sshguard-users — User questions and answers, bugs, and general support

Re: [Sshguard-users] Problem with blocking "strings" not being IPs

[Peter V. <sku...@gm...>]

Hi all,
todays messages:
Nov 27 23:31:25 server sshguard[25526]: Releasing  after 450 seconds.
Nov 27 23:31:25 server sshguard[25526]: Setting environment:
SSHG_ADDR=SSHG_ADDR=<E8>~a^GL^?;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
Nov 27 23:31:25 server sshguard[25526]: Run command "case $SSHG_ADDRKIND in
4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;; 6) exec
/sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2 ;; esac":
exited 2.
Nov 27 23:31:25 server sshguard[25526]: Release command failed. Exited: -1

Other strange messages:
Nov 27 23:34:16 server sshguard[25526]: Releasing  after 621 seconds.
Nov 27 23:34:16 server sshguard[25526]: Setting environment:
SSHG_ADDR=0;SSHG_ADDRKIND=0;SSHG_SERVICE=0.
Nov 27 23:34:16 server sshguard[25526]: Run command "case $SSHG_ADDRKIND in
4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;; 6) exec
/sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2 ;; esac":
exited 2.
Nov 27 23:34:16 server sshguard[25526]: Release command failed. Exited: -1

Both examples are for rules removal. There are no messages for
corresponding iptables inserts.

I do see some strange users as inputs.
"Failed password for invalid user rock123\r"

Could be that message strings are not handled appropriately and specially
crafted user accounts lead to unexpected results. Could anybody have a look
on that?

sshguard 1.4-2
syslog-ng 3.1.3-3

-- 
Peter Viskup

On Fri, Nov 14, 2014 at 9:09 PM, Peter Viskup <sku...@gm...> wrote:

> Hi Kevin,
> thanks for quick reply. Running syslog-ng version 3.1.3-3.
>
> filter sshlogs { facility(auth, authpriv) and not match("sshguard"
> value("MESSAGE")); };
> destination sshguardproc {
>         program("/usr/sbin/sshguard -w <some_IP>/24"
> log { source(s_src); filter(sshlogs); destination(sshguardproc); };
>
> No other [white,black]listing.
>
>
> On Fri, Nov 14, 2014 at 9:02 PM, Kevin Zheng <kev...@gm...> wrote:
>
>> Hi Peter,
>>
>> On 11/14/2014 13:51, Peter Viskup wrote:
>> > anybody seeing/saw similar messages? Once this occur the SSH isn't
>> > accessible at least our Zabbix monitoring reporting that.
>> >
>> > Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after
>> 1372366479 seconds.
>> > Jun  4 21:31:43 server sshguard[8003]: Setting environment:
>> SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
>> > Jun  4 21:31:43 server sshguard[8003]: Run command "case $SSHG_ADDRKIND
>> in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;;
>> >  6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit
>> -2 ;; esac": exited 1.
>> > Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited:
>> -1
>>
>> This sounds like SSHGuard picking up some invalid IP addresses and
>> passing them on. Are you using Log Sucker or syslog?
>>
>> Additionally, something could have been happening with the blacklist
>> database. What whitelist/blacklist settings are you using?
>>
>> Thanks,
>> Kevin Zheng
>>
>> --
>> Kevin Zheng
>> kev...@gm... | ke...@kd... | PGP: 0xC22E1090
>>
>>
>> ------------------------------------------------------------------------------
>> Comprehensive Server Monitoring with Site24x7.
>> Monitor 10 servers for $9/Month.
>> Get alerted through email, SMS, voice calls or mobile push notifications.
>> Take corrective actions from your mobile device.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Sshguard-users mailing list
>> Ssh...@li...
>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>>
>
>

Re: [Sshguard-users] Problem with blocking "strings" not being IPs

[Peter V. <sku...@gm...>]

Hi Kevin,
thanks for quick reply. Running syslog-ng version 3.1.3-3.

filter sshlogs { facility(auth, authpriv) and not match("sshguard"
value("MESSAGE")); };
destination sshguardproc {
        program("/usr/sbin/sshguard -w <some_IP>/24"
log { source(s_src); filter(sshlogs); destination(sshguardproc); };

No other [white,black]listing.


On Fri, Nov 14, 2014 at 9:02 PM, Kevin Zheng <kev...@gm...> wrote:

> Hi Peter,
>
> On 11/14/2014 13:51, Peter Viskup wrote:
> > anybody seeing/saw similar messages? Once this occur the SSH isn't
> > accessible at least our Zabbix monitoring reporting that.
> >
> > Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after
> 1372366479 seconds.
> > Jun  4 21:31:43 server sshguard[8003]: Setting environment:
> SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
> > Jun  4 21:31:43 server sshguard[8003]: Run command "case $SSHG_ADDRKIND
> in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;;
> >  6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2
> ;; esac": exited 1.
> > Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited: -1
>
> This sounds like SSHGuard picking up some invalid IP addresses and
> passing them on. Are you using Log Sucker or syslog?
>
> Additionally, something could have been happening with the blacklist
> database. What whitelist/blacklist settings are you using?
>
> Thanks,
> Kevin Zheng
>
> --
> Kevin Zheng
> kev...@gm... | ke...@kd... | PGP: 0xC22E1090
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

Re: [Sshguard-users] Problem with blocking "strings" not being IPs

[Kevin Z. <kev...@gm...>]

Hi Peter,

On 11/14/2014 13:51, Peter Viskup wrote:
> anybody seeing/saw similar messages? Once this occur the SSH isn't
> accessible at least our Zabbix monitoring reporting that.
> 
> Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after 1372366479 seconds.
> Jun  4 21:31:43 server sshguard[8003]: Setting environment: SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
> Jun  4 21:31:43 server sshguard[8003]: Run command "case $SSHG_ADDRKIND in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j DROP ;;
>  6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit -2 ;; esac": exited 1.
> Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited: -1

This sounds like SSHGuard picking up some invalid IP addresses and
passing them on. Are you using Log Sucker or syslog?

Additionally, something could have been happening with the blacklist
database. What whitelist/blacklist settings are you using?

Thanks,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

[Sshguard-users] Problem with blocking "strings" not being IPs

[Peter V. <sku...@gm...>]

Hi all,
anybody seeing/saw similar messages? Once this occur the SSH isn't
accessible at least our Zabbix monitoring reporting that.

Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after
1372366479 seconds.
Jun  4 21:31:43 server sshguard[8003]: Setting environment:
SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
Jun  4 21:31:43 server sshguard[8003]: Run command "case
$SSHG_ADDRKIND in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j
DROP ;;
 6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit
-2 ;; esac": exited 1.
Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited: -1

System information:
 - Debian Squeeze LTS
 - iptables 1.4.8-3
 - sshguard 1.4-2
 - linux-image 2.6.32-48squeeze8

Was this bug fixed already? Are the IPs checked for validity before
they are blocked? Could be that it was related to some bug in kernel.
Sorry for a little late reporting. Hope that somebody would be able to
explain what could happen and make us sure all is fixed in new
versions.

-- 
Peter Viskup

[Sshguard-users] Problem with blocking "strings" not being IPs

[Peter V. <sku...@gm...>]

Hi all,
[keep me in copy, I'm not subscribed]
anybody seeing similar messages? Once this occur the SSH isn't
accessible at least our Zabbix monitoring reporting that.

Jun  4 21:31:43 server sshguard[8003]: Releasing <B0><EB><C0>^A after
1372366479 seconds.
Jun  4 21:31:43 server sshguard[8003]: Setting environment:
SSHG_ADDR=4;SSHG_ADDRKIND=4;SSHG_SERVICE=100.
Jun  4 21:31:43 server sshguard[8003]: Run command "case
$SSHG_ADDRKIND in 4) exec /sbin/iptables -D sshguard -s $SSHG_ADDR -j
DROP ;;
 6) exec /sbin/ip6tables -D sshguard -s $SSHG_ADDR -j DROP ;; *) exit
-2 ;; esac": exited 1.
Jun  4 21:31:43 server sshguard[8003]: Release command failed. Exited: -1

System information:
 - Debian Squeeze LTS
 - iptables 1.4.8-3
 - sshguard 1.4-2
 - linux-image 2.6.32-48squeeze8

Was this bug fixed already? Are the IPs checked for validity before
they are blocked? Could be that it was related to some bug in kernel.
Sorry for a little late reporting. Hope that somebody would be able to
explain what could happen and make us sure all is fixed in new
versions.


-- 
Peter Viskup

Re: [Sshguard-users] OpenBSD/pf Bug

[Kevin Z. <kev...@gm...>]

On 10/28/2014 08:17, Libertas wrote:
> I just wanted to mention a potential bug I encountered on a generic
> up-to-date installation of OpenBSD 5.5, using the current SSHGuard
> version in the ports tree (I think... otherwise it came from the
> packages tree). When I tried to whitelist an IP address with "sshguard
> -w <ip>", it hung indefinitely. When I came back half an hour later and
> saw it still hanging, I used ^C to kill it and saw something like
> "Permission denied: /bin/pfctl".

I will try to reproduce this issue on my machine (FreeBSD). What user
was `sshguard` running as?

> It seems that this permission denied report should be immediate, and
> that the program shouldn't hang indefinitely.

I agree; if the program needs to bail out it should do so immediately.

Best,
Kevin Zheng

-- 
Kevin Zheng
kev...@gm... | ke...@kd... | PGP: 0xC22E1090

Re: [Sshguard-users] help configuring sshguard with ufw

[<jo...@te...>]

Le dimanche, 02 novembre 2014 11:10:05 +0100,
Laurent Alebarde <l.a...@fr...> a écrit :

> Anyway, here is how I did it with fail2ban:

The anyway is relative.  With some devices, it is important to run
binaries instead of scripts.  You'd be amazed to see how many of these
devices actually provide services to the population, such as electricty
and transports.

Re: [Sshguard-users] help configuring sshguard with ufw

[<jo...@te...>]

Le dimanche, 2 novembre 2014 10:07:37 +0100,
"Micheal Blue" <mb...@gm...> a écrit :

Your original query is:

> Can someone point
> > me to a guide that shows how to configure ufw with sshguard or is
> > this not possible? 

So I basically replied that there's nothing to do.  What I meant is, of
course, that there's nothing to do *extra* to regular configuration.
With your query specifically, there is no guide to search for.

Because ufw uses iptables.  And sshguard also works with iptables.
They both use the same.  So nothing extra to do.

This said, of course you have to configure sshguard and do any regular
normal steps.  And in this case, it means to add the iptables target
because sshguard will add to the blocked IPs to this.  If it's not
there, then no blocking can ever happen.

I'm not yet familiar with systemd, so for how to automatically add
these at each boot you will have to see the Arch Linux pages.

Re: [Sshguard-users] help configuring sshguard with ufw

[Laurent A. <l.a...@fr...>]

Anyway, here is how I did it with fail2ban:

Extract of 2 examples of /etc/fail2ban/jail.local

    [ssh]
    enabled  = true
    action = ufw-all
    port     = 36247
    filter   = sshd
    logpath  = /var/log/auth.log
    maxretry = 2

    [nginx-auth]
    enabled = true
    filter = nginx-auth
    action = ufw-nginx-full
    #       sendmail[name=nginx-auth]
    logpath = /var/log/nginx*/*error*.log
    bantime = 3600 # 1 hour
    maxretry = 3


/etc/fail2ban/action.d/ufw-all.conf :

    [Definition]
    actionstart =
    actionstop =
    actioncheck =
    actionban = ufw insert 1 deny from <ip>
    actionunban = ufw delete deny from <ip>


/etc/fail2ban/action.d/ufw-nginx-full.conf

    [Definition]
    actionstart =
    actionstop =
    actioncheck =
    actionban = ufw insert 2 deny from <ip> to any app "Nginx Full"
    actionunban = ufw delete deny from <ip> to any app "Nginx Full"



Le 01/11/2014 12:29, jo...@te... a écrit :
> Le vendredi, 31 Oct 2014 23:29:28 +0100,
> Laurent Alebarde <l.a...@fr...> a écrit :
>
>> I did it with fail2ban
> Apart from some functional differences, the big difference between the
> two is that sshguard as a compiled application, meaning that it is not
> a script, which results in faster execution.  Not only sshguard is
> compiled, the parsing expressions also are.
>
> Cheers.
>

Re: [Sshguard-users] help configuring sshguard with ufw

[Micheal B. <mb...@gm...>]

 
 

Sent: Saturday, November 01, 2014 at 6:27 AM
From: "jo...@te..." <jo...@te...>
To: ssh...@li...
Cc: mb...@gm...
Subject: Re: [Sshguard-users] help configuring sshguard with ufw
Le vendredi, 31 octobre 2014 23:03:55 +0100,
"Micheal Blue" <mb...@gm...> a écrit :

Hello,

> I am using ufw (https://launchpad.net/ufw) and would like to know how
> to configure it to correctly work with sshguard. I saw the guide
> (http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/[http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/])
> which shows a number of iptables commands but I must admit that with
> ufw, the rule setup does not use these. I would like to keep the
> configuration within the ufw syntax if possible. Can someone point
> me to a guide that shows how to configure ufw with sshguard or is
> this not possible?

I think you got it wrong at the beginning, presuming you are running a
Linux machine. I do not use ufw although a quick look shows that it uses
iptables. ufw is a front end, like many others, like Shorewall for
instance, to the just about only one mechanism in Linux that can make
firewalls, that is, iptables.

It means that there is no problem at all. Since both ufw and sshguard
are using iptables, there is nothing to do.

Cheers.

Yes, I am using Arch Linux. There is an sshgaurd package in the official repos. But I am confused since the docs show to manually add rules which is something I have never done before. When you said there is nothing to do, When I install sshgaurd, the package manager says:
-- You should add chains to your firewall:
--   iptables -N sshguard
--   iptables -A INPUT -p tcp --dport 22 -j sshguard
--   ip6tables -N sshguard
--   ip6tables -A INPUT -p tcp --dport 22 -j sshguard
-- touch /etc/iptables/ip6tables.rules if you don't use IPv6
-- For more information, see https://wiki.archlinux.org/index.php/Sshguard

The package comes with a systemd service:
[Unit]
Description=Block hacking attempts
After=iptables.service ip6tables.service network.target
Wants=iptables.service ip6tables.service

[Service]
ExecStart=/usr/lib/systemd/scripts/sshguard-journalctl "-b /var/db/sshguard/blacklist.db" SYSLOG_FACILITY=4 SYSLOG_FACILITY=10

[Install]
WantedBy=multi-user.target

Re: [Sshguard-users] help configuring sshguard with ufw

[<jo...@te...>]

Le vendredi, 31 Oct 2014 23:29:28 +0100,
Laurent Alebarde <l.a...@fr...> a écrit :

> I did it with fail2ban

Apart from some functional differences, the big difference between the
two is that sshguard as a compiled application, meaning that it is not
a script, which results in faster execution.  Not only sshguard is
compiled, the parsing expressions also are.

Cheers.

Re: [Sshguard-users] help configuring sshguard with ufw

[<jo...@te...>]

Le vendredi, 31 octobre 2014 23:03:55 +0100,
"Micheal Blue" <mb...@gm...> a écrit :

Hello,

> I am using ufw (https://launchpad.net/ufw) and would like to know how
> to configure it to correctly work with sshguard. I saw the guide
> (http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/)
> which shows a number of iptables commands but I must admit that with
> ufw, the rule setup does not use these.  I would like to keep the
> configuration within the ufw syntax if possible.  Can someone point
> me to a guide that shows how to configure ufw with sshguard or is
> this not possible?

I think you got it wrong at the beginning, presuming you are running a
Linux machine. I do not use ufw although a quick look shows that it uses
iptables. ufw is a front end, like many others, like Shorewall for
instance, to the just about only one mechanism in Linux that can make
firewalls, that is, iptables.

It means that there is no problem at all.  Since both ufw and sshguard
are using iptables, there is nothing to do.

Cheers.

Re: [Sshguard-users] help configuring sshguard with ufw

[Laurent A. <l.a...@fr...>]

I did it with fail2ban

Le 31/10/2014 23:03, Micheal Blue a écrit :
> I am using ufw (https://launchpad.net/ufw) and would like to know how
> to configure it to correctly work with sshguard. I saw the guide
> (http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/)
> which shows a number of iptables commands but I must admit that with
> ufw, the rule setup does not use these.  I would like to keep the
> configuration within the ufw syntax if possible.  Can someone point me
> to a guide that shows how to configure ufw with sshguard or is this
> not possible?
>
>
> ------------------------------------------------------------------------------
>
>
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] help configuring sshguard with ufw

[Micheal B. <mb...@gm...>]

<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>I am using ufw (https://launchpad.net/ufw) and would like to know how to configure it to correctly work with sshguard. I saw the guide (http://www.sshguard.net/docs/setup/firewall/netfilter-iptables/) which shows a number of iptables commands but I must admit that with ufw, the rule setup does not use these. &nbsp;I would like to keep the configuration within the ufw syntax if possible. &nbsp;Can someone point me to a guide that shows how to configure ufw with sshguard or is this not possible?</div></div></body></html>

[Sshguard-users] OpenBSD/pf Bug

[Libertas <lib...@my...>]

Hi, everyone. I'm not sure if I can send emails here without
registering, but I thought I might as well try.

I just wanted to mention a potential bug I encountered on a generic
up-to-date installation of OpenBSD 5.5, using the current SSHGuard
version in the ports tree (I think... otherwise it came from the
packages tree). When I tried to whitelist an IP address with "sshguard
-w <ip>", it hung indefinitely. When I came back half an hour later and
saw it still hanging, I used ^C to kill it and saw something like
"Permission denied: /bin/pfctl".

It seems that this permission denied report should be immediate, and
that the program shouldn't hang indefinitely.

Thanks for reading,
Libertas

[Sshguard-users] sshguard failing on Mavericks

[Todd L. <lo...@gm...>]

Hello folks,

I build and installed the macports version of sshguard using pf.  There
appears to be some error in the parsing of the syslog, and sshguard appears
to be unable to even detect an ongoing attack.  Running it in debug mode
produces the following output:

Starting parse

Entering state 0

Reading a token: --accepting rule at line 112 ("Sep  5 17:31:06 lion.local
launchservicesd[56]: ")

Next token is token SYSLOG_BANNER_PID ()

Shifting token SYSLOG_BANNER_PID ()

Entering state 1

Reading a token: --accepting rule at line 222 ("Application")

Next token is token WORD ()

Error: popping token SYSLOG_BANNER_PID ()

Stack now 0

Cleanup: discarding lookahead token WORD ()

Stack now 0

Checking to refresh sources...

Refreshing sources showed 0 changes.

Start polling.

Searching for fd 4 in list.

Starting parse

Entering state 0

Reading a token: --accepting rule at line 112 ("Sep  5 17:31:06 lion.local
WindowServer[136]: ")

Next token is token SYSLOG_BANNER_PID ()

Shifting token SYSLOG_BANNER_PID ()

Entering state 1

Reading a token: --accepting rule at line 226 ("[")

Next token is token '[' ()

Error: popping token SYSLOG_BANNER_PID ()

Stack now 0

Cleanup: discarding lookahead token '[' ()

Stack now 0

Checking to refresh sources...

Refreshing sources showed 0 changes.

Start polling.



- any suggestion on how I can begin to debug this issue would be greatly
appreciated.


-thanks!

[Sshguard-users] improved attack_scanner.l file proposal

[Oliver F. <ol...@fa...>]

HI all,

Can someone please add the following to the attack_scanner.l file (found in src/parser)

* Exim2 by Nick: */
.*"login authenticator failed for ".+" (["             { BEGIN(exim_esmtp_autherr); return EXIM_ESMTP_AUTHFAIL_PREF; }
<exim_esmtp_autherr>"]) ["             { BEGIN(exim_esmtp_autherr); return EXIM_ESMTP_AUTHFAIL_PREF; }
<exim_esmtp_autherr>"]: 535 Incorrect authentication data (set_id=".+")"    { BEGIN(INITIAL); return EXIM_ESMTP_AUTHFAIL_SUFF; }

This should tackle exim abuse better than the current line for exim.

Thanks!

OllieJim

Re: [Sshguard-users] Parser changes for FreeBSD

[Willem J. W. <wj...@di...>]

There are more options to syslog in freebsd.
Like logging facility:priority.
That will also upset parsing.

I did try and fix that, and send the diff to sshguard maintainer.
But so far no result. 

Also did a different version with ipfw and fixed table. So one can use its own rules set and just block on table(50) any where one would like.

If you want I can dig out the diffs

--WjW


Op 27 mei 2014 om 18:09 heeft Mark Felder <fe...@fr...> het volgende geschreven:

> Following up on an old mailing list entry I found:
> 
>> FreeBSD syslogd has an option to make it more verbose when writing 
>> logs.
>> I'm old and slow; so I find the option helpful.  Unfortunately using
>> the  option spoils sshguard's parser.
> 
> This bug still exists. I'm currently the sshguard port maintainer on 
> FreeBSD. Another developer started using sshguard, stumbled upon the 
> same bug, and asked my assistance with figuring out why none of the bots 
> scanning his hosts were getting blocked. I don't think it's that unusual 
> to increase the verbosity of syslogd messages, especially if you're 
> receiving syslog messages from remote machines or jails running on the 
> same host.
> 
> So I guess what I'm meaning to ask: was there any progress on this? 
> Could the verbose log prefix be recognized instead of having the entry 
> be completely discarded? It seems that the regex matching here is simply 
> too strict...
> 
> 
> Thanks!
> 
> ------------------------------------------------------------------------------
> The best possible search technologies are now affordable for all companies.
> Download your FREE open source Enterprise Search Engine today!
> Our experts will assist you in its installation for $59/mo, no commitment.
> Test it for FREE on our Cloud platform anytime!
> http://pubads.g.doubleclick.net/gampad/clk?id=145328191&iu=/4140/ostg.clktrk
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
> 

[Sshguard-users] Parser changes for FreeBSD

[Mark F. <fe...@fr...>]

Following up on an old mailing list entry I found:

> FreeBSD syslogd has an option to make it more verbose when writing 
> logs.
> I'm old and slow; so I find the option helpful.  Unfortunately using
> the  option spoils sshguard's parser.

This bug still exists. I'm currently the sshguard port maintainer on 
FreeBSD. Another developer started using sshguard, stumbled upon the 
same bug, and asked my assistance with figuring out why none of the bots 
scanning his hosts were getting blocked. I don't think it's that unusual 
to increase the verbosity of syslogd messages, especially if you're 
receiving syslog messages from remote machines or jails running on the 
same host.

So I guess what I'm meaning to ask: was there any progress on this? 
Could the verbose log prefix be recognized instead of having the entry 
be completely discarded? It seems that the regex matching here is simply 
too strict...


Thanks!

Re: [Sshguard-users] "Connection closed by x.x.x.x [preauth]" attack not handled

[<jo...@te...>]

On Sun, 18 May 2014 22:31:40 +0200,
Anders Bergh <an...@gm...> wrote :

> May  7 08:28:26 vm sshd[15657]: Connection closed by 83.191.86.213
> [preauth]

> Reading a token: --accepting rule at line 110 ("May  7 08:28:26 vm
> sshd[15657]: ")

As can be seen, sshguard will not react on these messages.  I think
this was the reason of your initial post :)

Having sshguard in debug though, enables to see why.  It did not took
much time to make it work with those sshd messages which, after, if
made furiously, could provoke some resources stealing.

Thing is, I made it using the sshguard that I already modify for other
uses.  I think it could be good to have support for that type of
message in the official releae but it looks like sshguard upstream is
not maintained.  Nor is this mailing list read by the
author/maintainer.  Tell me if I'm wrong. 

I will certainly include it in the personalized sshguard I'm working on.

So here's the recipe to make it work.  It's not a formal diff, sorry.
It starts with a working demo in two parts, then followed by the
code modifications to add.  I defined '[preauth]' as somethign lex can
return.

A) Demo: one try

[...]
Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.

May  7 08:28:26 vm sshd[15657]: Connection closed by 83.191.86.213
[preauth]
[...]

Cleanup: popping token $end ()
Cleanup: popping nterm text ()

Matched address 83.191.86.213:4 attacking service 100, dangerousness
10.

B) Demo: after a few copy/paste of same log msg

Matched address 83.191.86.213:4 attacking service 100, dangerousness
10.

Purging stale attackers.

First abuse of '83.191.86.213', adding to offenders list.

Offender '83.191.86.213:4' scored 40 danger in 1 abuses.

Blocking 83.191.86.213:4 for >630secs: 40 danger in 4 attacks over 7
seconds (all: 40d in 1 abuses over 7s).

Setting environment:
SSHG_ADDR=83.191.86.213;SSHG_ADDRKIND=4;SSHG_SERVICE=100.


C) Code modifications in three parts, then recompile.  
                                                                                             
1)
attack_parser.h                                                                           
                                                                                             
   enum yytokentype
{                                                                        
   [...]
     SSH_NOLOGIN = 280,
     SSHPREAUTH = 281,

#define SSH_NOLOGIN 280
#define SSHPREAUTH 281


2) attack_scanner.l

Add ssh_nologin:

%s ssh_notallowed ssh_loginerr ssh_reversemap ssh_nologin

Add recognition of extra string:

\[preauth\]             return SSHPREAUTH;

Add parsing regex:

 /* SSH: initiate a connect but terminates without login */
"Connection closed by "  { return SSH_NOLOGIN; }


3) attack_scanner.y

Add token:

%token SSH_NOLOGIN SSHPREAUTH

Add to sshmsg definitions:

sshmsg:
 [...]
     | ssh_nologin
 ;

Add syntax:

ssh_nologin:
    SSH_NOLOGIN addr SSHPREAUTH
    ;

Re: [Sshguard-users] "Connection closed by x.x.x.x [preauth]" attack not handled

[Anders B. <an...@gm...>]

On Sun, May 18, 2014 at 12:25 PM, jo...@te...
<jo...@te...> wrote:
> sshguard will recognize 'May  7 08:28:26 vm sshd[15657]:'  This means
> you can launch sshguard in debug mode and copy/paste the rest of the
> log msg to see what the behaviour is.  Debug mode:
>
> env SSHGUARD_DEBUG=foo <your path to sshguard>
>

Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.

May  7 08:28:26 vm sshd[15657]: Connection closed by 83.191.86.213 [preauth]

Starting parse
Entering state 0
Reading a token: --accepting rule at line 110 ("May  7 08:28:26 vm
sshd[15657]: ")
Next token is token SYSLOG_BANNER_PID ()
Shifting token SYSLOG_BANNER_PID ()
Entering state 1
Reading a token: --accepting rule at line 220 ("Connection")
Next token is token WORD ()
Error: popping token SYSLOG_BANNER_PID ()
Stack now 0
Cleanup: discarding lookahead token WORD ()
Stack now 0

-- 
Anders Bergh

Re: [Sshguard-users] "Connection closed by x.x.x.x [preauth]" attack not handled

[<jo...@te...>]

On Wed, 7 May 2014 18:25:08 +0200,
Anders Bergh <an...@gm...> wrote :

> I have thousands of lines like this in my auth.log:
> 
> May  7 08:28:26 vm sshd[15657]: Connection closed by 83.191.86.213
> [preauth]
> 
> sshguard 1.5.0 (Debian wheezy) doesn't seem to do anything about this.
> Should it?

sshguard will recognize 'May  7 08:28:26 vm sshd[15657]:'  This means
you can launch sshguard in debug mode and copy/paste the rest of the
log msg to see what the behaviour is.  Debug mode:

env SSHGUARD_DEBUG=foo <your path to sshguard>

Re: [Sshguard-users] ipfw sshguard not working for mail

[<jo...@te...>]

On Tue, 29 Apr 2014 15:34:22 +0200,
Oliver FdeV <ol...@fa...> wrote :

> How can I get ipfw-sshguard working for mail and smtp?

Since I'm currently adding lex/yacc code to support log msgs from a
middleware, I'd say try it in debugging mode.  Simply launch sshguard
in debug mode.  It will run foreground enabling copy/paste of log
messages, as well as detailed reaction to the log messages.

To enable debug mode:

env SSHGUARD_DEBUG=foo <your path to sshguard>

By doing this you'll know which parts fails, parsing or launching the
firewall.

If you already know this, sorry for the redundancy !!

[Sshguard-users] "Connection closed by x.x.x.x [preauth]" attack not handled

[Anders B. <an...@gm...>]

Hi,

I have thousands of lines like this in my auth.log:

May  7 08:28:26 vm sshd[15657]: Connection closed by 83.191.86.213 [preauth]

sshguard 1.5.0 (Debian wheezy) doesn't seem to do anything about this.
Should it?

(not subscribed to ML so please CC me)

-- 
Anders Bergh

[Sshguard-users] Writing new parsing expressions

[<jo...@te...>]

Hello !

  Has anyone anything at all to share about writing new parsing
expressions to a total newbie to Lex/Yacc, specifically how to
write/compile for sshguard ?  Any help would be greatly appreciated -
thanks !