sshguard-users — User questions and answers, bugs, and general support

Re: [Sshguard-users] Email notification, when host is banned

[Mika S. <mik...@ho...>]

On 09.04.2012 06:55, Jo Rhett wrote:
> Look at sec.
> 
> On Apr 7, 2012, at 1:56 AM, Mika Suomalainen wrote:
> Hi,
> 
> Is it possible to set SSHGuard to send email notifications when host
> is banned? Something like what sudo always sends when user isn't on
> sudoers file.
> 
>>
>> ------------------------------------------------------------------------------
>> For Developers, A Lot Can Happen In A Second.
>> Boundary is the first to Know...and Tell You.
>> Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
>> http://p.sf.net/sfu/Boundary-d2dvs2
>> _______________________________________________
>> Sshguard-users mailing list
>> Ssh...@li...
>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
> 

I have looked at the manual page and /etc/default/sshguard and tried
Googling about this.

If you mean PGP/INLINE signature, which is little long due to my key
being 4096 bits long, I have moved to PGP/MIME.

-- 
Mika Suomalainen
gpg --keyserver pool.sks-keyservers.net --recv-keys 4DB53CFE82A46728
Key fingerprint = 24BC 1573 B8EE D666 D10A  AA65 4DB5 3CFE 82A4 6728

Re: [Sshguard-users] Email notification, when host is banned

[Jo R. <jr...@ne...>]

Look at sec.

On Apr 7, 2012, at 1:56 AM, Mika Suomalainen wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 
> Is it possible to set SSHGuard to send email notifications when host
> is banned? Something like what sudo always sends when user isn't on
> sudoers file.
> 
> - -- 
> Mika Suomalainen
>> gpg --keyserver pool.sks-keyservers.net --recv-keys
>> 4DB53CFE82A46728 Key fingerprint = 24BC 1573 B8EE D666 D10A  AA65
>> 4DB5 3CFE 82A4 6728
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.19 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iQIcBAEBAgAGBQJPgAFQAAoJEE21PP6CpGcoXncP/2pgQZMkSPYzE3WQlD3RBUy2
> 4Jb52JVChOXVeeGE5aEOKjDrdgMSyXQLyatGgxP52DFHs7tWw9S9SzVgI43j6hCb
> QkLL0bf27A852WAGBAsGvZOdXTd+ZYhawJmhrI6yzjMl81y6vyME7YGKrXPDZnW1
> osCxqP6ETTtgs2OuMSisMv6gBJ9LYmiNJZAfjf+W9YfyORk7jBDTEw1iEILrLHpd
> XGNFb6ywBsZYC2D6DqRrdaTu8uCSuHXPmacqHvGToobTWg3Xz3ep2US/n99TRfIw
> D8yuPsq7yCIsXINMuNe8qusQZVgX3VDD71ESRcn2Rv7Ye19nG0yMTOsFUzO8929n
> ZttudLA0qGYW1xp4Yv0YGT17UiwyUJ+aXc/WSr3Q7R8us/96a5B5p2p6EQsZ8Gy+
> UKW9UWj/a6MwSradLf/AnEpyLasEHgIlIL+PTSEIHTC8UGvZx+BnN8vrOIKV5PxV
> NcXHPWPvPQdTpp4/KLzywg+JZOMQyVjCYBWZ54YRYov0ehFEmyqSSSPUb812mLJd
> 4jVmuMEXhU63FooPtaaEilpKul1VO23IgJyPLKbV8Y05nJIBzF7Yvb5DgBzXpwoB
> dlwBkEtEW33F55xzXqzf8HifEY+aqUPXDBtxt6x9bxnhYVfoHT3rH51IIIb5xdHV
> 8lcAm78bwA9HHm6759iN
> =J2p6
> -----END PGP SIGNATURE-----
> 
> ------------------------------------------------------------------------------
> For Developers, A Lot Can Happen In A Second.
> Boundary is the first to Know...and Tell You.
> Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
> http://p.sf.net/sfu/Boundary-d2dvs2
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source and other randomness

[Sshguard-users] Email notification, when host is banned

[Mika S. <mik...@ho...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Is it possible to set SSHGuard to send email notifications when host
is banned? Something like what sudo always sends when user isn't on
sudoers file.

- -- 
Mika Suomalainen
> gpg --keyserver pool.sks-keyservers.net --recv-keys
> 4DB53CFE82A46728 Key fingerprint = 24BC 1573 B8EE D666 D10A  AA65
> 4DB5 3CFE 82A4 6728
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPgAFQAAoJEE21PP6CpGcoXncP/2pgQZMkSPYzE3WQlD3RBUy2
4Jb52JVChOXVeeGE5aEOKjDrdgMSyXQLyatGgxP52DFHs7tWw9S9SzVgI43j6hCb
QkLL0bf27A852WAGBAsGvZOdXTd+ZYhawJmhrI6yzjMl81y6vyME7YGKrXPDZnW1
osCxqP6ETTtgs2OuMSisMv6gBJ9LYmiNJZAfjf+W9YfyORk7jBDTEw1iEILrLHpd
XGNFb6ywBsZYC2D6DqRrdaTu8uCSuHXPmacqHvGToobTWg3Xz3ep2US/n99TRfIw
D8yuPsq7yCIsXINMuNe8qusQZVgX3VDD71ESRcn2Rv7Ye19nG0yMTOsFUzO8929n
ZttudLA0qGYW1xp4Yv0YGT17UiwyUJ+aXc/WSr3Q7R8us/96a5B5p2p6EQsZ8Gy+
UKW9UWj/a6MwSradLf/AnEpyLasEHgIlIL+PTSEIHTC8UGvZx+BnN8vrOIKV5PxV
NcXHPWPvPQdTpp4/KLzywg+JZOMQyVjCYBWZ54YRYov0ehFEmyqSSSPUb812mLJd
4jVmuMEXhU63FooPtaaEilpKul1VO23IgJyPLKbV8Y05nJIBzF7Yvb5DgBzXpwoB
dlwBkEtEW33F55xzXqzf8HifEY+aqUPXDBtxt6x9bxnhYVfoHT3rH51IIIb5xdHV
8lcAm78bwA9HHm6759iN
=J2p6
-----END PGP SIGNATURE-----

[Sshguard-users] 60 danger in 4 attacks over 1 seconds (all: 120d in 2 abuses over 15625s).

[Jo R. <jr...@ne...>]

I am running sshguard with the following options.
	root   66430  0.0  0.1  3424  1284  u0  I    10:42PM   0:00.01 /usr/local/sbin/sshguard -a 60 -p 300 -s 1200 -i /var/run/sshguard.pid -l /var/log/auth.log -w /usr/local/etc/sshguard.whitelist

However, I managed to get myself blocked today, which is a matter of two bugs:

Bug 1: seconds counting is broken

Feb  6 22:32:26 triceratops sshguard[62778]: Blocking 99.124.207.89:4 for >0secs: 60 danger in 4 attacks over 1 seconds (all: 120d in 2 abuses over 15625s).

Yes, I had six failed passwords.  Five of them from testing sshguard more than six hours earlier in the day.  Here in the log message you see it saying "1 second" and then reporting 15625 seconds. According to the options above it should have forgotten those attempts after 20 minutes.

# grep 99.124.207.89 /var/log/auth.log
Feb  6 15:12:04 triceratops sshd[62705]: error: PAM: authentication error for jrhett from 99.124.207.89
Feb  6 15:12:04 triceratops sshd[62705]: Failed password for jrhett from 99.124.207.89 port 59757 ssh2
Feb  6 18:12:01 triceratops sshd[64237]: error: PAM: authentication error for jrhett from 99.124.207.89
Feb  6 18:12:01 triceratops sshd[64237]: Failed password for jrhett from 99.124.207.89 port 54602 ssh2
Feb  6 18:23:04 triceratops sshguard[62778]: Blocking 99.124.207.89:4 for >450secs: 60 danger in 4 attacks over 663 seconds (all: 60d in 1 abuses over 663s).
Feb  6 21:12:00 triceratops sshd[65838]: error: PAM: authentication error for jrhett from 99.124.207.89
Feb  6 21:12:00 triceratops sshd[65838]: Failed password for jrhett from 99.124.207.89 port 53494 ssh2
Feb  6 21:38:30 triceratops sshd[65968]: Accepted publickey for jrhett from 99.124.207.89 port 61698 ssh2
Feb  6 21:38:33 triceratops sshd[65970]: Accepted publickey for jrhett from 99.124.207.89 port 61856 ssh2
Feb  6 21:47:43 triceratops sshd[66034]: Accepted publickey for jrhett from 99.124.207.89 port 50779 ssh2
Feb  6 22:32:26 triceratops sshguard[62778]: Blocking 99.124.207.89:4 for >0secs: 60 danger in 4 attacks over 1 seconds (all: 120d in 2 abuses over 15625s).

Bug 2: it timed out an address in the whitelist

If you read the log report carefully, it appears to think it is blocking 99.124.207.89:4 ... not really sure why it thinks :4 is part of the IP address, but this clearly caused it to avoid the whitelist behavior for some reason.  Contents of the whitelist include

# cat /usr/local/etc/sshguard.whitelist
99.124.207.88/29

Platform information:
# uname -a
FreeBSD triceratops.netconsonance.com 8.2-RELEASE-p3 FreeBSD 8.2-RELEASE-p3 #0: Tue Sep 27 18:07:27 UTC 2011     ro...@i3...:/usr/obj/usr/src/sys/GENERIC  i386

For what it is worth, we were running this on CentOS linux at the shop and never saw this problem, so it seems to be related to FreeBSD port in some way.

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source and other randomness

[Sshguard-users] Push to multiple hosts/firewalls?

[Nick G. <ga...@su...>]

We're looking to setup sshguard on our central syslog server and have
sshgaurd dynamically change the firewall rules on multiple hosts
(running iptables), thus reducing the ability for an attacker to walk
our IP ranges.

Has anyone attempted a configuration like this before, or does anyone
have thoughts on how we should proceed?

-Nick

--
Nicholas P. Gasparovich
Systems Administrator
Technology Integration Services
SUNY Institute of Technology
Utica, New York 13504-3050

[Sshguard-users] Logging of sshguard itself: logfile with succesful blocks

[Karlo L. <ma...@ka...>]

Hello all,

I installed and configured sshguard on a freeBSD machine. So far so
good.

I'd like to know how I can get sshguard to log the blocks that are made.

Is this possible?
Thanks,
Karlo

[Sshguard-users] Dovecot/PAM attacks not detected

[Alberto G. B. <aba...@ia...>]

Hi Everybody,

I succeeded in configuring sshguard to block attacks on sshd and vsftpd, but I still have problems with dovecot. According to the sshguard website, the attack signature for dovecot, should look like this:

imap-login: Aborted login (auth failed, 6 attempts): XYZ rip=6.6.6.0, lip=127.0.0.1

However, I tried different dovecot settings and I am unable to let him produce the above line. The best I got is the following, in /var/log/secure:

Nov 11 11:11:11 xxx dovecot-auth: pam_unix(dovecot:auth): check pass; user unknown
Nov 11 11:11:11 xxx dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=X.X.X.X
Nov 11 11:11:11 xxx dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user daniela

and the following in /var/log/mail/dovecot.log

dovecot: Nov 11 11:11:11 Info: auth(default): pam(daniela,X.X.X.X): pam_authenticate() failed: User not known to the underlying authentication module

Unfortunately, neither of the these signatures are detected as attacks by sshguard. I am running a CentOS 5.7 box with dovecot 1.0.7. Any help is greatly appreciated.

TIA,

Alberto

[Sshguard-users] Does the whitelist override an entry in the blacklist?

[Ginter, M. <Mik...@ep...>]

I have an internal user that got his IP address added to my blacklist.  I've added the IP address to the whitelist, but he still can't access the server.  Does the whitelist override the blacklist?  Can blacklist entries be removed?

Thanks in advance.

________________________________
This e-mail and files transmitted with it are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you are not one of the named recipient(s) or otherwise have reason to believe that you received this message in error, please immediately notify sender by e-mail, and destroy the original message. Thank You.

Re: [Sshguard-users] abort when reinstating blacklist on OS X

[Jin C. <jin...@me...>]

I looked into this a little further. It looks like the code actually expects that this might be a problem; line 135 of ipfw.c in fw_block() has the comment
    /* insert rules under this rule number (in chunks of max_addresses_per_rule) */
but there is no code to actually break the number of addresses up into chunks, nor is there mention of max_addresses_per_rule anywhere else in the codebase. So as soon as you get more blacklisted users than the system limit, which appears to be 15 for me (OS X Lion), sshguard will fail to start up properly. 

I've attached a patch which implements the chunking, which works for me. Please consider it.

Re: [Sshguard-users] sshguard: breaks if inode is too big

[Mij <mi...@ss...>]

Committed in r231, thanks!

Re: [Sshguard-users] sshguard: breaks if inode is too big

[Julián M. P. <dar...@gm...>]

Hi,

Sorry, the previous link is wrong, please see:

http://bugs.debian.org/642097

Kind regards,

-- 
Julián Moreno Patiño
 .''`. Debian GNU/{Linux,KfreeBSD}
: :' : Free Operating Systems
`. `'  http://debian.org/
  `-   PGP KEY ID 6168BF60
Registered GNU Linux User ID 488513

[Sshguard-users] sshguard: breaks if inode is too big

[Julián M. P. <dar...@gm...>]

Hi Mij,

A bug[0] was filed in GNU Debian with a patch and I'd like to know what do
you think about it ?

[0] http://bugs.debian.org/642097<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642097>

PS: if you want you can reply in 642097 at bugs dot debian dot org

Kind regards,

-- 
Julián Moreno Patiño
 .''`. Debian GNU/{Linux,KfreeBSD}
: :' : Free Operating Systems
`. `'  http://debian.org/
  `-   PGP KEY ID 6168BF60
Registered GNU Linux User ID 488513

Re: [Sshguard-users] File '/var/log/secure' vanished while adding!

[Armando <arm...@st...>]

Hi John

On Tue, Jul 05, 2011 at 12:24:39PM -0700, John T. Yocum wrote:
> I keep getting the error "File '/var/log/secure' vanished while adding!" 
> and similar for any log file I try to get sshguard to monitor. The log 
> files aren't actually vanishing, they are still a few days old in each 
> case. I'm running CentOS 5.6 64bit, if that makes a difference. Any 
> ideas would be appreciated.

I am trying to replicate your problem on a CentOS 5.6 64bit but I would
like to ask you few questions:
a) do you have special configuration parameters?
b) what versione of sshguard have you installed? Is it compiled or
   have you used some particular package?
c) is your CentOS updated?
d) does this problem happen only when there is the rotation of the log
   or does it happen more frequently?

Thanks for now.
Cheers,
Armando

Re: [Sshguard-users] Hook script

[Armando <arm...@st...>]

Hi Cedric,

I will talk to Michele about this and take it on. The firewall
backends have something similar already (see
http://sshguard.svn.sourceforge.net/viewvc/sshguard/trunk/src/fwalls/)
but it's not easily at hand for the user.

We will see what we can do for it :)

bye for now.
Cheers,
Armando Miraglia

On Tue, Oct 11, 2011 at 11:45:07AM +0200, Cedric Jeanneret wrote:
> Hello !
> 
> I'm wanting to switch from fail2ban to sshguard, but I see ONE thing 
> missing: hooks.
> 
> with fail2ban, I was able to record the ban in a postgresql database, 
> and thus getting some stats (which IP was banned, where it comes from, 
> ban per days and so on).
> 
> Will it be possible to have an option like "--hook /path/to/script", 
> and sshguard passing those kind of arguments to ARGV:
> IP, port, action (simple ban, unban, black list)
> 
> This may really be cool, as this will allow anyone to log, or, why not, 
> trigger some firewall stuff, or email, or....
> 
> Thanks in advance, and thank you for this nice tool :)
> 
> Cheers,
> 
> C.
> 
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2d-oct
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] abort when reinstating blacklist on OS X

[Jin C. <js...@al...>]

I was just checking my sshguard installation, and it looks like it's been consistently aborting and restarting for the last few days. I dug into it, and it appears that ipfw doesn't like to take more than 15 arguments in an address list on OS X (Lion)


#0  0x00007fff8903a82a in __kill ()
(gdb) where
#0  0x00007fff8903a82a in __kill ()
#1  0x00007fff8b0f7a9c in abort ()
#2  0x00007fff8b12a5de in __assert_rtn ()
#3  0x000000010ba6b97a in ipfwmod_buildblockcommand (ruleno=55042, addresses=0x10bb017f0, addrkind=6, command=0x10baa5e40 "/sbin/ipfw", args=0x10baa5ea0 "add 55043 drop ip from 157.253.195.193,62.76.41.77,222.134.33.132,121.61.118.112,62.150.149.87,95.173.187.38,193.109.162.121,31.3.235.2,202.78.239.203,202.75.218.139,8.25.218.88,221.207.229.6,78.189.1"...) at ipfw.c:291
#4  0x000000010ba6afa8 in fw_block_list (addresses=0x10bb017f0, addrkind=6, service_codes=0x10bb018a0) at ipfw.c:134
#5  0x000000010ba5d08f in process_blacklisted_addresses () at sshguard.c:570
#6  0x000000010ba5bb47 in main (argc=5, argv=0x7fff6b658c60) at sshguard.c:207



# /sbin/ipfw add 55043 drop ip from 157.253.195.193,62.76.41.77,222.134.33.132,121.61.118.112,62.150.149.87,95.173.187.38,193.109.162.121,31.3.235.2,202.78.239.203,202.75.218.139,8.25.218.88,221.207.229.6,78.189.106.136,218.108.0.91,195.228.135.138,220.172.191.31 to me
ipfw: getsockopt(IP_FW_ADD): Invalid argument


Running it with one fewer address works. Has anyone else run into this problem, and have a workaround?

Re: [Sshguard-users] Pre-scanning disconnects

[Mij <mi...@ss...>]

On Oct 3, 2011, at 18:18 , Jin Choi wrote:

> I'm seeing recent attacks where there are a number of disconnects before the scan takes place, of the form:
> Received disconnect from x.x.x.x: 11: Bye Bye
> 
> I don't know what hole this is targeting, but can sshguard be modified to handle this behavior as well?

I suggest you file a pattern with danger "noise" or "whinge" on
http://www.sshguard.net/support/attacks/submit/ .
It's hard to tell these apart as attacks, but a suitable danger level
can deliver.

Re: [Sshguard-users] Read blacklist.db

[Cedric J. <ssh...@te...>]

Hello again!

thank you for your answer - I'll have a look at gentoo overlays to see 
if there's some -9999 ebuild.

Cheers,

C.

On Wed, 12 Oct 2011 13:31:50 +0200, Mij wrote:
> On Oct 12, 2011, at 13:21 , Cedric Jeanneret wrote:
>
>> Hello!
>>
>> How can I read and edit the blacklist db file ? While doing "file
>> sshguard.db", it tells me it's some odd "raw G3 data, byte-padded",
>> which seems to be used for fax content... I'me guessing that's not 
>> true.
>
> In sshguard-1.5 blacklists are in SimCList serialization format, 
> which is
> binary (see http://mij.oltrelinux.com/devel/simclist/ ).
>
> In a recent commit on the SVN, blacklists are stored in 
> human-readable
> format. Wait some weeks for have that appear in a release, or compile
> the sources from the SVN as described in
> http://www.sshguard.net/docs/setup/compile-install/#fetch-code
>
>
>> My final goal is to be able to get blacklisted addresses (and all 
>> datas
>> I can get from this DB) to do some stats.
>
> You can extract the IPs with a command such as:
>
> strings /path/to/blacklist | grep -Eo "([0-9]+\.){3}[0-9]+"
>
> For extracting IPv6 addresses check out the regex in the sshguard 
> sources.
>
> 
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure 
> contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and 
> makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2d-oct
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] Read blacklist.db

[Mij <mi...@ss...>]

On Oct 12, 2011, at 13:21 , Cedric Jeanneret wrote:

> Hello!
> 
> How can I read and edit the blacklist db file ? While doing "file 
> sshguard.db", it tells me it's some odd "raw G3 data, byte-padded", 
> which seems to be used for fax content... I'me guessing that's not true.

In sshguard-1.5 blacklists are in SimCList serialization format, which is
binary (see http://mij.oltrelinux.com/devel/simclist/ ).

In a recent commit on the SVN, blacklists are stored in human-readable
format. Wait some weeks for have that appear in a release, or compile
the sources from the SVN as described in
http://www.sshguard.net/docs/setup/compile-install/#fetch-code


> My final goal is to be able to get blacklisted addresses (and all datas 
> I can get from this DB) to do some stats.

You can extract the IPs with a command such as:

strings /path/to/blacklist | grep -Eo "([0-9]+\.){3}[0-9]+"

For extracting IPv6 addresses check out the regex in the sshguard sources.

Re: [Sshguard-users] default blacklist threshold given incorrectly in manual

[Mij <mi...@ss...>]

Committed in r230, thanks for reporting.

The man page on the website is not updated. Reason: all tools I am aware
of for generating HTML from troff (man) suck. The current HTML is a manual
tweak of code generated by manServer.

Solutions:
* some folks contribute a decent interpreter for the basic troff constructs,
should take less than a day with python Yaps or LEPL
* we convert docs to reStructuredText or docbook and generate all
(troff and html) from there

[Sshguard-users] Read blacklist.db

[Cedric J. <ssh...@te...>]

Hello!

How can I read and edit the blacklist db file ? While doing "file 
sshguard.db", it tells me it's some odd "raw G3 data, byte-padded", 
which seems to be used for fax content... I'me guessing that's not true.

My final goal is to be able to get blacklisted addresses (and all datas 
I can get from this DB) to do some stats.

Thank you!

Cheers,

C.

Re: [Sshguard-users] Issues compiling 1.5

[Mij <mi...@ss...>]

r229 on the SVN contains a patch for compilers that do not support C99.
Compilers with partial/broken support may still fail.

Re: [Sshguard-users] SSHguard 1.5 compile error

[Mij <mi...@ss...>]

Hi Peter,

Looks like this version of gcc has broken support for C99.

I'll consider addressing this in the future, but for the moment it will yield
priority to other tasks, since users with gcc version 3 are very few and
diminishing.

Re: [Sshguard-users] sshguard blocks my IP after one failed password attempt!

[Mij <mi...@ss...>]

Hi Anne

Some pretty good troubleshooting you did there :)

Julian, the debian maintainer, appears to have addressed this in v1.5-4, see
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=638225

Re: [Sshguard-users] sshguard 1.5 abort on startup with -b

[Mij <mi...@ss...>]

Hi Jim,

Thanks for this report. Addressed in r226.

[Sshguard-users] Hook script

[Cedric J. <ssh...@te...>]

Hello !

I'm wanting to switch from fail2ban to sshguard, but I see ONE thing 
missing: hooks.

with fail2ban, I was able to record the ban in a postgresql database, 
and thus getting some stats (which IP was banned, where it comes from, 
ban per days and so on).

Will it be possible to have an option like "--hook /path/to/script", 
and sshguard passing those kind of arguments to ARGV:
IP, port, action (simple ban, unban, black list)

This may really be cool, as this will allow anyone to log, or, why not, 
trigger some firewall stuff, or email, or....

Thanks in advance, and thank you for this nice tool :)

Cheers,

C.