sshguard-users — User questions and answers, bugs, and general support

[Sshguard-users] Dovecot/PAM attacks not detected

[Alberto G. B. <aba...@ia...>]

Hi Everybody,

I succeeded in configuring sshguard to block attacks on sshd and vsftpd, but I still have problems with dovecot. According to the sshguard website, the attack signature for dovecot, should look like this:

imap-login: Aborted login (auth failed, 6 attempts): XYZ rip=6.6.6.0, lip=127.0.0.1

However, I tried different dovecot settings and I am unable to let him produce the above line. The best I got is the following, in /var/log/secure:

Nov 11 11:11:11 xxx dovecot-auth: pam_unix(dovecot:auth): check pass; user unknown
Nov 11 11:11:11 xxx dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=X.X.X.X
Nov 11 11:11:11 xxx dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user daniela

and the following in /var/log/mail/dovecot.log

dovecot: Nov 11 11:11:11 Info: auth(default): pam(daniela,X.X.X.X): pam_authenticate() failed: User not known to the underlying authentication module

Unfortunately, neither of the these signatures are detected as attacks by sshguard. I am running a CentOS 5.7 box with dovecot 1.0.7. Any help is greatly appreciated.

TIA,

Alberto

[Sshguard-users] Does the whitelist override an entry in the blacklist?

[Ginter, M. <Mik...@ep...>]

I have an internal user that got his IP address added to my blacklist.  I've added the IP address to the whitelist, but he still can't access the server.  Does the whitelist override the blacklist?  Can blacklist entries be removed?

Thanks in advance.

________________________________
This e-mail and files transmitted with it are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you are not one of the named recipient(s) or otherwise have reason to believe that you received this message in error, please immediately notify sender by e-mail, and destroy the original message. Thank You.

Re: [Sshguard-users] abort when reinstating blacklist on OS X

[Jin C. <jin...@me...>]

I looked into this a little further. It looks like the code actually expects that this might be a problem; line 135 of ipfw.c in fw_block() has the comment
    /* insert rules under this rule number (in chunks of max_addresses_per_rule) */
but there is no code to actually break the number of addresses up into chunks, nor is there mention of max_addresses_per_rule anywhere else in the codebase. So as soon as you get more blacklisted users than the system limit, which appears to be 15 for me (OS X Lion), sshguard will fail to start up properly. 

I've attached a patch which implements the chunking, which works for me. Please consider it.

Re: [Sshguard-users] sshguard: breaks if inode is too big

[Mij <mi...@ss...>]

Committed in r231, thanks!

Re: [Sshguard-users] sshguard: breaks if inode is too big

[Julián M. P. <dar...@gm...>]

Hi,

Sorry, the previous link is wrong, please see:

http://bugs.debian.org/642097

Kind regards,

-- 
Julián Moreno Patiño
 .''`. Debian GNU/{Linux,KfreeBSD}
: :' : Free Operating Systems
`. `'  http://debian.org/
  `-   PGP KEY ID 6168BF60
Registered GNU Linux User ID 488513

[Sshguard-users] sshguard: breaks if inode is too big

[Julián M. P. <dar...@gm...>]

Hi Mij,

A bug[0] was filed in GNU Debian with a patch and I'd like to know what do
you think about it ?

[0] http://bugs.debian.org/642097<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642097>

PS: if you want you can reply in 642097 at bugs dot debian dot org

Kind regards,

-- 
Julián Moreno Patiño
 .''`. Debian GNU/{Linux,KfreeBSD}
: :' : Free Operating Systems
`. `'  http://debian.org/
  `-   PGP KEY ID 6168BF60
Registered GNU Linux User ID 488513

Re: [Sshguard-users] File '/var/log/secure' vanished while adding!

[Armando <arm...@st...>]

Hi John

On Tue, Jul 05, 2011 at 12:24:39PM -0700, John T. Yocum wrote:
> I keep getting the error "File '/var/log/secure' vanished while adding!" 
> and similar for any log file I try to get sshguard to monitor. The log 
> files aren't actually vanishing, they are still a few days old in each 
> case. I'm running CentOS 5.6 64bit, if that makes a difference. Any 
> ideas would be appreciated.

I am trying to replicate your problem on a CentOS 5.6 64bit but I would
like to ask you few questions:
a) do you have special configuration parameters?
b) what versione of sshguard have you installed? Is it compiled or
   have you used some particular package?
c) is your CentOS updated?
d) does this problem happen only when there is the rotation of the log
   or does it happen more frequently?

Thanks for now.
Cheers,
Armando

Re: [Sshguard-users] Hook script

[Armando <arm...@st...>]

Hi Cedric,

I will talk to Michele about this and take it on. The firewall
backends have something similar already (see
http://sshguard.svn.sourceforge.net/viewvc/sshguard/trunk/src/fwalls/)
but it's not easily at hand for the user.

We will see what we can do for it :)

bye for now.
Cheers,
Armando Miraglia

On Tue, Oct 11, 2011 at 11:45:07AM +0200, Cedric Jeanneret wrote:
> Hello !
> 
> I'm wanting to switch from fail2ban to sshguard, but I see ONE thing 
> missing: hooks.
> 
> with fail2ban, I was able to record the ban in a postgresql database, 
> and thus getting some stats (which IP was banned, where it comes from, 
> ban per days and so on).
> 
> Will it be possible to have an option like "--hook /path/to/script", 
> and sshguard passing those kind of arguments to ARGV:
> IP, port, action (simple ban, unban, black list)
> 
> This may really be cool, as this will allow anyone to log, or, why not, 
> trigger some firewall stuff, or email, or....
> 
> Thanks in advance, and thank you for this nice tool :)
> 
> Cheers,
> 
> C.
> 
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2d-oct
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] abort when reinstating blacklist on OS X

[Jin C. <js...@al...>]

I was just checking my sshguard installation, and it looks like it's been consistently aborting and restarting for the last few days. I dug into it, and it appears that ipfw doesn't like to take more than 15 arguments in an address list on OS X (Lion)


#0  0x00007fff8903a82a in __kill ()
(gdb) where
#0  0x00007fff8903a82a in __kill ()
#1  0x00007fff8b0f7a9c in abort ()
#2  0x00007fff8b12a5de in __assert_rtn ()
#3  0x000000010ba6b97a in ipfwmod_buildblockcommand (ruleno=55042, addresses=0x10bb017f0, addrkind=6, command=0x10baa5e40 "/sbin/ipfw", args=0x10baa5ea0 "add 55043 drop ip from 157.253.195.193,62.76.41.77,222.134.33.132,121.61.118.112,62.150.149.87,95.173.187.38,193.109.162.121,31.3.235.2,202.78.239.203,202.75.218.139,8.25.218.88,221.207.229.6,78.189.1"...) at ipfw.c:291
#4  0x000000010ba6afa8 in fw_block_list (addresses=0x10bb017f0, addrkind=6, service_codes=0x10bb018a0) at ipfw.c:134
#5  0x000000010ba5d08f in process_blacklisted_addresses () at sshguard.c:570
#6  0x000000010ba5bb47 in main (argc=5, argv=0x7fff6b658c60) at sshguard.c:207



# /sbin/ipfw add 55043 drop ip from 157.253.195.193,62.76.41.77,222.134.33.132,121.61.118.112,62.150.149.87,95.173.187.38,193.109.162.121,31.3.235.2,202.78.239.203,202.75.218.139,8.25.218.88,221.207.229.6,78.189.106.136,218.108.0.91,195.228.135.138,220.172.191.31 to me
ipfw: getsockopt(IP_FW_ADD): Invalid argument


Running it with one fewer address works. Has anyone else run into this problem, and have a workaround?

Re: [Sshguard-users] Pre-scanning disconnects

[Mij <mi...@ss...>]

On Oct 3, 2011, at 18:18 , Jin Choi wrote:

> I'm seeing recent attacks where there are a number of disconnects before the scan takes place, of the form:
> Received disconnect from x.x.x.x: 11: Bye Bye
> 
> I don't know what hole this is targeting, but can sshguard be modified to handle this behavior as well?

I suggest you file a pattern with danger "noise" or "whinge" on
http://www.sshguard.net/support/attacks/submit/ .
It's hard to tell these apart as attacks, but a suitable danger level
can deliver.

Re: [Sshguard-users] Read blacklist.db

[Cedric J. <ssh...@te...>]

Hello again!

thank you for your answer - I'll have a look at gentoo overlays to see 
if there's some -9999 ebuild.

Cheers,

C.

On Wed, 12 Oct 2011 13:31:50 +0200, Mij wrote:
> On Oct 12, 2011, at 13:21 , Cedric Jeanneret wrote:
>
>> Hello!
>>
>> How can I read and edit the blacklist db file ? While doing "file
>> sshguard.db", it tells me it's some odd "raw G3 data, byte-padded",
>> which seems to be used for fax content... I'me guessing that's not 
>> true.
>
> In sshguard-1.5 blacklists are in SimCList serialization format, 
> which is
> binary (see http://mij.oltrelinux.com/devel/simclist/ ).
>
> In a recent commit on the SVN, blacklists are stored in 
> human-readable
> format. Wait some weeks for have that appear in a release, or compile
> the sources from the SVN as described in
> http://www.sshguard.net/docs/setup/compile-install/#fetch-code
>
>
>> My final goal is to be able to get blacklisted addresses (and all 
>> datas
>> I can get from this DB) to do some stats.
>
> You can extract the IPs with a command such as:
>
> strings /path/to/blacklist | grep -Eo "([0-9]+\.){3}[0-9]+"
>
> For extracting IPv6 addresses check out the regex in the sshguard 
> sources.
>
> 
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure 
> contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and 
> makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2d-oct
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] Read blacklist.db

[Mij <mi...@ss...>]

On Oct 12, 2011, at 13:21 , Cedric Jeanneret wrote:

> Hello!
> 
> How can I read and edit the blacklist db file ? While doing "file 
> sshguard.db", it tells me it's some odd "raw G3 data, byte-padded", 
> which seems to be used for fax content... I'me guessing that's not true.

In sshguard-1.5 blacklists are in SimCList serialization format, which is
binary (see http://mij.oltrelinux.com/devel/simclist/ ).

In a recent commit on the SVN, blacklists are stored in human-readable
format. Wait some weeks for have that appear in a release, or compile
the sources from the SVN as described in
http://www.sshguard.net/docs/setup/compile-install/#fetch-code


> My final goal is to be able to get blacklisted addresses (and all datas 
> I can get from this DB) to do some stats.

You can extract the IPs with a command such as:

strings /path/to/blacklist | grep -Eo "([0-9]+\.){3}[0-9]+"

For extracting IPv6 addresses check out the regex in the sshguard sources.

Re: [Sshguard-users] default blacklist threshold given incorrectly in manual

[Mij <mi...@ss...>]

Committed in r230, thanks for reporting.

The man page on the website is not updated. Reason: all tools I am aware
of for generating HTML from troff (man) suck. The current HTML is a manual
tweak of code generated by manServer.

Solutions:
* some folks contribute a decent interpreter for the basic troff constructs,
should take less than a day with python Yaps or LEPL
* we convert docs to reStructuredText or docbook and generate all
(troff and html) from there

[Sshguard-users] Read blacklist.db

[Cedric J. <ssh...@te...>]

Hello!

How can I read and edit the blacklist db file ? While doing "file 
sshguard.db", it tells me it's some odd "raw G3 data, byte-padded", 
which seems to be used for fax content... I'me guessing that's not true.

My final goal is to be able to get blacklisted addresses (and all datas 
I can get from this DB) to do some stats.

Thank you!

Cheers,

C.

Re: [Sshguard-users] Issues compiling 1.5

[Mij <mi...@ss...>]

r229 on the SVN contains a patch for compilers that do not support C99.
Compilers with partial/broken support may still fail.

Re: [Sshguard-users] SSHguard 1.5 compile error

[Mij <mi...@ss...>]

Hi Peter,

Looks like this version of gcc has broken support for C99.

I'll consider addressing this in the future, but for the moment it will yield
priority to other tasks, since users with gcc version 3 are very few and
diminishing.

Re: [Sshguard-users] sshguard blocks my IP after one failed password attempt!

[Mij <mi...@ss...>]

Hi Anne

Some pretty good troubleshooting you did there :)

Julian, the debian maintainer, appears to have addressed this in v1.5-4, see
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=638225

Re: [Sshguard-users] sshguard 1.5 abort on startup with -b

[Mij <mi...@ss...>]

Hi Jim,

Thanks for this report. Addressed in r226.

[Sshguard-users] Hook script

[Cedric J. <ssh...@te...>]

Hello !

I'm wanting to switch from fail2ban to sshguard, but I see ONE thing 
missing: hooks.

with fail2ban, I was able to record the ban in a postgresql database, 
and thus getting some stats (which IP was banned, where it comes from, 
ban per days and so on).

Will it be possible to have an option like "--hook /path/to/script", 
and sshguard passing those kind of arguments to ARGV:
IP, port, action (simple ban, unban, black list)

This may really be cool, as this will allow anyone to log, or, why not, 
trigger some firewall stuff, or email, or....

Thanks in advance, and thank you for this nice tool :)

Cheers,

C.

[Sshguard-users] sshguard goes into a loop after log rollover on netbsd-4

[Greg A. W. <wo...@pl...>]

SSHGuard-1.5 seems to go into an infinite loop at some point, when a log
file it is watching with "-l" is archived and re-created.

It does not appear to be reading new entries from the log, and totally
missed an SSH attack, plus secondary manual testing.

This is on NetBSD-4.  HAVE_KQUEUE is defined.

I've reconfigured to drive it on STDIN directly from syslogd for now,
but I'd rather have it watch the log file as a daemon than have to feed
it from syslogd.  I guess I could use "tail -F" which is reliable and
working on NetBSD (and which also uses kqueue).  Perhaps SSHGuard has
too many features and really should rely on something like "tail -F",
though unfortunately "tail -F" only works on one file at a time on
many(most/all?) platforms. 

BTW, you'll see that after I detach from it with gdb the CPU use drops,
but still does not go down to a reasonable level, and it still continues
to ignore new entries in the log file.

12:38 [2267] # /etc/rc.d/sshguard status 
sshguard is running as pid 20463.
USER   PID %CPU %MEM   VSZ  RSS TTY STAT STARTED      TIME COMMAND
root 20463 99.7  0.0 61792 1088 ?   Rsa   8:12PM 985:56.51 /usr/local/sbin/sshguard -w 10.0.0.0/8 -w XXX.XXX.XXX.0/24 -l /var/log/au
12:39 [2268] # gdb /usr/local/sbin/sshguard 20463 
[GDB will not be able to debug user-mode threads: Service unavailable]
GNU gdb 6.5
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386--netbsdelf"...
Attaching to program: /usr/local/sbin/sshguard, process 20463
Reading symbols from /usr/lib/libpthread.so.0...done.
Loaded symbols for /usr/lib/libpthread.so.0
Reading symbols from /usr/lib/libc.so.12...done.
Loaded symbols for /usr/lib/libc.so.12
Reading symbols from /usr/libexec/ld.elf_so...done.
Loaded symbols for /usr/libexec/ld.elf_so
0xbbb22937 in kevent () from /usr/lib/libc.so.12
(gdb) where
#0  0xbbb22937 in kevent () from /usr/lib/libc.so.12
#1  0x0804c742 in logsuck_getline (buf=0xbfbfdcac "", buflen=1000, from_previous_source=false, whichsource=0xbfbfe0d0)
    at sshguard_logsuck.c:240
#2  0x08049d6f in main (argc=74524, argv=0xbbbed400) at sshguard.c:255
(gdb) cont
Continuing.
^?
Program received signal SIGINT, Interrupt.
0xbbb22937 in kevent () from /usr/lib/libc.so.12
(gdb) where
#0  0xbbb22937 in kevent () from /usr/lib/libc.so.12
#1  0x0804c742 in logsuck_getline (buf=0xbfbfdcac "", buflen=1000, from_previous_source=false, whichsource=0xbfbfe0d0)
    at sshguard_logsuck.c:240
#2  0x08049d6f in main (argc=74524, argv=0xbbbed400) at sshguard.c:255
(gdb) quit
The program is running.  Quit anyway (and detach it)? (y or n) y
Detaching from program: /usr/local/sbin/sshguard, process 20463
12:39 [2269] # /etc/rc.d/sshguard status          
sshguard is running as pid 20463.
USER   PID %CPU %MEM   VSZ  RSS TTY STAT STARTED      TIME COMMAND
root 20463 40.8  0.0 61792 1084 ?   Rsa   8:12PM 986:18.74 /usr/local/sbin/sshguard -w 10.0.0.0/8 -w XXX.XXX.XXX.0/24 -l /var/log/au
12:39 [2270] # /etc/rc.d/sshguard status 
sshguard is running as pid 20463.
USER   PID %CPU %MEM   VSZ  RSS TTY STAT STARTED      TIME COMMAND
root 20463 43.7  0.0 61792 1084 ?   Rsa   8:12PM 986:20.04 /usr/local/sbin/sshguard -w 10.0.0.0/8 -w XXX.XXX.XXX.0/24 -l /var/log/au
12:39 [2271] # /etc/rc.d/sshguard status 
sshguard is running as pid 20463.
USER   PID %CPU %MEM   VSZ  RSS TTY STAT STARTED      TIME COMMAND
root 20463 49.0  0.0 61792 1084 ?   Rsa   8:12PM 986:21.64 /usr/local/sbin/sshguard -w 10.0.0.0/8 -w XXX.XXX.XXX.0/24 -l /var/log/au

-- 
						Greg A. Woods

+1 250 762-7675                                RoboHack <wo...@ro...>
Planix, Inc. <wo...@pl...>      Secrets of the Weird <wo...@we...>

Re: [Sshguard-users] imaps is not blocked

[Mij <mi...@ss...>]

Hi Krzysztof,

As you notice, the pattern we have for dovecot is the latter. What version of dovecot
produces your pattern? Please file a submission for the new pattern at

http://www.sshguard.net/support/attacks/submit/

Re: [Sshguard-users] log file list

[Mij <mi...@ss...>]

Hi Bradley


> Is there a place to search the mailing list archives vs browsing them?
> This is where I have looked:
> http://sourceforge.net/mailarchive/forum.php?set=custom&viewmonth=&viewday=&forum_name=sshguard-users&style=ultimate&max_rows=25&submit=Change+View

Correct. From there, follow "Mailing Lists" > "Search Mail Lists" in the upper bar.


> My question, is it currently possible to sshguard read a list of log files from a conf file as an alternative/addition to using "-l file.log" when starting sshguard?

Not yet, I'll write it down among the feature requests.

[Sshguard-users] Pre-scanning disconnects

[Jin C. <js...@al...>]

I'm seeing recent attacks where there are a number of disconnects before the scan takes place, of the form:
Received disconnect from x.x.x.x: 11: Bye Bye

I don't know what hole this is targeting, but can sshguard be modified to handle this behavior as well?

[Sshguard-users] default blacklist threshold given incorrectly in manual

[Jin C. <js...@al...>]

man sshguard says

     -b [thresh:]filename
              enable blacklisting: blacklist after thresh (or 40) dangerousness committed, and hold
              the permanent blacklist in filename.  See TOUCHINESS & BLACKLISTING below.

But the source actually defines
#define DEFAULT_BLACKLIST_THRESHOLD (3 * DEFAULT_ABUSE_THRESHOLD)

So, 120. The manual should reflect that.

Re: [Sshguard-users] sshguard on OpenBSD 4.8

[Mij <mi...@ss...>]

Ciao Pietro,

On Apr 27, 2011, at 23:25 , Pietro Leone wrote:

> I do not understand how logsucker works, if I do not provide any log files 
> throught "-l" option ssh work with defaults log files?

No, it defaults to standard input.


> I tried launching sshguard in rc.local:
> 
> /usr/local/sbin/sshguard -l /var/log/authlog -l /var/log/secure
> 
> How can I be sure that sshguard is working?

SSHGuard logs some messages at start-up, you can grep your logs e.g. for
"Started successfully". They are all LOG_AUTH facility, which syslog typically
sends to /var/log/auth*


> But sshguard does not block any address.
> 
> How can I do?

For further details see http://www.sshguard.net/docs/faqs/#does-not-work .