extra to do.

This said, of course you have to configure sshguard and do any regular
normal steps.  And in this case, it means to add the iptables target
because sshguard will add to the blocked IPs to this.  If it's not
there, then no blocking can ever happen.

I'm not yet familiar with systemd, so for how to automatically add
these at each boot you will have to see the Arch Linux pages.

Re: [Sshguard-users] help configuring sshguard with ufw

[Laurent A. <l.a...@fr...>]

Anyway, here is how I did it with fail2ban:

Extract of 2 examples of /etc/fail2ban/jail.local

    [ssh]
    enabled  = true
    action = ufw-all
    port     = 36247
    filter   = sshd
    logpath  = /var/log/auth.log
    maxretry = 2

    [nginx-auth]
    enabled = true
    filter = nginx-auth
    action = ufw-nginx-full
    #       sendmail[name=nginx-auth]
    logpath = /var/log/nginx*/*error*.log
    bantime = 3600 # 1 hour
    maxretry = 3


/etc/fail2ban/action.d/ufw-all.conf :

    [Definition]
    actionstart =
    actionstop =
    actioncheck =
    actionban = ufw insert 1 deny from <ip>
    actionunban = ufw delete deny from <ip>


/etc/fail2ban/action.d/ufw-nginx-full.conf

    [Definition]
    actionstart =
    actionstop =
    actioncheck =
    actionban = ufw insert 2 deny from <ip> to any app "Nginx Full"
    actionunban = ufw delete deny from <ip> to any app "Nginx Full"



Le 01/11/2014 12:29, jo...@te... a écrit :
> Le vendredi, 31 Oct 2014 23:29:28 +0100,
> Laurent Alebarde <l.a...@fr...> a écrit :
>
>> I did it with fail2ban
> Apart from some functional differences, the big difference between the
> two is that sshguard as a compiled application, meaning that it is not
> a script, which results in faster execution.  Not only sshguard is
> compiled, the parsing expressions also are.
>
> Cheers.
>

Re: [Sshguard-users] help configuring sshguard with ufw

[Micheal B. <mb...@gm...>]

 
 

Sent: Saturday, November 01, 2014 at 6:27 AM
From: "jo...@te..." <jo...@te...>
To: ssh...@li...
Cc: mb...@gm...
Subject: Re: [Sshguard-users] help configuring sshguard with ufw
Le vendredi, 31 octobre 2014 23:03:55 +0100,
"Micheal Blue" <mb...@gm...> a écrit :

Hello,

> I am using ufw (https://launchpad.net/ufw) and would like to know how
> to configure it to correctly work with sshguard. I saw the guide
> (http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/[http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/])
> which shows a number of iptables commands but I must admit that with
> ufw, the rule setup does not use these. I would like to keep the
> configuration within the ufw syntax if possible. Can someone point
> me to a guide that shows how to configure ufw with sshguard or is
> this not possible?

I think you got it wrong at the beginning, presuming you are running a
Linux machine. I do not use ufw although a quick look shows that it uses
iptables. ufw is a front end, like many others, like Shorewall for
instance, to the just about only one mechanism in Linux that can make
firewalls, that is, iptables.

It means that there is no problem at all. Since both ufw and sshguard
are using iptables, there is nothing to do.

Cheers.

Yes, I am using Arch Linux. There is an sshgaurd package in the official repos. But I am confused since the docs show to manually add rules which is something I have never done before. When you said there is nothing to do, When I install sshgaurd, the package manager says:
-- You should add chains to your firewall:
--   iptables -N sshguard
--   iptables -A INPUT -p tcp --dport 22 -j sshguard
--   ip6tables -N sshguard
--   ip6tables -A INPUT -p tcp --dport 22 -j sshguard
-- touch /etc/iptables/ip6tables.rules if you don't use IPv6
-- For more information, see https://wiki.archlinux.org/index.php/Sshguard

The package comes with a systemd service:
[Unit]
Description=Block hacking attempts
After=iptables.service ip6tables.service network.target
Wants=iptables.service ip6tables.service

[Service]
ExecStart=/usr/lib/systemd/scripts/sshguard-journalctl "-b /var/db/sshguard/blacklist.db" SYSLOG_FACILITY=4 SYSLOG_FACILITY=10

[Install]
WantedBy=multi-user.target

Re: [Sshguard-users] help configuring sshguard with ufw

[<jo...@te...>]

Le vendredi, 31 Oct 2014 23:29:28 +0100,
Laurent Alebarde <l.a...@fr...> a écrit :

> I did it with fail2ban

Apart from some functional differences, the big difference between the
two is that sshguard as a compiled application, meaning that it is not
a script, which results in faster execution.  Not only sshguard is
compiled, the parsing expressions also are.

Cheers.

Re: [Sshguard-users] help configuring sshguard with ufw

[<jo...@te...>]

Le vendredi, 31 octobre 2014 23:03:55 +0100,
"Micheal Blue" <mb...@gm...> a écrit :

Hello,

> I am using ufw (https://launchpad.net/ufw) and would like to know how
> to configure it to correctly work with sshguard. I saw the guide
> (http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/)
> which shows a number of iptables commands but I must admit that with
> ufw, the rule setup does not use these.  I would like to keep the
> configuration within the ufw syntax if possible.  Can someone point
> me to a guide that shows how to configure ufw with sshguard or is
> this not possible?

I think you got it wrong at the beginning, presuming you are running a
Linux machine. I do not use ufw although a quick look shows that it uses
iptables. ufw is a front end, like many others, like Shorewall for
instance, to the just about only one mechanism in Linux that can make
firewalls, that is, iptables.

It means that there is no problem at all.  Since both ufw and sshguard
are using iptables, there is nothing to do.

Cheers.

Re: [Sshguard-users] help configuring sshguard with ufw

[Laurent A. <l.a...@fr...>]

I did it with fail2ban

Le 31/10/2014 23:03, Micheal Blue a écrit :
> I am using ufw (https://launchpad.net/ufw) and would like to know how
> to configure it to correctly work with sshguard. I saw the guide
> (http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/)
> which shows a number of iptables commands but I must admit that with
> ufw, the rule setup does not use these.  I would like to keep the
> configuration within the ufw syntax if possible.  Can someone point me
> to a guide that shows how to configure ufw with sshguard or is this
> not possible?
>
>
> ------------------------------------------------------------------------------
>
>
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] help configuring sshguard with ufw

[Micheal B. <mb...@gm...>]

<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>I am using ufw (https://launchpad.net/ufw) and would like to know how to configure it to correctly work with sshguard. I saw the guide (http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/) which shows a number of iptables commands but I must admit that with ufw, the rule setup does not use these. &nbsp;I would like to keep the configuration within the ufw syntax if possible. &nbsp;Can someone point me to a guide that shows how to configure ufw with sshguard or is this not possible?</div></div></body></html>

[Sshguard-users] OpenBSD/pf Bug

[Libertas <lib...@my...>]

Hi, everyone. I'm not sure if I can send emails here without
registering, but I thought I might as well try.

I just wanted to mention a potential bug I encountered on a generic
up-to-date installation of OpenBSD 5.5, using the current SSHGuard
version in the ports tree (I think... otherwise it came from the
packages tree). When I tried to whitelist an IP address with "sshguard
-w <ip>", it hung indefinitely. When I came back half an hour later and
saw it still hanging, I used ^C to kill it and saw something like
"Permission denied: /bin/pfctl".

It seems that this permission denied report should be immediate, and
that the program shouldn't hang indefinitely.

Thanks for reading,
Libertas

[Sshguard-users] sshguard failing on Mavericks

[Todd L. <lo...@gm...>]

Hello folks,

I build and installed the macports version of sshguard using pf.  There
appears to be some error in the parsing of the syslog, and sshguard appears
to be unable to even detect an ongoing attack.  Running it in debug mode
produces the following output:

Starting parse

Entering state 0

Reading a token: --accepting rule at line 112 ("Sep  5 17:31:06 lion.local
launchservicesd[56]: ")

Next token is token SYSLOG_BANNER_PID ()

Shifting token SYSLOG_BANNER_PID ()

Entering state 1

Reading a token: --accepting rule at line 222 ("Application")

Next token is token WORD ()

Error: popping token SYSLOG_BANNER_PID ()

Stack now 0

Cleanup: discarding lookahead token WORD ()

Stack now 0

Checking to refresh sources...

Refreshing sources showed 0 changes.

Start polling.

Searching for fd 4 in list.

Starting parse

Entering state 0

Reading a token: --accepting rule at line 112 ("Sep  5 17:31:06 lion.local
WindowServer[136]: ")

Next token is token SYSLOG_BANNER_PID ()

Shifting token SYSLOG_BANNER_PID ()

Entering state 1

Reading a token: --accepting rule at line 226 ("[")

Next token is token '[' ()

Error: popping token SYSLOG_BANNER_PID ()

Stack now 0

Cleanup: discarding lookahead token '[' ()

Stack now 0

Checking to refresh sources...

Refreshing sources showed 0 changes.

Start polling.



- any suggestion on how I can begin to debug this issue would be greatly
appreciated.


-thanks!

[Sshguard-users] improved attack_scanner.l file proposal

[Oliver F. <ol...@fa...>]

HI all,

Can someone please add the following to the attack_scanner.l file (found in src/parser)

* Exim2 by Nick: */
.*"login authenticator failed for ".+" (["             { BEGIN(exim_esmtp_autherr); return EXIM_ESMTP_AUTHFAIL_PREF; }
<exim_esmtp_autherr>"]) ["             { BEGIN(exim_esmtp_autherr); return EXIM_ESMTP_AUTHFAIL_PREF; }
<exim_esmtp_autherr>"]: 535 Incorrect authentication data (set_id=".+")"    { BEGIN(INITIAL); return EXIM_ESMTP_AUTHFAIL_SUFF; }

This should tackle exim abuse better than the current line for exim.

Thanks!

OllieJim

Re: [Sshguard-users] Parser changes for FreeBSD

[Willem J. W. <wj...@di...>]

There are more options to syslog in freebsd.
Like logging facility:priority.
That will also upset parsing.

I did try and fix that, and send the diff to sshguard maintainer.
But so far no result. 

Also did a different version with ipfw and fixed table. So one can use its own rules set and just block on table(50) any where one would like.

If you want I can dig out the diffs

--WjW


Op 27 mei 2014 om 18:09 heeft Mark Felder <fe...@fr...> het volgende geschreven:

> Following up on an old mailing list entry I found:
> 
>> FreeBSD syslogd has an option to make it more verbose when writing 
>> logs.
>> I'm old and slow; so I find the option helpful.  Unfortunately using
>> the  option spoils sshguard's parser.
> 
> This bug still exists. I'm currently the sshguard port maintainer on 
> FreeBSD. Another developer started using sshguard, stumbled upon the 
> same bug, and asked my assistance with figuring out why none of the bots 
> scanning his hosts were getting blocked. I don't think it's that unusual 
> to increase the verbosity of syslogd messages, especially if you're 
> receiving syslog messages from remote machines or jails running on the 
> same host.
> 
> So I guess what I'm meaning to ask: was there any progress on this? 
> Could the verbose log prefix be recognized instead of having the entry 
> be completely discarded? It seems that the regex matching here is simply 
> too strict...
> 
> 
> Thanks!
> 
> ------------------------------------------------------------------------------
> The best possible search technologies are now affordable for all companies.
> Download your FREE open source Enterprise Search Engine today!
> Our experts will assist you in its installation for $59/mo, no commitment.
> Test it for FREE on our Cloud platform anytime!
> http://pubads.g.doubleclick.net/gampad/clk?id=145328191&iu=/4140/ostg.clktrk
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
> 

[Sshguard-users] Parser changes for FreeBSD

[Mark F. <fe...@fr...>]

Following up on an old mailing list entry I found:

> FreeBSD syslogd has an option to make it more verbose when writing 
> logs.
> I'm old and slow; so I find the option helpful.  Unfortunately using
> the  option spoils sshguard's parser.

This bug still exists. I'm currently the sshguard port maintainer on 
FreeBSD. Another developer started using sshguard, stumbled upon the 
same bug, and asked my assistance with figuring out why none of the bots 
scanning his hosts were getting blocked. I don't think it's that unusual 
to increase the verbosity of syslogd messages, especially if you're 
receiving syslog messages from remote machines or jails running on the 
same host.

So I guess what I'm meaning to ask: was there any progress on this? 
Could the verbose log prefix be recognized instead of having the entry 
be completely discarded? It seems that the regex matching here is simply 
too strict...


Thanks!