sshguard-users — User questions and answers, bugs, and general support

[Sshguard-users] sshd logins missed

[Douglas D. <dt...@gm...>]

I put sshguard on our mail server using inetd as a backend. The default
install
works very well. Tens of thousands of logins are reduced to a few dozen
daily.
Occasionally an attack is missed as shown:

Mar  2 06:01:47 myhost sshd[74730]: Invalid user magazine from 219.92.5.182
Mar  2 06:01:48 myhost sshd[74732]: Invalid user magazine from 219.92.5.182
Mar  2 06:01:48 myhost sshguard[62471]: Offender '219.92.5.182:4' scored 40
danger in 1 abuses (threshold 40) -> blacklisted.
Mar  2 06:01:49 myhost sshguard[62471]: Blocking 219.92.5.182:4 for >0secs:
40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Mar  2 06:01:50 myhost sshd[74737]: refused connect from
usj-5-182.tm.net.my(219.92.5.182)
Mar  2 06:01:49 myhost sshd[74736]: refused connect from
usj-5-182.tm.net.my(219.92.5.182)

Mar  2 06:02:35 myhost sshd[74782]: Invalid user oracle from 61.142.106.34
Mar  2 06:02:40 myhost sshd[74792]: Invalid user oracle from 61.142.106.34

Mar  2 06:04:59 myhost sshd[75023]: Invalid user oracle from 61.142.106.34
Mar  2 06:05:01 myhost sshd[75026]: Invalid user oracle from 61.142.106.34
Mar  2 06:05:03 myhost sshd[75037]: Invalid user oracle from 61.142.106.34
Mar  2 06:05:06 myhost sshd[75039]: Invalid user bwadmin from 61.142.106.34
Mar  2 06:05:10 myhost sshd[75047]: Invalid user cacti from 61.142.106.34
Mar  2 06:05:12 myhost sshd[75049]: Invalid user oracle from 61.142.106.34
Mar  2 06:05:14 myhost sshd[75053]: Invalid user oracle from 61.142.106.34
Mar  2 06:05:16 myhost sshd[75057]: Invalid user oracle from 61.142.106.34
Mar  2 06:05:19 myhost sshd[75059]: Invalid user bwadmin from 61.142.106.34
Mar  2 06:05:24 myhost sshd[75063]: Invalid user cacti from 61.142.106.34

I see no reason 61.142.106.34 was not blocked unless it is a timing issue
reading the logs but 06:01:50 --> 06:02:35 seems like a long time.
61.142.106.34 tried 12 logins

My other though was there was enough time between the first two attempts
and the remaining 10 so that 61.142.106.34 was deemed to be okay. Alias my
c is not good enough to figure that out from the code.

Thanks for any thoughts on this.

[Sshguard-users] sshguard permanent ban

[Samuel P. <em...@em...>]

Hi, i am trying to figure out the correct way to permanently ban a 
blocked address by sshguard.  i have googled and read the man page which 
seems the -p flag can do this but i dont understand the format to 
permanently block.  Does anybody have an example?

Thanks

[Sshguard-users] Break in attempts being missed

[Brian P. <bri...@bo...>]

Hello,

I'm finding that some break in attempts are being missed by sshguard while
others aren't.

I'm seeing:

Feb 11 00:00:53 server1 sshd[57146]: Invalid user www-data from
121.197.3.180
Feb 11 00:00:53 server1 sshd[57147]: Address 121.197.3.180 maps to
ip197.hichina.com, but this does not map back to the address - POSSIBLE
BREAK-IN ATTEMPT!

This IP isn't blocked and occurs hundreds of times.

But lines like:

Feb 11 13:35:36 server1 sshd[10749]: Invalid user a from 121.125.73.22
Feb 11 13:35:36 server1 sshd[10750]: Invalid user a from 121.125.73.22
Feb 11 13:35:37 server1 sshd[10751]: Invalid user a from 121.125.73.22
Feb 11 13:35:37 server1 sshd[10752]: Invalid user a from 121.125.73.22

Does result in a block

sshguard 1.5.0 on FreeBSD 8.0 RELEASE.


In interactive mode it appears that sshguard is reading both lines as one.


Thanks,
Brian

Re: [Sshguard-users] How to read sshguard log messages - what does "x danger" mean?

[Mij <mi...@ss...>]

Hi Benedikt,

> 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).

> So what does the "40 danger" mean in this context and what is it derived from?

The attack performed 4 times by the attacker had danger 10. So danger 40 was scored,
and the "abuse" threshold was reached.
This attacker was blocked for the first time, so it historically scored 40 danger in 1 abuse.

For more details see http://www.sshguard.net/docs/terminology/

michele

[Sshguard-users] How to read sshguard log messages - what does "x danger" mean?

[Benedikt B. <ma...@be...>]

Hi,

I searched all the man pages and documentation on the website but could't really find some information on how to understand the log messages that sshguard writes if it blocks some attack.

When there is something blocked, there is a message like
<timestamp> <hostname> sshguard[1767]: Blocking <attacker IP> for >630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).

So what does the "40 danger" mean in this context and what is it derived from? Am I right to say that the part in parentheses means that this IP has overall caused 40 danger points (wherever they may come from) with one abusive attempt within 9 seconds?

Tanks for some answers or help.

Greetz
Benedikt

Re: [Sshguard-users] readonly setup broken with >1.5

[Mij <mi...@ss...>]

Moin Harald,

Thanks for reporting this. The hosts backend code is very old and I'm not
sure when this change occurred. Editing via /tmp is definitely the way to go.
We'll fix this in the next sprint.

m


On Dec 9, 2012, at 17:22 , Harald Schmalzbauer <h.s...@om...> wrote:

> Hello,
> 
> thanks a lot for that nifty tool!
> I've bin using it for quiet some time.
> Very often, I have jails which are read-only / mounted. /etc/hosts.allow
> is then a symlink somehere into /var (which is writable).
> This has been working fine with older versions of sshguard, but it
> stopped working with version 1.6 for me. Not sure if that's really the
> first version where the behaviour changed though.
> 
> sshguard want's to create a temporary file inside /etc reflecting the pid:
>    "Could not create temporary file /etc/hosts.allow-sshguard.4020"
> 
> Why doesn't it use TMPDIR?
> 
> Any hint's where to work arround that in the code?
> 
> Thanks,
> 
> -Harry (not subscribed!)
> 
> ------------------------------------------------------------------------------
> LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
> Remotely access PCs and mobile devices and provide instant support
> Improve your efficiency, and focus on delivering more value-add services
> Discover what IT Professionals Know. Rescue delivers
> http://p.sf.net/sfu/logmein_12329d2d_______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] readonly setup broken with >1.5

[Harald S. <h.s...@om...>]

 Hello,

thanks a lot for that nifty tool!
I've bin using it for quiet some time.
Very often, I have jails which are read-only / mounted. /etc/hosts.allow
is then a symlink somehere into /var (which is writable).
This has been working fine with older versions of sshguard, but it
stopped working with version 1.6 for me. Not sure if that's really the
first version where the behaviour changed though.

sshguard want's to create a temporary file inside /etc reflecting the pid:
    "Could not create temporary file /etc/hosts.allow-sshguard.4020"

Why doesn't it use TMPDIR?

Any hint's where to work arround that in the code?

Thanks,

-Harry (not subscribed!)

Re: [Sshguard-users] pure-ftpd protection not working

[Ville W. <wal...@gm...>]

Hi Mij,

Thanks for the reply.  With that info I was able to figure it out.  The
reason for why it wasn't working "out of the box" is that on Ubuntu
pure-ftpd logs login failures into /var/log/syslog by default.
/var/log/auth.log only gets authentication notices from PAM:

Dec  4 00:16:07 moonpod pure-ftpd: pam_unix(pure-ftpd:auth): check pass;
user unknown
Dec  4 00:16:07 moonpod pure-ftpd: pam_unix(pure-ftpd:auth): authentication
failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=test123
rhost=workstation.internal.domain
Dec  4 00:16:07 moonpod pure-ftpd: pam_winbind(pure-ftpd:auth): getting
password (0x00000388)
Dec  4 00:16:07 moonpod pure-ftpd: pam_winbind(pure-ftpd:auth):
pam_get_item returned a password

Once I added syslog to LogSucker (by adding it to "LOGFILES" in
/etc/default/sshguard), it started working.  The other alternative would've
been to separate pure-ftpd login failures into a separate log via rsyslog
configuration change (and then point sshguard to that log), but there's
probably no harm done by sshguard monitoring the syslog.

SSHguard is so much easier to use than blockhosts which I used for many
years with FreeBSD.  I'm quite happy with it!  Keep up the good work!

Ville


On Fri, Nov 30, 2012 at 4:42 AM, Mij <mi...@ss...> wrote:

> Hi Ville,
>
> Find here the list of generalised messages that sshguard is supposed to
> block:
>
> http://www.sshguard.net/docs/reference/attack-signatures/
>
> if your pure-ftpd logs show attacks in different formats, please submit a
> sample to
>
> http://www.sshguard.net/support/attacks/submit/
>
> Make sure to include sufficient log context around every attack line. More
> is better than less.
>
> -m
>
>
> On Nov 24, 2012, at 3:09 , Ville Walveranta <wal...@gm...> wrote:
>
> > I have pure-ftpd 1.0.35-1 installed on Ubuntu 12.04 server along with
> sshguard 1.5-4.  sshguard is working perfectly with sshd – repeated login
> attempts are promptly blocked after five or so failed attempts.
> >
> > But pure-ftpd logins are not.  Pure-ftpd is logging to /var/log/auth.log
> like sshd.  Do I need to change something in pure-ftpd configuration?
>  Perhaps use another log format (although I'm not sure if the format
> selected for AltLog affects the auth.log entries..)?
> >
> > Thanks for any insights on this issue!
> >
> > Ville Walveranta
> >
> >
> ------------------------------------------------------------------------------
> > Monitor your physical, virtual and cloud infrastructure from a single
> > web console. Get in-depth insight into apps, servers, databases, vmware,
> > SAP, cloud infrastructure, etc. Download 30-day Free Trial.
> > Pricing starts from $795 for 25 servers or applications!
> >
> http://p.sf.net/sfu/zoho_dev2dev_nov_______________________________________________
> > Sshguard-users mailing list
> > Ssh...@li...
> > https://lists.sourceforge.net/lists/listinfo/sshguard-users
>
>
>
> ------------------------------------------------------------------------------
> Keep yourself connected to Go Parallel:
> TUNE You got it built. Now make it sing. Tune shows you how.
> http://goparallel.sourceforge.net
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

[Sshguard-users] Mountain Lion sshd log lines not recognized

[Adrian L. <ad...@lu...>]

I've setup sshguard on OS X 10.8.2 "Mountain Lion". I've successfully integrated sshguard with the system's pf firewall; using interactive mode and the sample log lines I see new IPs blocked in pf.

However actual failures are not being acted upon. Pasting log lines into sshguard interactive mode it appears log messages are not being parsed.

Some sample sshd messages:
Dec  2 03:26:16 server.example.com sshd[20830]: error: PAM: unknown user for illegal user richard from 82.221.99.229 via 1.2.3.4
Dec  2 10:04:32 server.example.com sshd[41143]: error: PAM: authentication error for root from badguy.comcast.net via 1.2.3.4

The "via 1.2.3.4" is the interface IP address of the logging server.

-Adrian

Re: [Sshguard-users] problem with mac osx lion

[Bradley G. <pi...@ma...>]

In MacPorts, we configure sshguard for Lion with:
--with-pfctl=/sbin/pfctl --with-firewall=pf


Regards,
Bradley Giesbrecht (pixilla)

On Nov 30, 2012, at 2:45 AM, Mij wrote:

> Bradley noticed a few days ago that OS X Lion switched from IPFW to PF – It was about time! –.
> If you use macports, they'll pick the right thing for you.
> 
> -m
> 
> 
> On Nov 28, 2012, at 18:43 , Neal Piche <bje...@gm...> wrote:
> 
>> I have mac osx lion and I got an error message in my log, here is the relevant section:
>> 
>> Nov 28 07:03:58 phirestalker sshd[93189]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:00 phirestalker sshd[93192]: Invalid user cgi from 222.184.230.118
>> Nov 28 07:04:00 phirestalker sshd[93193]: input_userauth_request: invalid user cgi
>> Nov 28 07:04:00 phirestalker sshd[93193]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:02 phirestalker sshd[93194]: Invalid user richie from 222.184.230.118
>> Nov 28 07:04:02 phirestalker sshd[93195]: input_userauth_request: invalid user richie
>> Nov 28 07:04:02 phirestalker sshd[93195]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:04 phirestalker sshd[93201]: Invalid user shirsh from 222.184.230.118
>> Nov 28 07:04:04 phirestalker sshd[93204]: input_userauth_request: invalid user shirsh
>> Nov 28 07:04:04 phirestalker sshd[93204]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:06 phirestalker sshd[93227]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:08 phirestalker sshd[93234]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:10 phirestalker sshd[93236]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:12 phirestalker sshd[93237]: Invalid user system from 222.184.230.118
>> Nov 28 07:04:12 phirestalker sshguard[11459]: Blocking 222.184.230.118:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
>> Nov 28 07:04:12 phirestalker sshd[93238]: input_userauth_request: invalid user system
>> Nov 28 07:15:18 phirestalker sshguard[11459]: Command "/sbin/ipfw delete 55036" exited 69
>> Nov 28 07:15:18 phirestalker sshguard[11459]: Release command failed. Exited: -1
>> 
>> it seems to block the person correctly but then tries and fails to unban them. In the unban it is using ipfw but from what I understand lion has switched to pf. A pf.conf is present and filled with things that seem to correlate with the system firewall. The funny thing is ipfw seems to be present as well but non-functional as I had fail2ban installed before and it said it was blocking and the IPs continued to hammer ssh. I have NO idea what is going on, I have found no reference to config files for sshguard in the documentation so how can I get it to use pf instead even though it is on mac and thinks it should use ipfw?
>> 
>> Thanks 
>> ------------------------------------------------------------------------------
>> Keep yourself connected to Go Parallel: 
>> TUNE You got it built. Now make it sing. Tune shows you how.
>> http://goparallel.sourceforge.net
>> _______________________________________________
>> Sshguard-users mailing list
>> Ssh...@li...
>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
> 
> 
> ------------------------------------------------------------------------------
> Keep yourself connected to Go Parallel: 
> TUNE You got it built. Now make it sing. Tune shows you how.
> http://goparallel.sourceforge.net
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] problem with mac osx lion

[Mij <mi...@ss...>]

Bradley noticed a few days ago that OS X Lion switched from IPFW to PF – It was about time! –.
If you use macports, they'll pick the right thing for you.

-m


On Nov 28, 2012, at 18:43 , Neal Piche <bje...@gm...> wrote:

> I have mac osx lion and I got an error message in my log, here is the relevant section:
> 
> Nov 28 07:03:58 phirestalker sshd[93189]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:00 phirestalker sshd[93192]: Invalid user cgi from 222.184.230.118
> Nov 28 07:04:00 phirestalker sshd[93193]: input_userauth_request: invalid user cgi
> Nov 28 07:04:00 phirestalker sshd[93193]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:02 phirestalker sshd[93194]: Invalid user richie from 222.184.230.118
> Nov 28 07:04:02 phirestalker sshd[93195]: input_userauth_request: invalid user richie
> Nov 28 07:04:02 phirestalker sshd[93195]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:04 phirestalker sshd[93201]: Invalid user shirsh from 222.184.230.118
> Nov 28 07:04:04 phirestalker sshd[93204]: input_userauth_request: invalid user shirsh
> Nov 28 07:04:04 phirestalker sshd[93204]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:06 phirestalker sshd[93227]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:08 phirestalker sshd[93234]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:10 phirestalker sshd[93236]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:12 phirestalker sshd[93237]: Invalid user system from 222.184.230.118
> Nov 28 07:04:12 phirestalker sshguard[11459]: Blocking 222.184.230.118:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
> Nov 28 07:04:12 phirestalker sshd[93238]: input_userauth_request: invalid user system
> Nov 28 07:15:18 phirestalker sshguard[11459]: Command "/sbin/ipfw delete 55036" exited 69
> Nov 28 07:15:18 phirestalker sshguard[11459]: Release command failed. Exited: -1
> 
> it seems to block the person correctly but then tries and fails to unban them. In the unban it is using ipfw but from what I understand lion has switched to pf. A pf.conf is present and filled with things that seem to correlate with the system firewall. The funny thing is ipfw seems to be present as well but non-functional as I had fail2ban installed before and it said it was blocking and the IPs continued to hammer ssh. I have NO idea what is going on, I have found no reference to config files for sshguard in the documentation so how can I get it to use pf instead even though it is on mac and thinks it should use ipfw?
> 
> Thanks 
> ------------------------------------------------------------------------------
> Keep yourself connected to Go Parallel: 
> TUNE You got it built. Now make it sing. Tune shows you how.
> http://goparallel.sourceforge.net
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] pure-ftpd protection not working

[Mij <mi...@ss...>]

Hi Ville,

Find here the list of generalised messages that sshguard is supposed to block:

http://www.sshguard.net/docs/reference/attack-signatures/

if your pure-ftpd logs show attacks in different formats, please submit a sample to

http://www.sshguard.net/support/attacks/submit/

Make sure to include sufficient log context around every attack line. More is better than less.

-m


On Nov 24, 2012, at 3:09 , Ville Walveranta <wal...@gm...> wrote:

> I have pure-ftpd 1.0.35-1 installed on Ubuntu 12.04 server along with sshguard 1.5-4.  sshguard is working perfectly with sshd – repeated login attempts are promptly blocked after five or so failed attempts.
> 
> But pure-ftpd logins are not.  Pure-ftpd is logging to /var/log/auth.log like sshd.  Do I need to change something in pure-ftpd configuration?  Perhaps use another log format (although I'm not sure if the format selected for AltLog affects the auth.log entries..)?
> 
> Thanks for any insights on this issue!
> 
> Ville Walveranta
> 
> ------------------------------------------------------------------------------
> Monitor your physical, virtual and cloud infrastructure from a single
> web console. Get in-depth insight into apps, servers, databases, vmware,
> SAP, cloud infrastructure, etc. Download 30-day Free Trial.
> Pricing starts from $795 for 25 servers or applications!
> http://p.sf.net/sfu/zoho_dev2dev_nov_______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] sshguard does not detect SMTP attack

[Mij <mi...@ss...>]

Hello Robert,

These patterns are not known to sshguard. Please submit these samples to

http://www.sshguard.net/support/attacks/submit/

You find the list of recognised patters on

http://www.sshguard.net/docs/reference/attack-signatures/

-m


On Nov 19, 2012, at 21:11 , Robert S <rob...@gm...> wrote:

> I have the following sshguard config:
> 
> # /etc/syslog-ng/syslog-ng.conf
> destination authlog { pipe("/var/log/sshguard.fifo"); };
> 
> filter f_authpriv { facility(auth, authpriv); };
> log { source(src); filter(f_authpriv); destination(authlog); };
> 
> filter f_mail { facility(mail); };
> log { source(src); filter(f_mail); destination(authlog); };
> 
> 
> # cat /var/log/sshguard.fifo | /usr/sbin/sshguard -b
> /var/local/sshguard/blacklist.db -w /etc/sshguard.whitelist -f
> 100:/var/run/sshd.pid -f 250:/var/run/sendmail.pid -f
> 210:/var/run/dovecot/master.pid
> 
> Recently I got a lot of these in my syslog:
> 
> Nov 20 03:10:32 myserver sm-mta[24866]: qAJGAOu7024866:
> cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
> SMTP attack: command=AUTH, count=3
> Nov 20 03:12:43 myserver sm-mta[24906]: qAJGCZe6024906:
> cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
> SMTP attack: command=AUTH, count=3
> Nov 20 03:12:57 myserver saslauthd[5531]: do_auth : auth failure:
> [user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
> Nov 20 03:14:52 myserver sm-mta[24914]: qAJGEjAF024914:
> cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
> SMTP attack: command=AUTH, count=3
> Nov 20 03:15:08 myserver saslauthd[5528]: do_auth : auth failure:
> [user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
> Nov 20 03:17:02 myserver sm-mta[24926]: qAJGGtse024926:
> cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
> SMTP attack: command=AUTH, count=3
> Nov 20 03:17:17 myserver saslauthd[5532]: do_auth : auth failure:
> [user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
> 
> .. but these were not detected by sshguard.
> 
> I have run sshguard in debug mode and the messages are getting
> through, and it is blocking ssh attacks successfully.  I am running
> sendmail 8.14.4 and sshguard 1.5 on gentoo linux.  Can somebody tell
> me where things are going wrong?
> 
> ------------------------------------------------------------------------------
> Monitor your physical, virtual and cloud infrastructure from a single
> web console. Get in-depth insight into apps, servers, databases, vmware,
> SAP, cloud infrastructure, etc. Download 30-day Free Trial.
> Pricing starts from $795 for 25 servers or applications!
> http://p.sf.net/sfu/zoho_dev2dev_nov
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] sshguard ignoring entries from unnamed hosts

[Mij <mi...@ss...>]

Hey Charles,

Thanks for reporting. I've never seen syslog logging IPs in place of the hostname.
It's an easy fix and we'll address it at the next sprint before the EOY.

-m


On May 22, 2012, at 0:47 , Charles Sprickman <sp...@bw...> wrote:

> This is an odd one.  I use sshguard in FreeBSD jails quite often by having the jail send all auth.info to the host.  This generally works well, but a recent new install showed that a ton of brute-force attacks were being logged but sshguard was not acting on them.  After playing around with debug mode, I found this that it's due to the logfile containing the jail's IP rather than hostname.
> 
> ignored:
> 
> Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
> May 21 18:35:54 10.88.77.22 sshd[39330]: error: PAM: authentication error for root from x.x.x.x
> Starting parse
> Entering state 0
> Reading a token: --accepting rule at line 213 ("May 21 18:35:54")
> Next token is token TIMESTAMP_SYSLOG ()
> Cleanup: discarding lookahead token TIMESTAMP_SYSLOG ()
> Stack now 0
> 
> valid:
> 
> May 21 18:35:54 foo sshd[39330]: error: PAM: authentication error for root from x.x.x.x
> Starting parse
> Entering state 0
> Reading a token: --accepting rule at line 110 ("May 21 18:35:54 foo sshd[39330]: ")
> Next token is token SYSLOG_BANNER_PID ()
> Shifting token SYSLOG_BANNER_PID ()
> Entering state 1
> Reading a token: --accepting rule at line 146 ("error: PAM: authentication error for root from ")
> Next token is token SSH_LOGINERR_PAM ()
> Shifting token SSH_LOGINERR_PAM ()
> Entering state 9
> […]
> Now at end of input.
> Stack now 0 23
> Cleanup: popping nterm text ()
> Matched address x.x.x.x:4 attacking service 100, dangerousness 10.
> 
> I can fix this in /etc/hosts, but why would sshguard not accept the first form by default?  I generally don't bother with dns on the internal networks.
> 
> Thanks,
> 
> Charles
> --
> Charles Sprickman
> NetEng/SysAdmin
> Bway.net - New York's Best Internet www.bway.net
> sp...@bw... - 212.982.9800
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] Blocking root user logins

[Mij <mi...@ss...>]

Hello William,

> Is there a way to block attempts to connect as root after
> 2 or 3 tries?

There is no "user way" to make a difference between attempts as root or other unaccepted users.
These attempts will be blocked after 2-3 tries anyway.

-m


On Jul 28, 2012, at 20:51 , William Meigs <wm...@be...> wrote:

> I always set
> PermitRootLogin no
> in my sshd_config.
> 
> Is there a way to block attempts to connect as root after
> 2 or 3 tries? That would get rid of half of the attacks on my
> systems.
> 
> -- 
> William Meigs
> Beyond Management LLC
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] Apache rules

[Mij <mi...@ss...>]

Hola Paco


On Sep 23, 2012, at 14:18 , Paco Hope <pa...@pa...> wrote:

> I'm sure this has been talked about before, but I'm struggling to find a way to search the email archives. Neither google nor sourceforge seem to have a mechanism. Am I really that daft?

MLs are hosted at sourceforge . Have a look at
http://sourceforge.net/search/?group_id=188282&type_of_search=mlists


> Anyways, I see tons and tons of people probing my web server for common vulns. When they're probing for things that look like IIS, it's pretty safe for me to assume they're just brute forcing. Now, there are various apache-specific ways to protect myself (e.g., mod_security), but those would just protect apache from people trying to exploit apache. I'd very much like to have sshguard throw them into the blacklist so they can't even try ssh, ftp, or anything else if they trip on an apache rule. Is this unwise? Has this been discussed and rejected?

Definitely makes sense.


> Here are a few example entries:
> 94.75.245.17 - - [21/Sep/2012:08:27:17 +0100] "GET /administrator/ HTTP/1.1" 301 247 "-" "
> Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0
> .50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"
> 
> 188.72.230.35 - - [09/Jul/2011:23:27:56 +0100] "CONNECT dl3.jetswap.net:80 HTTP/1.0" 405 235 "-" "-"
> 
> 85.252.49.19 - - [17/Aug/2012:13:06:19 +0100] "POST /components/com_oziogallery2/imagin/scripts_ralcr/filesystem/writeToFile.php HTTP/1.1" 301 308 "none" ""
> 
> Is it just too many possible rules? or is there some other good reason?

The problem I see with this is, the attack patterns change too often to be incorporated in a sane way.
However, we do have an interest in this. Please post these sample patterns on

http://www.sshguard.net/support/attacks/submit/

-m

[Sshguard-users] problem with mac osx lion

[Neal P. <bje...@gm...>]

I have mac osx lion and I got an error message in my log, here is the relevant section:

Nov 28 07:03:58 phirestalker sshd[93189]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:00 phirestalker sshd[93192]: Invalid user cgi from 222.184.230.118
Nov 28 07:04:00 phirestalker sshd[93193]: input_userauth_request: invalid user cgi
Nov 28 07:04:00 phirestalker sshd[93193]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:02 phirestalker sshd[93194]: Invalid user richie from 222.184.230.118
Nov 28 07:04:02 phirestalker sshd[93195]: input_userauth_request: invalid user richie
Nov 28 07:04:02 phirestalker sshd[93195]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:04 phirestalker sshd[93201]: Invalid user shirsh from 222.184.230.118
Nov 28 07:04:04 phirestalker sshd[93204]: input_userauth_request: invalid user shirsh
Nov 28 07:04:04 phirestalker sshd[93204]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:06 phirestalker sshd[93227]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:08 phirestalker sshd[93234]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:10 phirestalker sshd[93236]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:12 phirestalker sshd[93237]: Invalid user system from 222.184.230.118
Nov 28 07:04:12 phirestalker sshguard[11459]: Blocking 222.184.230.118:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
Nov 28 07:04:12 phirestalker sshd[93238]: input_userauth_request: invalid user system
Nov 28 07:15:18 phirestalker sshguard[11459]: Command "/sbin/ipfw delete 55036" exited 69
Nov 28 07:15:18 phirestalker sshguard[11459]: Release command failed. Exited: -1

it seems to block the person correctly but then tries and fails to unban them. In the unban it is using ipfw but from what I understand lion has switched to pf. A pf.conf is present and filled with things that seem to correlate with the system firewall. The funny thing is ipfw seems to be present as well but non-functional as I had fail2ban installed before and it said it was blocking and the IPs continued to hammer ssh. I have NO idea what is going on, I have found no reference to config files for sshguard in the documentation so how can I get it to use pf instead even though it is on mac and thinks it should use ipfw?

Thanks 

[Sshguard-users] pure-ftpd protection not working

[Ville W. <wal...@gm...>]

I have pure-ftpd 1.0.35-1 installed on Ubuntu 12.04 server along with
sshguard 1.5-4.  sshguard is working perfectly with sshd – repeated login
attempts are promptly blocked after five or so failed attempts.

But pure-ftpd logins are not.  Pure-ftpd is logging to /var/log/auth.log
like sshd.  Do I need to change something in pure-ftpd configuration?
 Perhaps use another log format (although I'm not sure if the format
selected for AltLog affects the auth.log entries..)?

Thanks for any insights on this issue!

Ville Walveranta

[Sshguard-users] sshguard does not detect SMTP attack

[Robert S <rob...@gm...>]

I have the following sshguard config:

# /etc/syslog-ng/syslog-ng.conf
destination authlog { pipe("/var/log/sshguard.fifo"); };

filter f_authpriv { facility(auth, authpriv); };
log { source(src); filter(f_authpriv); destination(authlog); };

filter f_mail { facility(mail); };
log { source(src); filter(f_mail); destination(authlog); };


# cat /var/log/sshguard.fifo | /usr/sbin/sshguard -b
/var/local/sshguard/blacklist.db -w /etc/sshguard.whitelist -f
100:/var/run/sshd.pid -f 250:/var/run/sendmail.pid -f
210:/var/run/dovecot/master.pid

Recently I got a lot of these in my syslog:

Nov 20 03:10:32 myserver sm-mta[24866]: qAJGAOu7024866:
cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
SMTP attack: command=AUTH, count=3
Nov 20 03:12:43 myserver sm-mta[24906]: qAJGCZe6024906:
cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
SMTP attack: command=AUTH, count=3
Nov 20 03:12:57 myserver saslauthd[5531]: do_auth : auth failure:
[user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
Nov 20 03:14:52 myserver sm-mta[24914]: qAJGEjAF024914:
cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
SMTP attack: command=AUTH, count=3
Nov 20 03:15:08 myserver saslauthd[5528]: do_auth : auth failure:
[user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
Nov 20 03:17:02 myserver sm-mta[24926]: qAJGGtse024926:
cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
SMTP attack: command=AUTH, count=3
Nov 20 03:17:17 myserver saslauthd[5532]: do_auth : auth failure:
[user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]

 .. but these were not detected by sshguard.

I have run sshguard in debug mode and the messages are getting
through, and it is blocking ssh attacks successfully.  I am running
sendmail 8.14.4 and sshguard 1.5 on gentoo linux.  Can somebody tell
me where things are going wrong?

[Sshguard-users] sshguard: Do not support syslog-ng's option for ISO-8601 timestamps

[Julián M. P. <dar...@gm...>]

Hi Mij,

Please consider to apply the patch to support syslog-ng with ISO-8601
timestamps.

More details of the patch please see:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693614

Thank you so much.

-- 
Julián Moreno Patiño
Debian Developer
 .''`. Debian GNU/{Linux,KfreeBSD}
: :' : Free Operating Systems
`. `'  http://debian.org/
  `-   GPG Fingerprint:
C2C8 904E 314C D8FA 041D 9B00 D5FD FC15 6168 BF60
Registered GNU Linux User ID 488513

Re: [Sshguard-users] a help with iptables or rinetd

[Jo R. <jr...@ne...>]

You need to run sshguard or something similar on the bastion host, not on the internal server.

On Oct 3, 2012, at 9:57 PM, Roberto Spadim wrote:
> hi guys, i have a server connected to internet , and connected to local network
> i'm using ipv4
> at internet connection, i'm using rinetd to redirect connections from
> port 22 to internal server at ip 172.16.0.33 port 2022
> rinetd is a tcp daemond, not a firewall, and at my local server
> 172.16.0.33 i see a connection from internet server ip 172.16.0.34,
> instead of original user ip (from internet)
> 
> in other words.. when a brute force is detected all connection from
> 172.16.0.34 are dropped
> 
> could any one help me create a NAT from internet server to local
> server? in others words, how could i configure iptables (linux 2.6 /
> 3.xx) to work as a redirector, i found many many information at
> google, but they don't work very nice some don't connect, some just
> allow connect and don't comunicate
> 
> 
> anyone could help? maybe this could be put on FAQ
> thanks
> 
> ------------------------------------------------------------------------------
> Don't let slow site performance ruin your business. Deploy New Relic APM
> Deploy New Relic app performance management and know exactly
> what is happening inside your Ruby, Python, PHP, Java, and .NET app
> Try New Relic at no cost today and get our sweet Data Nerd shirt too!
> http://p.sf.net/sfu/newrelic-dev2dev
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

-- 
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[Sshguard-users] a help with iptables or rinetd

[Roberto S. <ro...@sp...>]

hi guys, i have a server connected to internet , and connected to local network
i'm using ipv4
at internet connection, i'm using rinetd to redirect connections from
port 22 to internal server at ip 172.16.0.33 port 2022
rinetd is a tcp daemond, not a firewall, and at my local server
172.16.0.33 i see a connection from internet server ip 172.16.0.34,
instead of original user ip (from internet)

in other words.. when a brute force is detected all connection from
172.16.0.34 are dropped

could any one help me create a NAT from internet server to local
server? in others words, how could i configure iptables (linux 2.6 /
3.xx) to work as a redirector, i found many many information at
google, but they don't work very nice some don't connect, some just
allow connect and don't comunicate


anyone could help? maybe this could be put on FAQ
thanks

[Sshguard-users] Apache rules

[Paco H. <pa...@pa...>]

I'm sure this has been talked about before, but I'm struggling to find a way to search the email archives. Neither google nor sourceforge seem to have a mechanism. Am I really that daft?

Anyways, I see tons and tons of people probing my web server for common vulns. When they're probing for things that look like IIS, it's pretty safe for me to assume they're just brute forcing. Now, there are various apache-specific ways to protect myself (e.g., mod_security), but those would just protect apache from people trying to exploit apache. I'd very much like to have sshguard throw them into the blacklist so they can't even try ssh, ftp, or anything else if they trip on an apache rule. Is this unwise? Has this been discussed and rejected?

Here are a few example entries:
94.75.245.17 - - [21/Sep/2012:08:27:17 +0100] "GET /administrator/ HTTP/1.1" 301 247 "-" "
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0
.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"

188.72.230.35 - - [09/Jul/2011:23:27:56 +0100] "CONNECT dl3.jetswap.net:80 HTTP/1.0" 405 235 "-" "-"

85.252.49.19 - - [17/Aug/2012:13:06:19 +0100] "POST /components/com_oziogallery2/imagin/scripts_ralcr/filesystem/writeToFile.php HTTP/1.1" 301 308 "none" ""

Is it just too many possible rules? or is there some other good reason?

Thoughts?

Thanks,
Paco

Re: [Sshguard-users] Real quick install documentation struggle

[Jo R. <jr...@ne...>]

On Aug 4, 2012, at 11:08 PM, Richard Pesce wrote:
> another huge problem is I do not understand iptables. :)

This isn't an appropriate problem for sshguard mailing list users to help you with. Similar to we shouldn't help you learn to shoot a gun and hurt yourself. Best that you either take lessons to learn the appropriate material, or hire someone competent to do the job for you.

-- 
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[Sshguard-users] Real quick install documentation struggle

[Richard P. <pe...@pe...>]

The current iptables config docs say to type these two commands:

iptables -N sshguard
iptables -A INPUT -j sshguard

I attempted this and it added it perfectly to the iptables..
Only problem is I am using fedora 16 and configured the firewall with
system-config-firewall and the above didn't work for me... it blocked
addresses but after the allow rules

another huge problem is I do not understand iptables. :)


I fixed my problem by changing the line "iptables -A INPUT -j
sshguard" to "/sbin/iptables -I INPUT 1 -j sshguard"
which inserted the deny rules as the very first item in the list.
Which is fine for me, but maybe its an issue...

Fedora 16 started using Systemd and in order to save your iptables
config you use this: "iptables-save > /etc/sysconfig/iptables"
otherwise you get an error...

Anyway, thank you!