sshguard-users — User questions and answers, bugs, and general support

[Sshguard-users] readonly setup broken with >1.5

[Harald S. <h.s...@om...>]

 Hello,

thanks a lot for that nifty tool!
I've bin using it for quiet some time.
Very often, I have jails which are read-only / mounted. /etc/hosts.allow
is then a symlink somehere into /var (which is writable).
This has been working fine with older versions of sshguard, but it
stopped working with version 1.6 for me. Not sure if that's really the
first version where the behaviour changed though.

sshguard want's to create a temporary file inside /etc reflecting the pid:
    "Could not create temporary file /etc/hosts.allow-sshguard.4020"

Why doesn't it use TMPDIR?

Any hint's where to work arround that in the code?

Thanks,

-Harry (not subscribed!)

Re: [Sshguard-users] pure-ftpd protection not working

[Ville W. <wal...@gm...>]

Hi Mij,

Thanks for the reply.  With that info I was able to figure it out.  The
reason for why it wasn't working "out of the box" is that on Ubuntu
pure-ftpd logs login failures into /var/log/syslog by default.
/var/log/auth.log only gets authentication notices from PAM:

Dec  4 00:16:07 moonpod pure-ftpd: pam_unix(pure-ftpd:auth): check pass;
user unknown
Dec  4 00:16:07 moonpod pure-ftpd: pam_unix(pure-ftpd:auth): authentication
failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=test123
rhost=workstation.internal.domain
Dec  4 00:16:07 moonpod pure-ftpd: pam_winbind(pure-ftpd:auth): getting
password (0x00000388)
Dec  4 00:16:07 moonpod pure-ftpd: pam_winbind(pure-ftpd:auth):
pam_get_item returned a password

Once I added syslog to LogSucker (by adding it to "LOGFILES" in
/etc/default/sshguard), it started working.  The other alternative would've
been to separate pure-ftpd login failures into a separate log via rsyslog
configuration change (and then point sshguard to that log), but there's
probably no harm done by sshguard monitoring the syslog.

SSHguard is so much easier to use than blockhosts which I used for many
years with FreeBSD.  I'm quite happy with it!  Keep up the good work!

Ville


On Fri, Nov 30, 2012 at 4:42 AM, Mij <mi...@ss...> wrote:

> Hi Ville,
>
> Find here the list of generalised messages that sshguard is supposed to
> block:
>
> http://www.sshguard.net/docs/reference/attack-signatures/
>
> if your pure-ftpd logs show attacks in different formats, please submit a
> sample to
>
> http://www.sshguard.net/support/attacks/submit/
>
> Make sure to include sufficient log context around every attack line. More
> is better than less.
>
> -m
>
>
> On Nov 24, 2012, at 3:09 , Ville Walveranta <wal...@gm...> wrote:
>
> > I have pure-ftpd 1.0.35-1 installed on Ubuntu 12.04 server along with
> sshguard 1.5-4.  sshguard is working perfectly with sshd – repeated login
> attempts are promptly blocked after five or so failed attempts.
> >
> > But pure-ftpd logins are not.  Pure-ftpd is logging to /var/log/auth.log
> like sshd.  Do I need to change something in pure-ftpd configuration?
>  Perhaps use another log format (although I'm not sure if the format
> selected for AltLog affects the auth.log entries..)?
> >
> > Thanks for any insights on this issue!
> >
> > Ville Walveranta
> >
> >
> ------------------------------------------------------------------------------
> > Monitor your physical, virtual and cloud infrastructure from a single
> > web console. Get in-depth insight into apps, servers, databases, vmware,
> > SAP, cloud infrastructure, etc. Download 30-day Free Trial.
> > Pricing starts from $795 for 25 servers or applications!
> >
> http://p.sf.net/sfu/zoho_dev2dev_nov_______________________________________________
> > Sshguard-users mailing list
> > Ssh...@li...
> > https://lists.sourceforge.net/lists/listinfo/sshguard-users
>
>
>
> ------------------------------------------------------------------------------
> Keep yourself connected to Go Parallel:
> TUNE You got it built. Now make it sing. Tune shows you how.
> http://goparallel.sourceforge.net
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

[Sshguard-users] Mountain Lion sshd log lines not recognized

[Adrian L. <ad...@lu...>]

I've setup sshguard on OS X 10.8.2 "Mountain Lion". I've successfully integrated sshguard with the system's pf firewall; using interactive mode and the sample log lines I see new IPs blocked in pf.

However actual failures are not being acted upon. Pasting log lines into sshguard interactive mode it appears log messages are not being parsed.

Some sample sshd messages:
Dec  2 03:26:16 server.example.com sshd[20830]: error: PAM: unknown user for illegal user richard from 82.221.99.229 via 1.2.3.4
Dec  2 10:04:32 server.example.com sshd[41143]: error: PAM: authentication error for root from badguy.comcast.net via 1.2.3.4

The "via 1.2.3.4" is the interface IP address of the logging server.

-Adrian

Re: [Sshguard-users] problem with mac osx lion

[Bradley G. <pi...@ma...>]

In MacPorts, we configure sshguard for Lion with:
--with-pfctl=/sbin/pfctl --with-firewall=pf


Regards,
Bradley Giesbrecht (pixilla)

On Nov 30, 2012, at 2:45 AM, Mij wrote:

> Bradley noticed a few days ago that OS X Lion switched from IPFW to PF – It was about time! –.
> If you use macports, they'll pick the right thing for you.
> 
> -m
> 
> 
> On Nov 28, 2012, at 18:43 , Neal Piche <bje...@gm...> wrote:
> 
>> I have mac osx lion and I got an error message in my log, here is the relevant section:
>> 
>> Nov 28 07:03:58 phirestalker sshd[93189]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:00 phirestalker sshd[93192]: Invalid user cgi from 222.184.230.118
>> Nov 28 07:04:00 phirestalker sshd[93193]: input_userauth_request: invalid user cgi
>> Nov 28 07:04:00 phirestalker sshd[93193]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:02 phirestalker sshd[93194]: Invalid user richie from 222.184.230.118
>> Nov 28 07:04:02 phirestalker sshd[93195]: input_userauth_request: invalid user richie
>> Nov 28 07:04:02 phirestalker sshd[93195]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:04 phirestalker sshd[93201]: Invalid user shirsh from 222.184.230.118
>> Nov 28 07:04:04 phirestalker sshd[93204]: input_userauth_request: invalid user shirsh
>> Nov 28 07:04:04 phirestalker sshd[93204]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:06 phirestalker sshd[93227]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:08 phirestalker sshd[93234]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:10 phirestalker sshd[93236]: Received disconnect from 222.184.230.118: 11: Bye Bye
>> Nov 28 07:04:12 phirestalker sshd[93237]: Invalid user system from 222.184.230.118
>> Nov 28 07:04:12 phirestalker sshguard[11459]: Blocking 222.184.230.118:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
>> Nov 28 07:04:12 phirestalker sshd[93238]: input_userauth_request: invalid user system
>> Nov 28 07:15:18 phirestalker sshguard[11459]: Command "/sbin/ipfw delete 55036" exited 69
>> Nov 28 07:15:18 phirestalker sshguard[11459]: Release command failed. Exited: -1
>> 
>> it seems to block the person correctly but then tries and fails to unban them. In the unban it is using ipfw but from what I understand lion has switched to pf. A pf.conf is present and filled with things that seem to correlate with the system firewall. The funny thing is ipfw seems to be present as well but non-functional as I had fail2ban installed before and it said it was blocking and the IPs continued to hammer ssh. I have NO idea what is going on, I have found no reference to config files for sshguard in the documentation so how can I get it to use pf instead even though it is on mac and thinks it should use ipfw?
>> 
>> Thanks 
>> ------------------------------------------------------------------------------
>> Keep yourself connected to Go Parallel: 
>> TUNE You got it built. Now make it sing. Tune shows you how.
>> http://goparallel.sourceforge.net
>> _______________________________________________
>> Sshguard-users mailing list
>> Ssh...@li...
>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
> 
> 
> ------------------------------------------------------------------------------
> Keep yourself connected to Go Parallel: 
> TUNE You got it built. Now make it sing. Tune shows you how.
> http://goparallel.sourceforge.net
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] problem with mac osx lion

[Mij <mi...@ss...>]

Bradley noticed a few days ago that OS X Lion switched from IPFW to PF – It was about time! –.
If you use macports, they'll pick the right thing for you.

-m


On Nov 28, 2012, at 18:43 , Neal Piche <bje...@gm...> wrote:

> I have mac osx lion and I got an error message in my log, here is the relevant section:
> 
> Nov 28 07:03:58 phirestalker sshd[93189]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:00 phirestalker sshd[93192]: Invalid user cgi from 222.184.230.118
> Nov 28 07:04:00 phirestalker sshd[93193]: input_userauth_request: invalid user cgi
> Nov 28 07:04:00 phirestalker sshd[93193]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:02 phirestalker sshd[93194]: Invalid user richie from 222.184.230.118
> Nov 28 07:04:02 phirestalker sshd[93195]: input_userauth_request: invalid user richie
> Nov 28 07:04:02 phirestalker sshd[93195]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:04 phirestalker sshd[93201]: Invalid user shirsh from 222.184.230.118
> Nov 28 07:04:04 phirestalker sshd[93204]: input_userauth_request: invalid user shirsh
> Nov 28 07:04:04 phirestalker sshd[93204]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:06 phirestalker sshd[93227]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:08 phirestalker sshd[93234]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:10 phirestalker sshd[93236]: Received disconnect from 222.184.230.118: 11: Bye Bye
> Nov 28 07:04:12 phirestalker sshd[93237]: Invalid user system from 222.184.230.118
> Nov 28 07:04:12 phirestalker sshguard[11459]: Blocking 222.184.230.118:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
> Nov 28 07:04:12 phirestalker sshd[93238]: input_userauth_request: invalid user system
> Nov 28 07:15:18 phirestalker sshguard[11459]: Command "/sbin/ipfw delete 55036" exited 69
> Nov 28 07:15:18 phirestalker sshguard[11459]: Release command failed. Exited: -1
> 
> it seems to block the person correctly but then tries and fails to unban them. In the unban it is using ipfw but from what I understand lion has switched to pf. A pf.conf is present and filled with things that seem to correlate with the system firewall. The funny thing is ipfw seems to be present as well but non-functional as I had fail2ban installed before and it said it was blocking and the IPs continued to hammer ssh. I have NO idea what is going on, I have found no reference to config files for sshguard in the documentation so how can I get it to use pf instead even though it is on mac and thinks it should use ipfw?
> 
> Thanks 
> ------------------------------------------------------------------------------
> Keep yourself connected to Go Parallel: 
> TUNE You got it built. Now make it sing. Tune shows you how.
> http://goparallel.sourceforge.net
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] pure-ftpd protection not working

[Mij <mi...@ss...>]

Hi Ville,

Find here the list of generalised messages that sshguard is supposed to block:

http://www.sshguard.net/docs/reference/attack-signatures/

if your pure-ftpd logs show attacks in different formats, please submit a sample to

http://www.sshguard.net/support/attacks/submit/

Make sure to include sufficient log context around every attack line. More is better than less.

-m


On Nov 24, 2012, at 3:09 , Ville Walveranta <wal...@gm...> wrote:

> I have pure-ftpd 1.0.35-1 installed on Ubuntu 12.04 server along with sshguard 1.5-4.  sshguard is working perfectly with sshd – repeated login attempts are promptly blocked after five or so failed attempts.
> 
> But pure-ftpd logins are not.  Pure-ftpd is logging to /var/log/auth.log like sshd.  Do I need to change something in pure-ftpd configuration?  Perhaps use another log format (although I'm not sure if the format selected for AltLog affects the auth.log entries..)?
> 
> Thanks for any insights on this issue!
> 
> Ville Walveranta
> 
> ------------------------------------------------------------------------------
> Monitor your physical, virtual and cloud infrastructure from a single
> web console. Get in-depth insight into apps, servers, databases, vmware,
> SAP, cloud infrastructure, etc. Download 30-day Free Trial.
> Pricing starts from $795 for 25 servers or applications!
> http://p.sf.net/sfu/zoho_dev2dev_nov_______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] sshguard does not detect SMTP attack

[Mij <mi...@ss...>]

Hello Robert,

These patterns are not known to sshguard. Please submit these samples to

http://www.sshguard.net/support/attacks/submit/

You find the list of recognised patters on

http://www.sshguard.net/docs/reference/attack-signatures/

-m


On Nov 19, 2012, at 21:11 , Robert S <rob...@gm...> wrote:

> I have the following sshguard config:
> 
> # /etc/syslog-ng/syslog-ng.conf
> destination authlog { pipe("/var/log/sshguard.fifo"); };
> 
> filter f_authpriv { facility(auth, authpriv); };
> log { source(src); filter(f_authpriv); destination(authlog); };
> 
> filter f_mail { facility(mail); };
> log { source(src); filter(f_mail); destination(authlog); };
> 
> 
> # cat /var/log/sshguard.fifo | /usr/sbin/sshguard -b
> /var/local/sshguard/blacklist.db -w /etc/sshguard.whitelist -f
> 100:/var/run/sshd.pid -f 250:/var/run/sendmail.pid -f
> 210:/var/run/dovecot/master.pid
> 
> Recently I got a lot of these in my syslog:
> 
> Nov 20 03:10:32 myserver sm-mta[24866]: qAJGAOu7024866:
> cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
> SMTP attack: command=AUTH, count=3
> Nov 20 03:12:43 myserver sm-mta[24906]: qAJGCZe6024906:
> cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
> SMTP attack: command=AUTH, count=3
> Nov 20 03:12:57 myserver saslauthd[5531]: do_auth : auth failure:
> [user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
> Nov 20 03:14:52 myserver sm-mta[24914]: qAJGEjAF024914:
> cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
> SMTP attack: command=AUTH, count=3
> Nov 20 03:15:08 myserver saslauthd[5528]: do_auth : auth failure:
> [user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
> Nov 20 03:17:02 myserver sm-mta[24926]: qAJGGtse024926:
> cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
> SMTP attack: command=AUTH, count=3
> Nov 20 03:17:17 myserver saslauthd[5532]: do_auth : auth failure:
> [user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
> 
> .. but these were not detected by sshguard.
> 
> I have run sshguard in debug mode and the messages are getting
> through, and it is blocking ssh attacks successfully.  I am running
> sendmail 8.14.4 and sshguard 1.5 on gentoo linux.  Can somebody tell
> me where things are going wrong?
> 
> ------------------------------------------------------------------------------
> Monitor your physical, virtual and cloud infrastructure from a single
> web console. Get in-depth insight into apps, servers, databases, vmware,
> SAP, cloud infrastructure, etc. Download 30-day Free Trial.
> Pricing starts from $795 for 25 servers or applications!
> http://p.sf.net/sfu/zoho_dev2dev_nov
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] sshguard ignoring entries from unnamed hosts

[Mij <mi...@ss...>]

Hey Charles,

Thanks for reporting. I've never seen syslog logging IPs in place of the hostname.
It's an easy fix and we'll address it at the next sprint before the EOY.

-m


On May 22, 2012, at 0:47 , Charles Sprickman <sp...@bw...> wrote:

> This is an odd one.  I use sshguard in FreeBSD jails quite often by having the jail send all auth.info to the host.  This generally works well, but a recent new install showed that a ton of brute-force attacks were being logged but sshguard was not acting on them.  After playing around with debug mode, I found this that it's due to the logfile containing the jail's IP rather than hostname.
> 
> ignored:
> 
> Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
> May 21 18:35:54 10.88.77.22 sshd[39330]: error: PAM: authentication error for root from x.x.x.x
> Starting parse
> Entering state 0
> Reading a token: --accepting rule at line 213 ("May 21 18:35:54")
> Next token is token TIMESTAMP_SYSLOG ()
> Cleanup: discarding lookahead token TIMESTAMP_SYSLOG ()
> Stack now 0
> 
> valid:
> 
> May 21 18:35:54 foo sshd[39330]: error: PAM: authentication error for root from x.x.x.x
> Starting parse
> Entering state 0
> Reading a token: --accepting rule at line 110 ("May 21 18:35:54 foo sshd[39330]: ")
> Next token is token SYSLOG_BANNER_PID ()
> Shifting token SYSLOG_BANNER_PID ()
> Entering state 1
> Reading a token: --accepting rule at line 146 ("error: PAM: authentication error for root from ")
> Next token is token SSH_LOGINERR_PAM ()
> Shifting token SSH_LOGINERR_PAM ()
> Entering state 9
> […]
> Now at end of input.
> Stack now 0 23
> Cleanup: popping nterm text ()
> Matched address x.x.x.x:4 attacking service 100, dangerousness 10.
> 
> I can fix this in /etc/hosts, but why would sshguard not accept the first form by default?  I generally don't bother with dns on the internal networks.
> 
> Thanks,
> 
> Charles
> --
> Charles Sprickman
> NetEng/SysAdmin
> Bway.net - New York's Best Internet www.bway.net
> sp...@bw... - 212.982.9800
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] Blocking root user logins

[Mij <mi...@ss...>]

Hello William,

> Is there a way to block attempts to connect as root after
> 2 or 3 tries?

There is no "user way" to make a difference between attempts as root or other unaccepted users.
These attempts will be blocked after 2-3 tries anyway.

-m


On Jul 28, 2012, at 20:51 , William Meigs <wm...@be...> wrote:

> I always set
> PermitRootLogin no
> in my sshd_config.
> 
> Is there a way to block attempts to connect as root after
> 2 or 3 tries? That would get rid of half of the attacks on my
> systems.
> 
> -- 
> William Meigs
> Beyond Management LLC
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] Apache rules

[Mij <mi...@ss...>]

Hola Paco


On Sep 23, 2012, at 14:18 , Paco Hope <pa...@pa...> wrote:

> I'm sure this has been talked about before, but I'm struggling to find a way to search the email archives. Neither google nor sourceforge seem to have a mechanism. Am I really that daft?

MLs are hosted at sourceforge . Have a look at
http://sourceforge.net/search/?group_id=188282&type_of_search=mlists


> Anyways, I see tons and tons of people probing my web server for common vulns. When they're probing for things that look like IIS, it's pretty safe for me to assume they're just brute forcing. Now, there are various apache-specific ways to protect myself (e.g., mod_security), but those would just protect apache from people trying to exploit apache. I'd very much like to have sshguard throw them into the blacklist so they can't even try ssh, ftp, or anything else if they trip on an apache rule. Is this unwise? Has this been discussed and rejected?

Definitely makes sense.


> Here are a few example entries:
> 94.75.245.17 - - [21/Sep/2012:08:27:17 +0100] "GET /administrator/ HTTP/1.1" 301 247 "-" "
> Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0
> .50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"
> 
> 188.72.230.35 - - [09/Jul/2011:23:27:56 +0100] "CONNECT dl3.jetswap.net:80 HTTP/1.0" 405 235 "-" "-"
> 
> 85.252.49.19 - - [17/Aug/2012:13:06:19 +0100] "POST /components/com_oziogallery2/imagin/scripts_ralcr/filesystem/writeToFile.php HTTP/1.1" 301 308 "none" ""
> 
> Is it just too many possible rules? or is there some other good reason?

The problem I see with this is, the attack patterns change too often to be incorporated in a sane way.
However, we do have an interest in this. Please post these sample patterns on

http://www.sshguard.net/support/attacks/submit/

-m

[Sshguard-users] problem with mac osx lion

[Neal P. <bje...@gm...>]

I have mac osx lion and I got an error message in my log, here is the relevant section:

Nov 28 07:03:58 phirestalker sshd[93189]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:00 phirestalker sshd[93192]: Invalid user cgi from 222.184.230.118
Nov 28 07:04:00 phirestalker sshd[93193]: input_userauth_request: invalid user cgi
Nov 28 07:04:00 phirestalker sshd[93193]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:02 phirestalker sshd[93194]: Invalid user richie from 222.184.230.118
Nov 28 07:04:02 phirestalker sshd[93195]: input_userauth_request: invalid user richie
Nov 28 07:04:02 phirestalker sshd[93195]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:04 phirestalker sshd[93201]: Invalid user shirsh from 222.184.230.118
Nov 28 07:04:04 phirestalker sshd[93204]: input_userauth_request: invalid user shirsh
Nov 28 07:04:04 phirestalker sshd[93204]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:06 phirestalker sshd[93227]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:08 phirestalker sshd[93234]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:10 phirestalker sshd[93236]: Received disconnect from 222.184.230.118: 11: Bye Bye
Nov 28 07:04:12 phirestalker sshd[93237]: Invalid user system from 222.184.230.118
Nov 28 07:04:12 phirestalker sshguard[11459]: Blocking 222.184.230.118:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
Nov 28 07:04:12 phirestalker sshd[93238]: input_userauth_request: invalid user system
Nov 28 07:15:18 phirestalker sshguard[11459]: Command "/sbin/ipfw delete 55036" exited 69
Nov 28 07:15:18 phirestalker sshguard[11459]: Release command failed. Exited: -1

it seems to block the person correctly but then tries and fails to unban them. In the unban it is using ipfw but from what I understand lion has switched to pf. A pf.conf is present and filled with things that seem to correlate with the system firewall. The funny thing is ipfw seems to be present as well but non-functional as I had fail2ban installed before and it said it was blocking and the IPs continued to hammer ssh. I have NO idea what is going on, I have found no reference to config files for sshguard in the documentation so how can I get it to use pf instead even though it is on mac and thinks it should use ipfw?

Thanks 

[Sshguard-users] pure-ftpd protection not working

[Ville W. <wal...@gm...>]

I have pure-ftpd 1.0.35-1 installed on Ubuntu 12.04 server along with
sshguard 1.5-4.  sshguard is working perfectly with sshd – repeated login
attempts are promptly blocked after five or so failed attempts.

But pure-ftpd logins are not.  Pure-ftpd is logging to /var/log/auth.log
like sshd.  Do I need to change something in pure-ftpd configuration?
 Perhaps use another log format (although I'm not sure if the format
selected for AltLog affects the auth.log entries..)?

Thanks for any insights on this issue!

Ville Walveranta

[Sshguard-users] sshguard does not detect SMTP attack

[Robert S <rob...@gm...>]

I have the following sshguard config:

# /etc/syslog-ng/syslog-ng.conf
destination authlog { pipe("/var/log/sshguard.fifo"); };

filter f_authpriv { facility(auth, authpriv); };
log { source(src); filter(f_authpriv); destination(authlog); };

filter f_mail { facility(mail); };
log { source(src); filter(f_mail); destination(authlog); };


# cat /var/log/sshguard.fifo | /usr/sbin/sshguard -b
/var/local/sshguard/blacklist.db -w /etc/sshguard.whitelist -f
100:/var/run/sshd.pid -f 250:/var/run/sendmail.pid -f
210:/var/run/dovecot/master.pid

Recently I got a lot of these in my syslog:

Nov 20 03:10:32 myserver sm-mta[24866]: qAJGAOu7024866:
cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
SMTP attack: command=AUTH, count=3
Nov 20 03:12:43 myserver sm-mta[24906]: qAJGCZe6024906:
cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
SMTP attack: command=AUTH, count=3
Nov 20 03:12:57 myserver saslauthd[5531]: do_auth : auth failure:
[user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
Nov 20 03:14:52 myserver sm-mta[24914]: qAJGEjAF024914:
cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
SMTP attack: command=AUTH, count=3
Nov 20 03:15:08 myserver saslauthd[5528]: do_auth : auth failure:
[user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
Nov 20 03:17:02 myserver sm-mta[24926]: qAJGGtse024926:
cese242.static.gvt.net.br [177.135.221.242] (may be forged): possible
SMTP attack: command=AUTH, count=3
Nov 20 03:17:17 myserver saslauthd[5532]: do_auth : auth failure:
[user=E!] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]

 .. but these were not detected by sshguard.

I have run sshguard in debug mode and the messages are getting
through, and it is blocking ssh attacks successfully.  I am running
sendmail 8.14.4 and sshguard 1.5 on gentoo linux.  Can somebody tell
me where things are going wrong?

[Sshguard-users] sshguard: Do not support syslog-ng's option for ISO-8601 timestamps

[Julián M. P. <dar...@gm...>]

Hi Mij,

Please consider to apply the patch to support syslog-ng with ISO-8601
timestamps.

More details of the patch please see:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693614

Thank you so much.

-- 
Julián Moreno Patiño
Debian Developer
 .''`. Debian GNU/{Linux,KfreeBSD}
: :' : Free Operating Systems
`. `'  http://debian.org/
  `-   GPG Fingerprint:
C2C8 904E 314C D8FA 041D 9B00 D5FD FC15 6168 BF60
Registered GNU Linux User ID 488513

Re: [Sshguard-users] a help with iptables or rinetd

[Jo R. <jr...@ne...>]

You need to run sshguard or something similar on the bastion host, not on the internal server.

On Oct 3, 2012, at 9:57 PM, Roberto Spadim wrote:
> hi guys, i have a server connected to internet , and connected to local network
> i'm using ipv4
> at internet connection, i'm using rinetd to redirect connections from
> port 22 to internal server at ip 172.16.0.33 port 2022
> rinetd is a tcp daemond, not a firewall, and at my local server
> 172.16.0.33 i see a connection from internet server ip 172.16.0.34,
> instead of original user ip (from internet)
> 
> in other words.. when a brute force is detected all connection from
> 172.16.0.34 are dropped
> 
> could any one help me create a NAT from internet server to local
> server? in others words, how could i configure iptables (linux 2.6 /
> 3.xx) to work as a redirector, i found many many information at
> google, but they don't work very nice some don't connect, some just
> allow connect and don't comunicate
> 
> 
> anyone could help? maybe this could be put on FAQ
> thanks
> 
> ------------------------------------------------------------------------------
> Don't let slow site performance ruin your business. Deploy New Relic APM
> Deploy New Relic app performance management and know exactly
> what is happening inside your Ruby, Python, PHP, Java, and .NET app
> Try New Relic at no cost today and get our sweet Data Nerd shirt too!
> http://p.sf.net/sfu/newrelic-dev2dev
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

-- 
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[Sshguard-users] a help with iptables or rinetd

[Roberto S. <ro...@sp...>]

hi guys, i have a server connected to internet , and connected to local network
i'm using ipv4
at internet connection, i'm using rinetd to redirect connections from
port 22 to internal server at ip 172.16.0.33 port 2022
rinetd is a tcp daemond, not a firewall, and at my local server
172.16.0.33 i see a connection from internet server ip 172.16.0.34,
instead of original user ip (from internet)

in other words.. when a brute force is detected all connection from
172.16.0.34 are dropped

could any one help me create a NAT from internet server to local
server? in others words, how could i configure iptables (linux 2.6 /
3.xx) to work as a redirector, i found many many information at
google, but they don't work very nice some don't connect, some just
allow connect and don't comunicate


anyone could help? maybe this could be put on FAQ
thanks

[Sshguard-users] Apache rules

[Paco H. <pa...@pa...>]

I'm sure this has been talked about before, but I'm struggling to find a way to search the email archives. Neither google nor sourceforge seem to have a mechanism. Am I really that daft?

Anyways, I see tons and tons of people probing my web server for common vulns. When they're probing for things that look like IIS, it's pretty safe for me to assume they're just brute forcing. Now, there are various apache-specific ways to protect myself (e.g., mod_security), but those would just protect apache from people trying to exploit apache. I'd very much like to have sshguard throw them into the blacklist so they can't even try ssh, ftp, or anything else if they trip on an apache rule. Is this unwise? Has this been discussed and rejected?

Here are a few example entries:
94.75.245.17 - - [21/Sep/2012:08:27:17 +0100] "GET /administrator/ HTTP/1.1" 301 247 "-" "
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0
.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"

188.72.230.35 - - [09/Jul/2011:23:27:56 +0100] "CONNECT dl3.jetswap.net:80 HTTP/1.0" 405 235 "-" "-"

85.252.49.19 - - [17/Aug/2012:13:06:19 +0100] "POST /components/com_oziogallery2/imagin/scripts_ralcr/filesystem/writeToFile.php HTTP/1.1" 301 308 "none" ""

Is it just too many possible rules? or is there some other good reason?

Thoughts?

Thanks,
Paco

Re: [Sshguard-users] Real quick install documentation struggle

[Jo R. <jr...@ne...>]

On Aug 4, 2012, at 11:08 PM, Richard Pesce wrote:
> another huge problem is I do not understand iptables. :)

This isn't an appropriate problem for sshguard mailing list users to help you with. Similar to we shouldn't help you learn to shoot a gun and hurt yourself. Best that you either take lessons to learn the appropriate material, or hire someone competent to do the job for you.

-- 
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[Sshguard-users] Real quick install documentation struggle

[Richard P. <pe...@pe...>]

The current iptables config docs say to type these two commands:

iptables -N sshguard
iptables -A INPUT -j sshguard

I attempted this and it added it perfectly to the iptables..
Only problem is I am using fedora 16 and configured the firewall with
system-config-firewall and the above didn't work for me... it blocked
addresses but after the allow rules

another huge problem is I do not understand iptables. :)


I fixed my problem by changing the line "iptables -A INPUT -j
sshguard" to "/sbin/iptables -I INPUT 1 -j sshguard"
which inserted the deny rules as the very first item in the list.
Which is fine for me, but maybe its an issue...

Fedora 16 started using Systemd and in order to save your iptables
config you use this: "iptables-save > /etc/sysconfig/iptables"
otherwise you get an error...

Anyway, thank you!

[Sshguard-users] Blocking root user logins

[William M. <wm...@be...>]

I always set
PermitRootLogin no
in my sshd_config.

Is there a way to block attempts to connect as root after
2 or 3 tries? That would get rid of half of the attacks on my
systems.

-- 
William Meigs
Beyond Management LLC

[Sshguard-users] Error parsing hostnames with 'ssh' in them

[jason <ja...@in...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I installed sshguard on a machine named 'sshbox' and found that it
failed parsing the syslog entry.  Changing the hostname to something
without 'ssh' in it allowed sshguard to function normally.


root@sshbox:~# sshguard -v
sshguard 1.5.0

Copyright (c) 2007,2008 Mij <mi...@ss...>
This is free software; see the source for conditions on copying.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJQEBDiAAoJEFBPX7xqwa0X9eAIAIXAdX+rbfgTYj1ozABRsT62
iMU089KPTOBkdPBS1PMYMGiD6mauU0z68lS1I0kDE9GqxbYJjLzf83+IzUNDJ5Ly
NgNxym4SkjdpSEkD76MBbMxhDcJU/wUdLGPfT7B+nJxqVQqoYFu5E/dhVJC8NK8I
+ozUq/kO5RMtNEBzROuCoSUxihH0tGqTetkBg+XfPVIhfpX787pLGykQ56FWbZ1m
yyt6Rsa16hBPmHh/4UhIgaK6zcJRQ6gNwUtMGhOZhxesm0+VQKmFk/CaOTkIIkLs
GwM13BBNKmGHATpF8t6T4IPEvumrHTXkkgN6b1WJWI/WDtsgHEIOGUEbXvhsf3Q=
=4R9/
-----END PGP SIGNATURE-----

Re: [Sshguard-users] sshguard 1.5 not recognizing invalid user log messages from sshd on OpenBSD.

[Henry Y. <he...@Ae...>]

On Sun, Jun 24, 2012 at 18:03:28PM -0600, Richard Johnson wrote:
> The quick patch here fixes the recognition problem if I do a direct
> paste of the truncated 'invalid user staff from 122.70.128.5' portion
> into sshguard when it is running in debug mode.

Instead of adding a separate lower-case pattern:

   "Invalid user ".+" from "
   "invalid user ".+" from "

you should be able to specify a case-insensitive pattern:

   (?i:i)"nvalid user ".+" from "

(This is from the linux documentation for "flex" (which is the
flavor of "lex" used in many/most linux systems); I'd assume that
you're unlikely to still be using the original "lex".  I'm no
expert at lex, by the way, but I've used the case-insensitve
option successfully in my own custom patterns.)

> But that patch does not fix the recognition of the pattern within the
> longer lines when running 'sshguard -l /var/log/authlog'.
> 
> It also does not fix recognition of even the truncated portion of the
> line mentioned above when it's appended to a separate log file and
> watched with 'sshguard -l /tmp/truncatedtest'.

For that, I don't know...

-- 
Henry Yen <Hen...@Ae...>               Aegis Information Systems, Inc.
Senior Systems Programmer                       Hicksville, New York
(800) AEGIS-00 x949                             1-800-AEGIS-00 (800-234-4700)

Re: [Sshguard-users] sshguard 1.5 not recognizing invalid user log messages from sshd on OpenBSD.

[Richard J. <rjt...@sa...>]

On Sun, Jun 24, 2012 at 06:03:28PM -0600, Richard Johnson wrote:
> But that patch does not fix the recognition of the pattern within the
> longer lines when running 'sshguard -l /var/log/authlog'.

This looks to be a timestamp issue rather than a more general parsing
problem on the longer lines.

When I feed the log messages a couple per second with accurate timestamps,
sshguard picks up on the simulated brute forcing.

It appears that the patch for allowing a lower case 'i' on 'invalid user'
has given me a working sshguard for ssh brute forcing of nonexistent
users on OpenBSD 5.1.


Richard

[Sshguard-users] sshguard 1.5 not recognizing invalid user log messages from sshd on OpenBSD.

[Richard J. <rjt...@sa...>]

sshguard 1.5 is not recognizing messages in /var/log/authlog from sshd
on an OpenBSD 4.9 or 5.1 system [1] as containing an attack signature.

Apparently, it's been a problem since at least OpenBSD 4.8, per:
http://sourceforge.net/mailarchive/forum.php?thread_name=AE3E9B9A-6376-4572-ACF9-128256676CD9%40sshguard.net&forum_name=sshguard-users

Example messages in /var/log/authlog:

Jun  9 21:46:07 green sshd[28212]: Failed password for invalid user staff from 122.70.128.5 port 35686 ssh2
Jun  9 21:46:07 green sshd[28212]: input_userauth_request: invalid user staff [preauth]
Jun  9 21:46:09 green sshd[19052]: Failed password for invalid user sales from 122.70.128.5 port 37580 ssh2
Jun  9 21:46:09 green sshd[19052]: input_userauth_request: invalid user sales [preauth]
Jun  9 21:46:11 green sshd[16201]: Failed password for invalid user recruit from 122.70.128.5 port 39886 ssh2
Jun  9 21:46:11 green sshd[16201]: input_userauth_request: invalid user recruit [preauth]

Your attack pattern web docs say sshguard is looking for the form:
	Invalid user inexu from 6.6.6.0
and attack_patternsl.l indeed lists an insistence for uppercase 'I' on
the word invalid:
	"Invalid user ".+" from"

The quick patch here fixes the recognition problem if I do a direct
paste of the truncated 'invalid user staff from 122.70.128.5' portion
into sshguard when it is running in debug mode.

--- src/parser/attack_scanner.l.orig	Wed Feb  9 05:01:47 2011
+++ src/parser/attack_scanner.l	Sun Jun 24 17:07:02 2012
@@ -128,6 +128,8 @@
 
  /* SSH: invalid or rejected user (cross platform [generated by openssh]) */
 "Invalid user ".+" from "                         { return SSH_INVALUSERPREF; }
+ /* SSH: invalid or rejected user (cross platform [generated by openssh]) */
+"invalid user ".+" from "                         { return SSH_INVALUSERPREF; }
  /* match disallowed user (not in AllowUsers/AllowGroups or in DenyUsers/DenyGroups) on Linux Ubuntu/FreeBSD */
  /* "User tinydns from 1.2.3.4 not allowed because not listed in AllowUsers" */
 "User ".+" from "                                               { BEGIN(ssh_notallowed); return SSH_NOTALLOWEDPREF; }


But that patch does not fix the recognition of the pattern within the
longer lines when running 'sshguard -l /var/log/authlog'.

It also does not fix recognition of even the truncated portion of the
line mentioned above when it's appended to a separate log file and
watched with 'sshguard -l /tmp/truncatedtest'.

Still, am I at least heading in the right direction?  Is there other
parsing that is too specific to match those sshd authlog entries? 
Thanks!


Richard

-------
[1]
sshd on OpenBSD 5.1:	OpenSSH_6.0, OpenSSL 1.0.0f 4 Jan 2012
sshd on OpenBSD 4.9:	OpenSSH_5.6, OpenSSL 0.9.8k25 Mar 2009

-------
PS - sourceforge mailing list subscription finally came through after I
put the above info here as well:
http://www.sshguard.net/support/submission/detail/37ce7e8f4d7cc1cf7af6/

Re: [Sshguard-users] Patch: windows login and dovecot/pop3

[Fritz Z. <za...@oe...>]

On Fri, 8 Jun 2012, Mij wrote:

> On Jun 5, 2012, at 14:35 , Fritz Zaucker wrote:
>
>> the following patch applied to sshguard 1.5 does
>>
>> a) extend MAX_LOGFILE_LEN to 2000 needed for b)
>> b) recognizes a certain type of Windows Terminal Server 2008 login failure
>> c) recognizes both dovecot imap AND pop3 login attempts
>
> Thank ya

Welcome.

>> Works for me, your mileage might vary. Especially for b) I'd expect
>> "localization", because the Windows messages might appear in different
>> languages.
>
> OMG.
>
> Can anybody check and confirm that Windows localization affects windows
> service logging? Even if that's the case, we'll just go Occam's razor.

It's just a suspicion as we have another Windows Systems logging in German.

>> P.S.: It might be useful to have a HOWTO for adding new attack patterns
>>       (until the next official version of sshguard is published). I am
>>       not really sure if I did it the way it is supposed to be done.
>
> The official howto is:
> Submit on http://www.sshguard.net/support/attacks/submit/ and be patient.

That is a nice offer, however, in an operational environment it is not
feasible to not do something about breakin attempts for a longer time period
if a nice tool is available.

> Adding patterns DYI is fairly simple for programmers, the hardest parts
> are:

> 1) detecting patterns portably across different versions of the OS or
>    daemon

That is something that can of course best be accomblished by you with as
much input from other sites as possible.

> 2) building patterns robust to pumping.
> 3) keeping up the quality of symbol names

I agree that for these reasons it's best that more patterns are introduced
by you.

> You mostly did a good job.

Thanks. What should I have done differently?


I still think that it could be helpful to have a short explanation for
programmers (what to add in which files, what to look out for), as you might
get more input that you then can consolidate.

But as sshguard is cleanly implemented, with some "reverse engineering" and
looking at another patch on the mailing list it was possible to put in the
most urgent patterns in our environment.

> Can you elaborate _which_ services this pattern addresses (e.g.  process
> names), or what detailed event causes them to show up?

I guess, patch c) is clear? Dovecot does provide a pop3 service in addition
to the (probably more used) imap service. The do log failed login attempts
slightly differently and thus need a different pattern for matching (perhaps
it would be better to have two different patterns?).

Patch b) recognizes failed remote login attempts to a Windows 2008
terminal server with the RDP protocol. As I said, I am not sure how generic
this pattern is.

Patch a) is needed as the Windows messages are longer than the 1000
characters defined in sshguard.c.

Cheers,
Fritz

-- 
Oetiker+Partner AG		tel: +41 62 775 9903 (direct)
Fritz Zaucker                        +41 62 775 9900 (switch board)
Aarweg 15                            +41 79 675 0630 (mobile)
CH-4600 Olten                   fax: +41 62 775 9905
Schweiz                         web: www.oetiker.ch