sshguard-users — User questions and answers, bugs, and general support

Re: [Sshguard-users] [Sshguard-maintainers] Not catching failed passwords

[Mij <mi...@bi...>]

On 20/ott/07, at 18:49, Forrest Aldrich wrote:

> sshguard is not catching failed password attempts for "valid" users:
>
> Oct 20 10:10:56 gw sshd[86897]: Failed password for root from  
> 80.93.212.74 port 53760 ssh2
> Oct 20 10:10:57 gw sshd[86899]: Failed password for root from  
> 80.93.212.74 port 53839 ssh2
> Oct 20 10:10:59 gw sshd[86901]: Failed password for root from  
> 80.93.212.74 port 53913 ssh2
> Oct 20 10:11:01 gw sshd[86903]: Failed password for root from  
> 80.93.212.74 port 53985 ssh2
> Oct 20 10:11:02 gw sshd[86918]: Failed password for root from  
> 80.93.212.74 port 54060 ssh2
> Oct 20 10:11:04 gw sshd[86920]: Failed password for root from  
> 80.93.212.74 port 54146 ssh2
> Oct 20 10:11:05 gw sshd[86922]: Failed password for root from  
> 80.93.212.74 port 54217 ssh2
> Oct 20 10:11:07 gw sshd[86924]: Invalid user administrator from  
> 80.93.212.74
> Oct 20 10:11:07 gw sshd[86924]: Failed password for invalid user  
> administrator from 80.93.212.74 port 54290 ssh2
> Oct 20 10:11:09 gw sshd[86926]: Invalid user administrator from  
> 80.93.212.74
> Oct 20 10:11:09 gw sshd[86926]: Failed password for invalid user  
> administrator from 80.93.212.74 port 54369 ssh2
> Oct 20 10:11:10 gw sshd[86928]: Invalid user administrator from  
> 80.93.212.74
> Oct 20 10:11:10 gw sshd[86928]: Failed password for invalid user  
> administrator from 80.93.212.74 port 54444 ssh2
> Oct 20 10:11:12 gw sshd[86930]: Invalid user administrator from  
> 80.93.212.74
> Oct 20 10:11:12 gw sshguard[85248]: Blocking 80.93.212.74: X  
> failures over X seconds.
>
> But it catches an invalid user.   It should be especially sensitive  
> of the failed root password attempts.  Even though I do not allow  
> root logins.

this is strange. Would you try running sshguard in debug mode (-d),  
inject the "failed password" strings
and see if sshguard reacts (it should) and when it gets to 4 failed  
attempts, if it runs the blocking command
(it should) and if it fails what it tells

Re: [Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Mij <mi...@bi...>]

On 04/ott/07, at 23:14, Steve Ochani wrote:

> I'm guessing that the program is looking for a different string to  
> watch out for in the logs but
> there is no config file to change that string.

this is correct. Might you submit these "solaris ssh" failure strings to

http://sshguard.sourceforge.net/newattackpatt.php

I can integrate these patterns into the next release

Re: [Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Steve O. <oc...@nc...>]

Hello again.

OK I've sucessfully built and installed after my changes mentioned below but the program is 
failing to block hosts.

The way I'm running the program (as root) as such:

tail -0f /var/adm/sshlog | /usr/local/sbin/sshguard

(which didn't give any errors after I replaced the sun grep with gnu grep)

I do have the two lines:

##sshguard-begin##
##sshguard-end##

in my /etc/opt/ipf/ipf.conf which is symlinked as

/etc/ipf.rules

I tried ssh'ing in as root about 20 times as quick as ssh allowed me from a linux machine (it 
took a couple of minutes) but the rules have not changed and I'm not banned.

Here is an excerpt from the logs:

-----------------------------------------------------------------------------------------------------------------------
Oct  4 16:53:22 newton sshd[640]: [ID 702911 local7.info] connection from "10.31.5.173"
Oct  4 16:53:22 newton sshd[27849]: [ID 702911 local7.warning] WARNING: DNS lookup 
failed for "10.31.5.173".
Oct  4 16:53:23 newton sshd[27849]: [ID 702911 local7.warning] Wrong password given for 
user 'root'.
Oct  4 16:53:28 newton last message repeated 2 times
Oct  4 16:53:30 newton sshd[27849]: [ID 702911 local7.info] Local disconnected: Connection 
closed.
Oct  4 16:53:30 newton sshd[27849]: [ID 702911 local7.info] connection lost: 'Connection 
closed.'
Oct  4 16:53:58 newton sshd[640]: [ID 702911 local7.info] connection from "10.31.5.173"
Oct  4 16:53:58 newton sshd[27854]: [ID 702911 local7.warning] WARNING: DNS lookup 
failed for "10.31.5.173".
Oct  4 16:53:59 newton sshd[27854]: [ID 702911 local7.warning] Wrong password given for 
user 'root'.
Oct  4 16:54:04 newton last message repeated 2 times
Oct  4 16:54:06 newton sshd[27854]: [ID 702911 local7.info] Local disconnected: Connection 
closed.
Oct  4 16:54:06 newton sshd[27854]: [ID 702911 local7.info] connection lost: 'Connection 
closed.'
Oct  4 16:54:07 newton sshd[640]: [ID 702911 local7.info] connection from "10.31.5.173"
Oct  4 16:54:07 newton sshd[27858]: [ID 702911 local7.warning] WARNING: DNS lookup 
failed for "10.31.5.173".
Oct  4 16:54:08 newton sshd[27858]: [ID 702911 local7.warning] Wrong password given for 
user 'root'.
Oct  4 16:54:13 newton last message repeated 2 times
Oct  4 16:54:15 newton sshd[27858]: [ID 702911 local7.info] Local disconnected: Connection 
closed.
Oct  4 16:54:15 newton sshd[27858]: [ID 702911 local7.info] connection lost: 'Connection 
closed.'
Oct  4 16:54:16 newton sshd[640]: [ID 702911 local7.info] connection from "10.31.5.173"
Oct  4 16:54:16 newton sshd[27862]: [ID 702911 local7.warning] WARNING: DNS lookup 
failed for "10.31.5.173".
Oct  4 16:54:18 newton sshd[27862]: [ID 702911 local7.warning] Wrong password given for 
user 'root'.
Oct  4 16:54:24 newton last message repeated 2 times
Oct  4 16:54:26 newton sshd[27862]: [ID 702911 local7.info] Local disconnected: Connection 
closed.
Oct  4 16:54:26 newton sshd[27862]: [ID 702911 local7.info] connection lost: 'Connection 
closed.'
Oct  4 16:54:28 newton sshd[640]: [ID 702911 local7.info] connection from "10.31.5.173"
Oct  4 16:54:28 newton sshd[27864]: [ID 702911 local7.warning] WARNING: DNS lookup 
failed for "10.31.5.173".
Oct  4 16:54:29 newton sshd[27864]: [ID 702911 local7.warning] Wrong password given for 
user 'root'.
Oct  4 16:54:34 newton last message repeated 2 times
Oct  4 16:54:36 newton sshd[27864]: [ID 702911 local7.info] Local disconnected: Connection 
closed.
Oct  4 16:54:36 newton sshd[27864]: [ID 702911 local7.info] connection lost: 'Connection 
closed.'
Oct  4 16:54:37 newton sshd[640]: [ID 702911 local7.info] connection from "10.31.5.173"
Oct  4 16:54:37 newton sshd[27870]: [ID 702911 local7.warning] WARNING: DNS lookup 
failed for "10.31.5.173".
Oct  4 16:54:38 newton sshd[27870]: [ID 702911 local7.warning] Wrong password given for 
user 'root'.
Oct  4 16:54:44 newton last message repeated 2 times
Oct  4 16:54:46 newton sshd[27870]: [ID 702911 local7.info] Local disconnected: Connection 
closed.
Oct  4 16:54:46 newton sshd[27870]: [ID 702911 local7.info] connection lost: 'Connection 
closed.'
Oct  4 16:55:39 newton sshd[640]: [ID 702911 local7.info] connection from "10.31.5.173"
Oct  4 16:55:39 newton sshd[27881]: [ID 702911 local7.warning] WARNING: DNS lookup 
failed for "10.31.5.173".
Oct  4 16:55:43 newton sshd[27881]: [ID 702911 local7.warning] Wrong password given for 
user 'root'.
Oct  4 16:55:49 newton last message repeated 2 times
Oct  4 16:55:51 newton sshd[27881]: [ID 702911 local7.info] Local disconnected: Connection 
closed.
Oct  4 16:55:51 newton sshd[27881]: [ID 702911 local7.info] connection lost: 'Connection 
closed.'
-----------------------------------------------------------------------------------------------------------------------


I also tried an invalid user as guest and that didn't work either:

-----------------------------------------------------------------------------------------------------------------------
Oct  4 17:05:06 newton sshd[640]: [ID 702911 local7.info] connection from "10.31.5.173"
Oct  4 17:05:06 newton sshd[28007]: [ID 702911 local7.warning] WARNING: DNS lookup 
failed for "10.31.5.173".
Oct  4 17:05:07 newton sshd[28007]: [ID 702911 local7.warning] password authentication 
failed. Login to account guest not allowed or account non-existent.
Oct  4 17:05:12 newton last message repeated 2 times
Oct  4 17:05:14 newton sshd[28007]: [ID 702911 local7.info] Local disconnected: Connection 
closed.
Oct  4 17:05:14 newton sshd[28007]: [ID 702911 local7.info] connection lost: 'Connection 
closed.'
-----------------------------------------------------------------------------------------------------------------------


I'm guessing that the program is looking for a different string to watch out for in the logs but 
there is no config file to change that string.

Any further help would be apreciated.

Thanks


-Steve O.







On 3 Oct 2007 at 20:52, ssh...@li...urcefo wrote:

> On 3 Oct 2007 at 19:59, Steve Ochani wrote:
> 
> > > then try compiling: run
> > > 
> > > gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o 
> > > sshguard_log.o sshguard_procauth.o simclist.o attack_parser.o
> > > attack_scanner.o fwalls/libfwall.a -lpthread -lsocket -lresolv
> > > -lnsl
> > 
> > Did that and I get 1 linker error
> > 
> > gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o
> > sshguard_log.o sshguard_procauth.o simclist.o attack_parser.o
> > attack_scanner.o fwalls/libfwall.a -lpthread - lsocket -lresolv
> > -lnsl Undefined                       first referenced
> >  symbol                             in file
> > gethostbyname2                      attack_parser.o
> > ld: fatal: Symbol referencing errors. No output written to sshguard
> > collect2: ld returned 1 exit status
> 
> I edited attack_parser.c and changed gethostbyname2 call to plain old
> gethostbyname and took out the last arg of AF_INET even though I
> realize the 2nd call is for ipv6, but I'm not using ipv6 so I should
> be ok.
> 
> 
> I'll hopefully have time to install and test it tomorrow.
> 
> Thanks for the help.
> 
> I'll report back by results.
> 
> (I can't wait to get my new Linux servers in a few months and get rid
> of p.o.s. solaris)
> 
> -Steve O.
> 
> 
> 

Re: [Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Steve O. <oc...@nc...>]

On 3 Oct 2007 at 19:59, Steve Ochani wrote:

> > then try compiling: run
> > 
> > gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o  
> > sshguard_log.o sshguard_procauth.o simclist.o attack_parser.o 
> > attack_scanner.o fwalls/libfwall.a -lpthread -lsocket -lresolv -lnsl
> 
> Did that and I get 1 linker error
> 
> gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o
> sshguard_log.o sshguard_procauth.o simclist.o attack_parser.o
> attack_scanner.o fwalls/libfwall.a -lpthread - lsocket -lresolv -lnsl
> Undefined                       first referenced
>  symbol                             in file
> gethostbyname2                      attack_parser.o
> ld: fatal: Symbol referencing errors. No output written to sshguard
> collect2: ld returned 1 exit status

I edited attack_parser.c and changed gethostbyname2 call to plain old gethostbyname and 
took out the last arg of AF_INET even though I realize the 2nd call is for ipv6, but I'm not 
using ipv6 so I should be ok.


I'll hopefully have time to install and test it tomorrow.

Thanks for the help.

I'll report back by results.

(I can't wait to get my new Linux servers in a few months and get rid of p.o.s. solaris)

-Steve O.

Re: [Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Steve O. <oc...@nc...>]

On 3 Oct 2007 at 4:21, Mij wrote:

Date sent:      	Wed, 03 Oct 2007 04:21:07 +0200
From:           	Mij <mi...@bi...>
Subject:        	Re: [Sshguard-users] help needed building sshguard to use ip filter	on
	solaris 8
To:             	ssh...@li...
Send reply to:  	ssh...@li...

> 
> On 02/ott/07, at 21:48, Steve Ochani wrote:
> 
> > Hi,
> >
> > That worked but now I'm getting linker errors.
> >
> > gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o  
> > sshguard_log.o
> > sshguard_procauth.o simclist.o attack_parser.o attack_scanner.o 
> > fwalls/libfwall.a -lpthread Undefined                       first
> > referenced
> >  symbol                             in file
> > _Exit                               sshguard_procauth.o
> > gethostbyname2                      attack_parser.o
> > unsetenv                            fwalls/libfwall.a(command.o)
> > gethostbyname                       sshguard_whitelist.o setenv     
> >                         fwalls/libfwall.a(command.o) hstrerror      
> >                     attack_parser.o inet_pton                       
> >    sshguard_whitelist.o inet_ntop                          
> > attack_parser.o h_errno                             attack_parser.o
> > ld: fatal: Symbol referencing errors. No output written to sshguard
> > collect2: ld returned 1 exit status make[3]: *** [sshguard] Error 1
> > make[3]: Leaving directory `/export/home/steve/ipf/
> > sshguard-1.1beta3/sshguard-1.1beta3/src' make[2]: ***
> > [all-recursive] Error 1 make[2]: Leaving directory
> > `/export/home/steve/ipf/ sshguard-1.1beta3/sshguard-1.1beta3/src'
> > make[1]: *** [all] Error 2 make[1]: Leaving directory
> > `/export/home/steve/ipf/ sshguard-1.1beta3/sshguard-1.1beta3/src'
> > make: *** [all-recursive] Error 1
> >
> >
> > I went into src directory and tried: (added -lnsl -lresolv)
> >
> > gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o ssh
> > uard_log.o sshguard_procauth.o simclist.o attack_parser.o 
> > attack_scanner.o fwal s/libfwall.a -lpthread -lnsl -lresolv
> >
> > but still get some linker errors
> >
> > gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o ssh
> > uard_log.o sshguard_procauth.o simclist.o attack_parser.o 
> > attack_scanner.o fwal s/libfwall.a -lpthread -lnsl -lresolv
> > Undefined                       first referenced
> >  symbol                             in file
> > _Exit                               sshguard_procauth.o
> > gethostbyname2                      attack_parser.o
> > unsetenv                            fwalls/libfwall.a(command.o)
> > setenv                              fwalls/libfwall.a(command.o) ld:
> > fatal: Symbol referencing errors. No output written to sshguard
> > collect2: ld returned 1 exit status
> >
> >
> > BTW I'm using gcc 3.4.2
> 
> 
> I answered this same problem in the past for a guy who contacted me 
> privately. I will publish this in the FAQ if you confirm this fixes
> the problem,  as soon as I have a moment. Here is the answer:
> 

I thought someone might have had the same problem and tried looking for a searchable 
archive of this list but couldn't find one.

> 
> the easiest is bypassing automake and compiling it manually.
> 
> Basically solaris doesn't include anything in default library search 
> path so you have to specify all manually. Moreover google tells me
> solaris has  not setenv() but only putenv(), so you have to make a
> minor edit to the source file. (I will not move the main tree to this
> one has it has been marked  deprecated by POSIX)
> 
> edit src/fwall/command.c, search for "setenv(COMMAND_ENVNAME_ADDR, 
> addr, 1)". Replace this with "putenv(COMMAND_ENVNAME_ADDR, addr)"
> (mind the  missing 1!). Do this for thrice the setenv() lines, then
> remove the "unsetenv"  lines near below

I got the error:

command.c: In function `run_command':
command.c:63: error: too many arguments to function `putenv'
command.c:64: error: too many arguments to function `putenv'
command.c:65: error: too many arguments to function `putenv'


Looking up the details on putenv I see that it only takes one arg as a "name=value" pair.
from "man putenv" and 
http://www.opengroup.org/onlinepubs/009695399/functions/putenv.html

so i changed the lines to

putenv(strcat(COMMAND_ENVNAME_ADDR,strcat("=",addr)));
putenv(strcat(COMMAND_ENVNAME_ADDRKIND,strcat("=",addrks)));
putenv(strcat(COMMAND_ENVNAME_SERVICE,strcat("=",servs)));


> 
> Save and get back into the "src" directory (cd ..)
> if you're using 1.3, edit sshguard_procauth.c and replace both _Exit
> () calls with _exit().

done

> 
> 
> then try compiling: run
> 
> gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o  
> sshguard_log.o sshguard_procauth.o simclist.o attack_parser.o  
> attack_scanner.o fwalls/libfwall.a -lpthread -lsocket -lresolv -lnsl

Did that and I get 1 linker error

gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o sshguard_log.o 
sshguard_procauth.o simclist.o attack_parser.o attack_scanner.o fwalls/libfwall.a -lpthread -
lsocket -lresolv -lnsl
Undefined                       first referenced
 symbol                             in file
gethostbyname2                      attack_parser.o
ld: fatal: Symbol referencing errors. No output written to sshguard
collect2: ld returned 1 exit status



Thanks


-Steve O.

Re: [Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Mij <mi...@bi...>]

On 02/ott/07, at 21:48, Steve Ochani wrote:

> Hi,
>
> That worked but now I'm getting linker errors.
>
> gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o  
> sshguard_log.o
> sshguard_procauth.o simclist.o attack_parser.o attack_scanner.o  
> fwalls/libfwall.a -lpthread
> Undefined                       first referenced
>  symbol                             in file
> _Exit                               sshguard_procauth.o
> gethostbyname2                      attack_parser.o
> unsetenv                            fwalls/libfwall.a(command.o)
> gethostbyname                       sshguard_whitelist.o
> setenv                              fwalls/libfwall.a(command.o)
> hstrerror                           attack_parser.o
> inet_pton                           sshguard_whitelist.o
> inet_ntop                           attack_parser.o
> h_errno                             attack_parser.o
> ld: fatal: Symbol referencing errors. No output written to sshguard
> collect2: ld returned 1 exit status
> make[3]: *** [sshguard] Error 1
> make[3]: Leaving directory `/export/home/steve/ipf/ 
> sshguard-1.1beta3/sshguard-1.1beta3/src'
> make[2]: *** [all-recursive] Error 1
> make[2]: Leaving directory `/export/home/steve/ipf/ 
> sshguard-1.1beta3/sshguard-1.1beta3/src'
> make[1]: *** [all] Error 2
> make[1]: Leaving directory `/export/home/steve/ipf/ 
> sshguard-1.1beta3/sshguard-1.1beta3/src'
> make: *** [all-recursive] Error 1
>
>
> I went into src directory and tried: (added -lnsl -lresolv)
>
> gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o ssh
> uard_log.o sshguard_procauth.o simclist.o attack_parser.o  
> attack_scanner.o fwal
> s/libfwall.a -lpthread -lnsl -lresolv
>
> but still get some linker errors
>
> gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o ssh
> uard_log.o sshguard_procauth.o simclist.o attack_parser.o  
> attack_scanner.o fwal
> s/libfwall.a -lpthread -lnsl -lresolv
> Undefined                       first referenced
>  symbol                             in file
> _Exit                               sshguard_procauth.o
> gethostbyname2                      attack_parser.o
> unsetenv                            fwalls/libfwall.a(command.o)
> setenv                              fwalls/libfwall.a(command.o)
> ld: fatal: Symbol referencing errors. No output written to sshguard
> collect2: ld returned 1 exit status
>
>
> BTW I'm using gcc 3.4.2


I answered this same problem in the past for a guy who contacted me  
privately.
I will publish this in the FAQ if you confirm this fixes the problem,  
as soon as I have a moment.
Here is the answer:


the easiest is bypassing automake and compiling it manually.

Basically solaris doesn't include anything in default library search  
path so you
have to specify all manually. Moreover google tells me solaris has  
not setenv()
but only putenv(), so you have to make a minor edit to the source file.
(I will not move the main tree to this one has it has been marked  
deprecated by POSIX)

edit src/fwall/command.c, search for "setenv(COMMAND_ENVNAME_ADDR,  
addr, 1)".
Replace this with "putenv(COMMAND_ENVNAME_ADDR, addr)" (mind the  
missing 1!).
Do this for thrice the setenv() lines, then remove the "unsetenv"  
lines near below

Save and get back into the "src" directory (cd ..)
if you're using 1.3, edit sshguard_procauth.c and replace both _Exit 
() calls with _exit().


then try compiling: run

gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o  
sshguard_log.o sshguard_procauth.o simclist.o attack_parser.o  
attack_scanner.o fwalls/libfwall.a -lpthread -lsocket -lresolv -lnsl

if you get again problems with _exit(), try replacing with "exit 
()" (then you will possibly have
some segfaults when exiting, but they're harmless)

Re: [Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Steve O. <oc...@nc...>]

On 2 Oct 2007 at 19:40, Mij wrote:

> 
> Older solaris releases do not appear to have stdint.h
> 
> try this one:
> edit src/simclist.c
> replace
> #include <stdint.h>
> with
> #include <inttypes.h>
> 
> let me know in case it doesn't get ok

Hi,

That worked but now I'm getting linker errors.

gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o sshguard_log.o 
sshguard_procauth.o simclist.o attack_parser.o attack_scanner.o fwalls/libfwall.a -lpthread 
Undefined                       first referenced
 symbol                             in file
_Exit                               sshguard_procauth.o
gethostbyname2                      attack_parser.o
unsetenv                            fwalls/libfwall.a(command.o)
gethostbyname                       sshguard_whitelist.o
setenv                              fwalls/libfwall.a(command.o)
hstrerror                           attack_parser.o
inet_pton                           sshguard_whitelist.o
inet_ntop                           attack_parser.o
h_errno                             attack_parser.o
ld: fatal: Symbol referencing errors. No output written to sshguard
collect2: ld returned 1 exit status
make[3]: *** [sshguard] Error 1
make[3]: Leaving directory `/export/home/steve/ipf/sshguard-1.1beta3/sshguard-1.1beta3/src'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/export/home/steve/ipf/sshguard-1.1beta3/sshguard-1.1beta3/src'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/export/home/steve/ipf/sshguard-1.1beta3/sshguard-1.1beta3/src'
make: *** [all-recursive] Error 1


I went into src directory and tried: (added -lnsl -lresolv)

gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o ssh
uard_log.o sshguard_procauth.o simclist.o attack_parser.o attack_scanner.o fwal
s/libfwall.a -lpthread -lnsl -lresolv

but still get some linker errors

gcc  -I. -O2   -o sshguard  sshguard.o sshguard_whitelist.o ssh
uard_log.o sshguard_procauth.o simclist.o attack_parser.o attack_scanner.o fwal
s/libfwall.a -lpthread -lnsl -lresolv
Undefined                       first referenced
 symbol                             in file
_Exit                               sshguard_procauth.o
gethostbyname2                      attack_parser.o
unsetenv                            fwalls/libfwall.a(command.o)
setenv                              fwalls/libfwall.a(command.o)
ld: fatal: Symbol referencing errors. No output written to sshguard
collect2: ld returned 1 exit status


BTW I'm using gcc 3.4.2


thanks


-Steve O.






> 
> ----------------------------------------------------------------------
> --- This SF.net email is sponsored by: Microsoft Defy all challenges.
> Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________ Sshguard-users mailing
> list Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] disable IPv6 support

[Mij <mi...@bi...>]

an errata corrige

> #define COMMAND_FLUSH       IPTABLES_PATH "/iptables -F sshguard ; "
> IPTABLES_PATH "/ip6tables -F sshguard"
>
> and shorten it as follows
> #define COMMAND_FLUSH       IPTABLES_PATH "/iptables -F sshguard

this is
#define COMMAND_FLUSH       IPTABLES_PATH "/iptables -F sshguard"


> then reconfigure (!), recompile and reinstall.

Re: [Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Mij <mi...@bi...>]

On 02/ott/07, at 18:09, Steve Ochani wrote:

> OK I got the configure command to go through by using
>
> ./configure --with-firewall=ipfilter
>
> However now when I ran make I got the error:
>
>
> gcc -DHAVE_CONFIG_H -I. -I. -I.     -I. -O2 -c `test -f  
> 'simclist.c' || echo './'`simclist.c
> simclist.c:6:20: stdint.h: No such file or directory
> make[3]: *** [simclist.o] Error 1
> make[3]: Leaving directory `/export/home/steve/ipf/ 
> sshguard-1.1beta3/sshguard-1.1beta3/src'
> make[2]: *** [all-recursive] Error 1
> make[2]: Leaving directory `/export/home/steve/ipf/ 
> sshguard-1.1beta3/sshguard-1.1beta3/src'
> make[1]: *** [all] Error 2
> make[1]: Leaving directory `/export/home/steve/ipf/ 
> sshguard-1.1beta3/sshguard-1.1beta3/src'
> make: *** [all-recursive] Error 1

Older solaris releases do not appear to have stdint.h

try this one:
edit src/simclist.c
replace
#include <stdint.h>
with
#include <inttypes.h>

let me know in case it doesn't get ok

Re: [Sshguard-users] disable IPv6 support

[Mij <mi...@bi...>]

On 02/ott/07, at 14:00, Mr. Mystify wrote:

>
> hi...
>
> is it possible to disable IPv6 support in sshguard???
>
> when securing a system disabling IPv6 is a basic method, if you don't
> use it. for the current sshguard release (sshguard 1.0) I can't  
> find any
> hints how to do this.
> and my sshguard currently gives warning messages that ip6tables chains
> are missing.
>
> of course this tables are missing, since I disabled any IPv6 support,
> since I only have IPv4 addresses ;-)

There is no way to disable IPv6 detection nor I plan to implement it.

The errors you get occur when flushing the list of blocked addresses.
As you say, ip6tables complains because the system doesn't have
its tables set up. These errors should appear very unfrequently (at  
startup
and shutdown), and you can safely ignore them.

If you dislike it, you can remove ip6tables actions by hacking the  
source.
Just edit src/fwalls/command_iptables.h
locate this line

#define COMMAND_FLUSH       IPTABLES_PATH "/iptables -F sshguard ; "  
IPTABLES_PATH "/ip6tables -F sshguard"

and shorten it as follows
#define COMMAND_FLUSH       IPTABLES_PATH "/iptables -F sshguard

then reconfigure (!), recompile and reinstall.

bye

Re: [Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Steve O. <oc...@nc...>]

OK I got the configure command to go through by using

./configure --with-firewall=ipfilter

However now when I ran make I got the error:


gcc -DHAVE_CONFIG_H -I. -I. -I.     -I. -O2 -c `test -f 'simclist.c' || echo './'`simclist.c
simclist.c:6:20: stdint.h: No such file or directory
make[3]: *** [simclist.o] Error 1
make[3]: Leaving directory `/export/home/steve/ipf/sshguard-1.1beta3/sshguard-1.1beta3/src'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/export/home/steve/ipf/sshguard-1.1beta3/sshguard-1.1beta3/src'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/export/home/steve/ipf/sshguard-1.1beta3/sshguard-1.1beta3/src'
make: *** [all-recursive] Error 1



Thanks for any help.


-Steve O.





On 2 Oct 2007 at 11:48, Steve Ochani wrote:

> Hello,
> 
> I've using ip filter (ver. 3.4.32, 64 bit) on solaris 8 (sparc).
> 
> Now I'm trying to build sshguard 1.1 beta 3, since it doesn't appear
> that the stable branch supports using ip filter as the backend.
> 
> The configure script does not recgnoize ipf as being installed, even
> though it's in my path at /usr/sbin/ipf
> 
> I have tried running configure as
> 
> ./configure --with-firewall=ipf
> 
> and it gives me error:
> 
> Choose a valid firewall backend (see --help)
> 
> I've also tried 
> 
> ./configure --with-firewall=ipf --with-ipf=/usr/sbin/ipf
> 
> and 
> 
> ./configure --with-firewall=ipf --with-ipf=/usr/sbin
> 
> and it still gives me the above error!
> 
> 
> What do I do now?
> 
> 
> Thanks for any help.
> 
> 
> 
> 
> ----------------------------------------------------------------------
> --- This SF.net email is sponsored by: Microsoft Defy all challenges.
> Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________ Sshguard-users mailing
> list Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] help needed building sshguard to use ip filter on solaris 8

[Steve O. <oc...@nc...>]

Hello,

I've using ip filter (ver. 3.4.32, 64 bit) on solaris 8 (sparc).

Now I'm trying to build sshguard 1.1 beta 3, since it doesn't appear that the stable branch 
supports using ip filter as the backend.

The configure script does not recgnoize ipf as being installed, even though it's in my path at 
/usr/sbin/ipf

I have tried running configure as

./configure --with-firewall=ipf

and it gives me error:

Choose a valid firewall backend (see --help)

I've also tried 

./configure --with-firewall=ipf --with-ipf=/usr/sbin/ipf

and 

./configure --with-firewall=ipf --with-ipf=/usr/sbin

and it still gives me the above error!


What do I do now?


Thanks for any help.

[Sshguard-users] disable IPv6 support

[Mr. M. <che...@gm...>]

hi...

is it possible to disable IPv6 support in sshguard???

when securing a system disabling IPv6 is a basic method, if you don't
use it. for the current sshguard release (sshguard 1.0) I can't find any
hints how to do this.
and my sshguard currently gives warning messages that ip6tables chains
are missing.

of course this tables are missing, since I disabled any IPv6 support,
since I only have IPv4 addresses ;-)

bye
mr. mystify

Re: [Sshguard-users] sshguard on OpenBSD

[Mij <mi...@bi...>]

On 26/lug/07, at 09:19, Michael Stilkerich wrote:

> Hi,
>
> I am using sshguard on OpenBSD 4.1 with pf. It does not work
> using the setup from the documentation, because syslogd is
> not running as root but _syslogd on OpenBSD, which results
> in sshguard being executed as _syslogd lacking the privileges
> required to add new addresses to the sshguard table. I solved
> the problem by allowing _syslogd to execute sshguard as root
> through sudo and adjusted the syslog.conf appropriately.

I'll point this out, thank you.


> Maybe
> you should point this out in the documentation, since the log
> just says
> sshguard[28812]: Blocking command failed. Exited: -1
> sshguard[28812]: Release command failed. Exited: -1
> which isn't particularly helpful.

to solve this one could see useful to check on startup if sshguard is
running as superuser. This makes sense in most cases, but in the general
idea of pluggable backends some may not require such a constraint
and thus want to run it with lower privileges.

I will consider to put such a constraint in the individual firewall  
initialization
routines to provide feedback on this. Who needs this gives up while  
initializating.


> Also, you may want to consider calling pfctl with -q since
> otherwise it operates pretty verbosely. I don't know if these
> messages appear in some log, otherwise it doesn't really
> matter.

yes, syslogd runs processes with standard out and err moved to /dev/null

bye

[Sshguard-users] sshguard on OpenBSD

[Michael S. <mi...@li...>]

Hi,

I am using sshguard on OpenBSD 4.1 with pf. It does not work
using the setup from the documentation, because syslogd is
not running as root but _syslogd on OpenBSD, which results
in sshguard being executed as _syslogd lacking the privileges
required to add new addresses to the sshguard table. I solved
the problem by allowing _syslogd to execute sshguard as root
through sudo and adjusted the syslog.conf appropriately. Maybe
you should point this out in the documentation, since the log
just says
sshguard[28812]: Blocking command failed. Exited: -1
sshguard[28812]: Release command failed. Exited: -1
which isn't particularly helpful.

Also, you may want to consider calling pfctl with -q since
otherwise it operates pretty verbosely. I don't know if these
messages appear in some log, otherwise it doesn't really
matter.

-Mike

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Mij <mi...@bi...>]

I forwarded the script to the -maintainers mailing list.

thanks


On 03/lug/07, at 23:19, Robert S wrote:

>> There are 2 basic kinds of attack: invalid user or invalid password.
>> The former is recognized on your system, the latter is not. There is
>> a parser attached that recognizes these logs. It has been integrated
>> in 1.1beta3.
>>
>> You can simply copy these files in a clean sshguard-1.0 package
>> (directory "src") and then run:
>>
>> cd src
>> bison -vd attack_parser.y
>> flex attack_scanner.l
>>
>> then recompile and reinstall.
>>
>
> Hi.  Many thanks.  That seems to work.  I've done a debian startup
> script that seems to do the job.  I hope it helps somebody:

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Robert S <rob...@gm...>]

> There are 2 basic kinds of attack: invalid user or invalid password.
> The former is recognized on your system, the latter is not. There is
> a parser attached that recognizes these logs. It has been integrated
> in 1.1beta3.
>
> You can simply copy these files in a clean sshguard-1.0 package
> (directory "src") and then run:
>
> cd src
> bison -vd attack_parser.y
> flex attack_scanner.l
>
> then recompile and reinstall.
>

Hi.  Many thanks.  That seems to work.  I've done a debian startup
script that seems to do the job.  I hope it helps somebody:

#! /bin/sh
### BEGIN INIT INFO
# Provides:          sshguard
# Required-Start:    $syslog
# Required-Stop:     $local_fs $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Sshguard initscript
# Description:       This file should be used to construct scripts to be
#                    placed in /etc/init.d.
### END INIT INFO
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="ssh guard service"
NAME=sshguard
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/$NAME
WHITELIST=/etc/sshguard.whitelist
LOG=/var/log/auth.log
. /lib/init/vars.sh
. /lib/lsb/init-functions
function startGuard {
    [ -e $WHITELIST ] && ARGS="-w $WHITELIST"
    sh -c "echo \$\$ > $PIDFILE && exec tail -n0 -f $LOG" |
/usr/local/sbin/sshguard $ARGS
    return $?
    }

do_start()
{
    [ -e $PIDFILE ] && return 1
    iptables -N sshguard
    iptables -I INPUT 1 -p tcp --dport 22 -j sshguard
    ip6tables -N sshguard
    ip6tables -A INPUT -p tcp --dport 22 -j sshguard
    startGuard &
    [ 0 -ne $? ] && return 2 || return 0
}
do_stop()
{
    kill `cat $PIDFILE`
    RETVAL=$?
    sleep 1
    iptables -D INPUT -p tcp --dport 22 -j sshguard
    iptables -F sshguard
    iptables -X sshguard
    ip6tables -D INPUT -p tcp --dport 22 -j sshguard
    ip6tables -F sshguard
    ip6tables -X sshguard
	rm -f $PIDFILE
	return "$RETVAL"
}
case "$1" in
  start)
	log_daemon_msg "Starting $DESC" "$NAME"
	do_start
	case "$?" in
		0|1)	log_end_msg 0 ;;
		2) 	log_end_msg 1 ;;
	esac
	;;
  stop)
	log_daemon_msg "Stopping $DESC" "$NAME"
	do_stop
	case "$?" in
		0|1)	log_end_msg 0 ;;
		2)	log_end_msg 1 ;;
	esac
	;;
  restart|force-reload)
	log_daemon_msg "Restarting $DESC" "$NAME"
	do_stop
	case "$?" in
	  0|1)
		do_start
		case "$?" in
			0) log_end_msg 0 ;;
			1) log_end_msg 1 ;; # Old process is still running
			*) log_end_msg 1 ;; # Failed to start
		esac
		;;
	  *)
	  	# Failed to stop
		log_end_msg 1
		;;
	esac
	;;
  *)
	echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
	exit 3
	;;
esac

Re: [Sshguard-users] sshguard exited on signal 6 (core dumped)

[Mij <mi...@bi...>]

I confirm this bug.

It happens when the pipe to sshguard is closed, and caused by the  
finalization routine
called twice, one implicitly by the OS.

The fix is trivial: replace lines 153-157 in src/sshguard.c
###
     if (fw_fin() != FWALL_OK) sshguard_log(LOG_ERR, "Cound not  
finalize firewall.");

     sshguard_log_fin();

     return 0;
###

with a single call to exit() that will call the finish functions once
###
     exit(0);
###

This has been already integrated in 1.1beta3.

thanks for reporting.


On 24/giu/07, at 11:09, Hans Lambermont wrote:

> Hi all,
>
> I hope coredumping on 'syslogd reload' is not intended behaviour.
>
> System: FreeBSD 6.2-RELEASE, IPFW, sshguard-ipfw-1.0_1, syslog line :
>   auth.info;authpriv.info | exec /usr/local/sbin/sshguard -a 1
>
> ps axgwww | grep sshguard
> 51586  ??  Ss     0:00.01 /usr/local/sbin/sshguard -a 1
>
> /etc/rc.d/syslogd reload
> Reloading syslogd config files.
>
> 10:36:45 sshguard[51586]: Got exit signal, flushing blocked  
> addresses and exiting...
> 10:36:45 kernel: pid 51586 (sshguard), uid 0: exited on signal 6  
> (core dumped)
> 10:36:45 sshguard[55614]: Started successfully [(a,p,s)=(1, 420,  
> 1200)], now ready to scan.
>
> So the old sshguard dumps core, and the new one starts fine
> (and works too:
> 01:30:32 sshguard[55614]: Blocking 221.204.251.32: 2 failures over  
> 4 seconds.
> 01:30:32 sshguard[55614]: running: '/sbin/ipfw add 55021 drop ip  
> from 221.204.251.32 to me'
> 01:39:27 sshguard[55614]: Releasing 221.204.251.32 after 535 seconds.
> 01:39:27 sshguard[55614]: running: '/sbin/ipfw delete 55021'
> )
>
> Here's a backtrace of one of sshguard's coredumps:
>
> gdb /usr/local/sbin/sshguard /sshguard.core
> GNU gdb 6.1.1 [FreeBSD]
> Copyright 2004 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License,  
> and you are
> welcome to change it and/or distribute copies of it under certain  
> conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for  
> details.
> This GDB was configured as "i386-marcel-freebsd"...(no debugging  
> symbols found)...
> Core was generated by `sshguard'.
> Program terminated with signal 6, Aborted.
> Reading symbols from /lib/libpthread.so.2...(no debugging symbols  
> found)...done.
> Loaded symbols for /lib/libpthread.so.2
> Reading symbols from /lib/libc.so.6...(no debugging symbols  
> found)...done.
> Loaded symbols for /lib/libc.so.6
> Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols  
> found)...done.
> Loaded symbols for /libexec/ld-elf.so.1
> #0  0x280a7537 in pthread_testcancel () from /lib/libpthread.so.2
> [New Thread 0x805a400 (sleeping)]
> [New Thread 0x805a200 (LWP 100231)]
> [New Thread 0x805a000 (LWP 100234)]
> (gdb) bt
> #0  0x280a7537 in pthread_testcancel () from /lib/libpthread.so.2
> #1  0x2809689a in sigaction () from /lib/libpthread.so.2
> #2  0x2809088d in pthread_kill () from /lib/libpthread.so.2
> #3  0x28090256 in raise () from /lib/libpthread.so.2
> #4  0x28169b78 in abort () from /lib/libc.so.6
> #5  0x28106fdb in _UTF8_init () from /lib/libc.so.6
> #6  0xbfbfef58 in ?? ()
> #7  0x28170dd3 in sys_nsig () from /lib/libc.so.6
> #8  0x28170cd3 in sys_nsig () from /lib/libc.so.6
> #9  0x28170d30 in sys_nsig () from /lib/libc.so.6
> #10 0x00000000 in ?? ()
> #11 0x2817bd80 in ?? () from /lib/libc.so.6
> #12 0xbfbfed18 in ?? ()
> #13 0x28107009 in _UTF8_init () from /lib/libc.so.6
> #14 0x2817bd80 in ?? () from /lib/libc.so.6
> #15 0x08050bb0 in optarg ()
> #16 0xbfbfedc8 in ?? ()
> #17 0x28107d69 in _UTF8_init () from /lib/libc.so.6
> #18 0x00000000 in ?? ()
> #19 0xbfbfed64 in ?? ()
> #20 0x2807b200 in ?? ()
> #21 0x0104887f in ?? ()
> #22 0x0bea6495 in ?? ()
> #23 0x280bef6a in ?? () from /lib/libc.so.6
> #24 0x28074558 in ?? () from /libexec/ld-elf.so.1
> #25 0x280aa4b4 in ?? () from /lib/libpthread.so.2
> #26 0x08052800 in ?? ()
> #27 0x00000000 in ?? ()
> #28 0x00000000 in ?? ()
> #29 0x00000000 in ?? ()
> #30 0x28170dc5 in sys_nsig () from /lib/libc.so.6
> #31 0x00000001 in ?? ()
> #32 0xbfbfed9c in ?? ()
> #33 0x280a83d1 in __error () from /lib/libpthread.so.2
> Previous frame inner to this frame (corrupt stack?)
>
> I hope this is enough info, I can make a debug build if needed.
>
> So, is coredumping on 'syslogd reload' intended or is this a bug,  
> or am
> I doing something wrong ?
>
> regards,
>   Hans Lambermont
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Mij <mi...@bi...>]

On 27/giu/07, at 13:44, Robert S wrote:

>> You would try running "/usr/local/sbin/sshguard" from the command
>> line and
>> pasting this line in its input (from keyboard)
>>
>> Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
>>
>
> This seems to work (compiled with debugging):
>
> # /usr/local/sbin/sshguard
> Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
> Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
> Matched IP address 1.2.3.4
> Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
> Matched IP address 1.2.3.4
> Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
> Matched IP address 1.2.3.4
> Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
> Matched IP address 1.2.3.4
> Blocking 1.2.3.4: 4 failures over 3 seconds.
>
> Setting environment:  
> SSHG_ADDR=1.2.3.4;SSHG_ADDRKIND=4;SSHG_SERVICE=10.
> Run command "case $SSHG_ADDRKIND in 4) exec /sbin/iptables -A sshguard
> -s $SSHG_ADDR -j DROP ;; 6) exec /sbin/ip6tables -A sshguard -s
> $SSHG_ADDR -j DROP ;; *) exit -2 ;; esac": exited 0.
> Got exit signal, flushing blocked addresses and exiting...
> ip6tables: No chain/target/match by that name
> Run command "/sbin/iptables -F sshguard ; /sbin/ip6tables -F
> sshguard": exited 256.
>
>> paste it 4 times then check "iptables -L" to see if a drop rule for
>
> This confirms that the address 1.2.3.4 is DROPed
>
>> # tail -n0 -F /var/log/secure.log | tee -a /dev/stderr | ./src/ 
>> sshguard
>
> No luck when I use a username that exists on the system:
>
> # tail -n0 -F /var/log/messages | tee -a /dev/stderr | /usr/local/ 
> sbin/sshguard
> Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
> Jun 28 07:13:28 etch sshd[5789]: Failed password for robert from
> 192.168.2.40 port 40727 ssh2
> Jun 28 07:13:34 etch sshd[5798]: (pam_unix) authentication failure;
> logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
> user=robert
> Jun 28 07:13:37 etch sshd[5798]: Failed password for robert from
> 192.168.2.40 port 40729 ssh2
> Jun 28 07:13:39 etch sshd[5798]: Failed password for robert from
> 192.168.2.40 port 40729 ssh2
> Jun 28 07:13:42 etch sshd[5798]: Failed password for robert from
> 192.168.2.40 port 40729 ssh2
> Jun 28 07:13:48 etch sshd[5800]: (pam_unix) authentication failure;
> logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
> user=robert
> Jun 28 07:13:49 etch sshd[5800]: Failed password for robert from
> 192.168.2.40 port 40730 ssh2
> Jun 28 07:13:52 etch sshd[5800]: Failed password for robert from
> 192.168.2.40 port 40730 ssh2
> Jun 28 07:13:56 etch sshd[5800]: Failed password for robert from
> 192.168.2.40 port 40730 ssh2
> <etc>
>
> On the other hand - if I use a non-existent user the following  
> happens:
>
> # tail -n0 -F /var/log/messages | tee -a /dev/stderr | /usr/local/ 
> sbin/sshguard
> Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
> Jun 28 07:24:44 etch sshd[5922]: Invalid user foobar from 192.168.2.40
> Jun 28 07:24:45 etch sshd[5922]: Failed none for invalid user foobar
> from 192.168.2.40 port 58171 ssh2
> Matched IP address 192.168.2.40
> Jun 28 07:24:48 etch sshd[5922]: (pam_unix) check pass; user unknown
> Jun 28 07:24:48 etch sshd[5922]: (pam_unix) authentication failure;
> logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
> Jun 28 07:24:50 etch sshd[5922]: Failed password for invalid user
> foobar from 192.168.2.40 port 58171 ssh2
> Jun 28 07:24:55 etch sshd[5922]: (pam_unix) check pass; user unknown
> Jun 28 07:24:56 etch sshd[5922]: Failed password for invalid user
> foobar from 192.168.2.40 port 58171 ssh2
> Jun 28 07:25:01 etch sshd[5922]: (pam_unix) check pass; user unknown
> Jun 28 07:25:03 etch sshd[5922]: Failed password for invalid user
> foobar from 192.168.2.40 port 58171 ssh2
> Jun 28 07:25:04 etch sshd[5924]: Invalid user foobar from 192.168.2.40
> Jun 28 07:25:04 etch sshd[5924]: Failed none for invalid user foobar
> from 192.168.2.40 port 58172 ssh2
> Matched IP address 192.168.2.40
> Jun 28 07:25:06 etch sshd[5924]: (pam_unix) check pass; user unknown
> Jun 28 07:25:06 etch sshd[5924]: (pam_unix) authentication failure;
> logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
> Jun 28 07:25:09 etch sshd[5924]: Failed password for invalid user
> foobar from 192.168.2.40 port 58172 ssh2
> Jun 28 07:25:13 etch sshd[5924]: (pam_unix) check pass; user unknown
> Jun 28 07:25:15 etch sshd[5924]: Failed password for invalid user
> foobar from 192.168.2.40 port 58172 ssh2
> Jun 28 07:25:16 etch sshd[5924]: (pam_unix) check pass; user unknown
> Jun 28 07:25:18 etch sshd[5924]: Failed password for invalid user
> foobar from 192.168.2.40 port 58172 ssh2
> Jun 28 07:25:20 etch sshd[5926]: Invalid user foobar from 192.168.2.40
> Jun 28 07:25:20 etch sshd[5926]: Failed none for invalid user foobar
> from 192.168.2.40 port 58173 ssh2
> Matched IP address 192.168.2.40
> Jun 28 07:25:21 etch sshd[5926]: (pam_unix) check pass; user unknown
> Jun 28 07:25:21 etch sshd[5926]: (pam_unix) authentication failure;
> logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
> Jun 28 07:25:23 etch sshd[5926]: Failed password for invalid user
> foobar from 192.168.2.40 port 58173 ssh2
> Jun 28 07:25:25 etch sshd[5928]: Invalid user foobar from 192.168.2.40
> Jun 28 07:25:25 etch sshd[5928]: Failed none for invalid user foobar
> from 192.168.2.40 port 58174 ssh2
> Matched IP address 192.168.2.40
> Blocking 192.168.2.40: 4 failures over 40 seconds.
>
> Setting environment:  
> SSHG_ADDR=192.168.2.40;SSHG_ADDRKIND=4;SSHG_SERVICE=10.
> Run command "case $SSHG_ADDRKIND in 4) exec /sbin/iptables -A sshguard
> -s $SSHG_ADDR -j DROP ;; 6) exec /sbin/ip6tables -A sshguard -s
> $SSHG_ADDR -j DROP ;; *) exit -2 ;; esac": exited 0.
>
> Strangely, I am still able to log into "etch".  iptables -L gives me:
>
> Chain sshguard (0 references)
> target     prot opt source               destination
> DROP       0    --  myhost.mydomain.com.au  anywhere

sshguard did its job in putting the blocking rule in the "sshguard"
chain, so I guess this address is not blocked because you have
not demanded the INPUT chain to this one, possible?


> Further - if I run sshguard with no input, and feed it "Failed
> password for robert from 192.168.2.40 port 40727 ssh2", it does
> nothing:
>
> # /usr/local/sbin/sshguard
> Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
> Failed password for robert from 192.168.2.40 port 40727 ssh2
> Failed password for robert from 192.168.2.40 port 40727 ssh2
> Failed password for robert from 192.168.2.40 port 40727 ssh2
> Failed password for robert from 192.168.2.40 port 40727 ssh2
> Failed password for robert from 192.168.2.40 port 40727 ssh2
> Failed password for robert from 192.168.2.40 port 40727 ssh2
>
> It appears to me that sshguard doesn't recognise most of my log  
> messages??

There are 2 basic kinds of attack: invalid user or invalid password.
The former is recognized on your system, the latter is not. There is
a parser attached that recognizes these logs. It has been integrated
in 1.1beta3.

You can simply copy these files in a clean sshguard-1.0 package
(directory "src") and then run:

cd src
bison -vd attack_parser.y
flex attack_scanner.l

then recompile and reinstall.

bye

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Robert S <rob...@gm...>]

> You would try running "/usr/local/sbin/sshguard" from the command
> line and
> pasting this line in its input (from keyboard)
>
> Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
>

This seems to work (compiled with debugging):

# /usr/local/sbin/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
Matched IP address 1.2.3.4
Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
Matched IP address 1.2.3.4
Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
Matched IP address 1.2.3.4
Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
Matched IP address 1.2.3.4
Blocking 1.2.3.4: 4 failures over 3 seconds.

Setting environment: SSHG_ADDR=1.2.3.4;SSHG_ADDRKIND=4;SSHG_SERVICE=10.
Run command "case $SSHG_ADDRKIND in 4) exec /sbin/iptables -A sshguard
-s $SSHG_ADDR -j DROP ;; 6) exec /sbin/ip6tables -A sshguard -s
$SSHG_ADDR -j DROP ;; *) exit -2 ;; esac": exited 0.
Got exit signal, flushing blocked addresses and exiting...
ip6tables: No chain/target/match by that name
Run command "/sbin/iptables -F sshguard ; /sbin/ip6tables -F
sshguard": exited 256.

> paste it 4 times then check "iptables -L" to see if a drop rule for

This confirms that the address 1.2.3.4 is DROPed

> # tail -n0 -F /var/log/secure.log | tee -a /dev/stderr | ./src/sshguard

No luck when I use a username that exists on the system:

# tail -n0 -F /var/log/messages | tee -a /dev/stderr | /usr/local/sbin/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Jun 28 07:13:28 etch sshd[5789]: Failed password for robert from
192.168.2.40 port 40727 ssh2
Jun 28 07:13:34 etch sshd[5798]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
user=robert
Jun 28 07:13:37 etch sshd[5798]: Failed password for robert from
192.168.2.40 port 40729 ssh2
Jun 28 07:13:39 etch sshd[5798]: Failed password for robert from
192.168.2.40 port 40729 ssh2
Jun 28 07:13:42 etch sshd[5798]: Failed password for robert from
192.168.2.40 port 40729 ssh2
Jun 28 07:13:48 etch sshd[5800]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
user=robert
Jun 28 07:13:49 etch sshd[5800]: Failed password for robert from
192.168.2.40 port 40730 ssh2
Jun 28 07:13:52 etch sshd[5800]: Failed password for robert from
192.168.2.40 port 40730 ssh2
Jun 28 07:13:56 etch sshd[5800]: Failed password for robert from
192.168.2.40 port 40730 ssh2
<etc>

On the other hand - if I use a non-existent user the following happens:

# tail -n0 -F /var/log/messages | tee -a /dev/stderr | /usr/local/sbin/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Jun 28 07:24:44 etch sshd[5922]: Invalid user foobar from 192.168.2.40
Jun 28 07:24:45 etch sshd[5922]: Failed none for invalid user foobar
from 192.168.2.40 port 58171 ssh2
Matched IP address 192.168.2.40
Jun 28 07:24:48 etch sshd[5922]: (pam_unix) check pass; user unknown
Jun 28 07:24:48 etch sshd[5922]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
Jun 28 07:24:50 etch sshd[5922]: Failed password for invalid user
foobar from 192.168.2.40 port 58171 ssh2
Jun 28 07:24:55 etch sshd[5922]: (pam_unix) check pass; user unknown
Jun 28 07:24:56 etch sshd[5922]: Failed password for invalid user
foobar from 192.168.2.40 port 58171 ssh2
Jun 28 07:25:01 etch sshd[5922]: (pam_unix) check pass; user unknown
Jun 28 07:25:03 etch sshd[5922]: Failed password for invalid user
foobar from 192.168.2.40 port 58171 ssh2
Jun 28 07:25:04 etch sshd[5924]: Invalid user foobar from 192.168.2.40
Jun 28 07:25:04 etch sshd[5924]: Failed none for invalid user foobar
from 192.168.2.40 port 58172 ssh2
Matched IP address 192.168.2.40
Jun 28 07:25:06 etch sshd[5924]: (pam_unix) check pass; user unknown
Jun 28 07:25:06 etch sshd[5924]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
Jun 28 07:25:09 etch sshd[5924]: Failed password for invalid user
foobar from 192.168.2.40 port 58172 ssh2
Jun 28 07:25:13 etch sshd[5924]: (pam_unix) check pass; user unknown
Jun 28 07:25:15 etch sshd[5924]: Failed password for invalid user
foobar from 192.168.2.40 port 58172 ssh2
Jun 28 07:25:16 etch sshd[5924]: (pam_unix) check pass; user unknown
Jun 28 07:25:18 etch sshd[5924]: Failed password for invalid user
foobar from 192.168.2.40 port 58172 ssh2
Jun 28 07:25:20 etch sshd[5926]: Invalid user foobar from 192.168.2.40
Jun 28 07:25:20 etch sshd[5926]: Failed none for invalid user foobar
from 192.168.2.40 port 58173 ssh2
Matched IP address 192.168.2.40
Jun 28 07:25:21 etch sshd[5926]: (pam_unix) check pass; user unknown
Jun 28 07:25:21 etch sshd[5926]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
Jun 28 07:25:23 etch sshd[5926]: Failed password for invalid user
foobar from 192.168.2.40 port 58173 ssh2
Jun 28 07:25:25 etch sshd[5928]: Invalid user foobar from 192.168.2.40
Jun 28 07:25:25 etch sshd[5928]: Failed none for invalid user foobar
from 192.168.2.40 port 58174 ssh2
Matched IP address 192.168.2.40
Blocking 192.168.2.40: 4 failures over 40 seconds.

Setting environment: SSHG_ADDR=192.168.2.40;SSHG_ADDRKIND=4;SSHG_SERVICE=10.
Run command "case $SSHG_ADDRKIND in 4) exec /sbin/iptables -A sshguard
-s $SSHG_ADDR -j DROP ;; 6) exec /sbin/ip6tables -A sshguard -s
$SSHG_ADDR -j DROP ;; *) exit -2 ;; esac": exited 0.

Strangely, I am still able to log into "etch".  iptables -L gives me:

Chain sshguard (0 references)
target     prot opt source               destination
DROP       0    --  myhost.mydomain.com.au  anywhere

Further - if I run sshguard with no input, and feed it "Failed
password for robert from 192.168.2.40 port 40727 ssh2", it does
nothing:

# /usr/local/sbin/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2

It appears to me that sshguard doesn't recognise most of my log messages??

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Mij <mi...@bi...>]

On 27/giu/07, at 00:07, Robert S wrote:

>> 2) for syslogd, external procs are not started when syslogd is
>> restarted, but at the first occurrence of a log for them. So, restart
>> syslogd and try a ssh login before checking ps.
>
> I tried using syslog-ng - no luck.
>
>> I am interested in your report. Could you please:
>> 1) disable syslog config for sshguard
>> 2) reinstall sshguard
>> 3) run sshguard from the command line as
>> /usr/local/sbin/sshguard
>
> I have tried these things.  I get no output when I do this:
>
> # /usr/local/sbin/sshguard

this is the correct behaviour; it is expecting input to scan.
With 1.1beta you have "-d" to dump logging to standard output;
otherwise they go to syslog


> When I do Ctrl-C I get:
>
> ip6tables: No chain/target/match by that name
>
> (I assume this is normal because I don't have any ip6tables chain - I
> get this on my gentoo machine that works OK)

correct; on shutdown blocking rules are flushed for consistency;  
iptables
and ip6tables are called for IPv4 and IPv6


> My /var/log/messages gives me these messages, but there is no sign
> that sshguard is being activated when a failed login occurs:
>
> Jun 27 17:48:06 etch sshguard[11412]: Started successfully
> [(a,p,s)=(4, 420, 1200)], now ready to scan.
> Jun 27 17:48:55 etch sshguard[11412]: Got exit signal, flushing
> blocked addresses and exiting...
>
> These are the messages I get in my logs when a failed login occurs (I
> tried disabling PAM):
>
> Jun 27 17:49:25 etch sshd[11521]: Failed password for robert from
> 192.168.2.40 port 33202 ssh2
> Jun 27 17:49:28 etch sshd[11523]: Failed password for robert from
> 192.168.2.40 port 33203 ssh2
> Jun 27 17:49:29 etch sshd[11523]: Failed password for robert from
> 192.168.2.40 port 33203 ssh2
>
> With PAM enabled I get these messages:
>
> Jun 27 17:58:28 etch sshd[11575]: (pam_unix) authentication failure;
> logname= uid=0 euid=0 tty=ssh ruser= rhost=myhost.mydomain.com.au
> user=robert
> Jun 27 17:58:31 etch sshd[11575]: Failed password for robert from
> 192.168.2.40 port 57699 ssh2
> Jun 27 17:58:33 etch sshd[11575]: Failed password for robert from
> 192.168.2.40 port 57699 ssh2
> Jun 27 17:58:36 etch sshd[11575]: Failed password for robert from
> 192.168.2.40 port 57699 ssh2
>
> I hope this is of some help.
>
> Robert.

it will not react if you start from the command line without feeding  
log messages.
You would try running "/usr/local/sbin/sshguard" from the command  
line and
pasting this line in its input (from keyboard)

Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4

paste it 4 times then check "iptables -L" to see if a drop rule for  
1.2.3.4 exist. Check
on another terminal without interrupting sshguard, otherwise it will  
flush all rules.

Then try feeding from tail. If attacks are not blocked then the only  
possibility
is that sshd is logging unrecognized messages. I definitely do not  
expect this.
Anyway, with "sshguard -d" (1.1beta) or compiling sshguard with - 
DDEBUG (use
"CFLAGS=-DDEBUG make -e" from the shell) (1.0) you have a report on  
stdout, eg

# tail -n0 -F /var/log/secure.log | tee -a /dev/stderr | ./src/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Jun 27 12:22:19 portabilis sshd[5355]: Invalid user asd from 127.0.0.1
Matched IP address 127.0.0.1
Jun 27 12:22:19 portabilis sshd[5355]: Failed none for invalid user  
asd from 127.0.0.1 port 49512 ssh2

(this is on Mac OS X).

If both these work, then the problem is in the way sshguard is called  
or messages are
passed to it from syslog-ng.

bye

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Robert S <rob...@gm...>]

> 2) for syslogd, external procs are not started when syslogd is
> restarted, but at the first occurrence of a log for them. So, restart
> syslogd and try a ssh login before checking ps.

I tried using syslog-ng - no luck.

> I am interested in your report. Could you please:
> 1) disable syslog config for sshguard
> 2) reinstall sshguard
> 3) run sshguard from the command line as
> /usr/local/sbin/sshguard

I have tried these things.  I get no output when I do this:

# /usr/local/sbin/sshguard

When I do Ctrl-C I get:

ip6tables: No chain/target/match by that name

(I assume this is normal because I don't have any ip6tables chain - I
get this on my gentoo machine that works OK)

My /var/log/messages gives me these messages, but there is no sign
that sshguard is being activated when a failed login occurs:

Jun 27 17:48:06 etch sshguard[11412]: Started successfully
[(a,p,s)=(4, 420, 1200)], now ready to scan.
Jun 27 17:48:55 etch sshguard[11412]: Got exit signal, flushing
blocked addresses and exiting...

These are the messages I get in my logs when a failed login occurs (I
tried disabling PAM):

Jun 27 17:49:25 etch sshd[11521]: Failed password for robert from
192.168.2.40 port 33202 ssh2
Jun 27 17:49:28 etch sshd[11523]: Failed password for robert from
192.168.2.40 port 33203 ssh2
Jun 27 17:49:29 etch sshd[11523]: Failed password for robert from
192.168.2.40 port 33203 ssh2

With PAM enabled I get these messages:

Jun 27 17:58:28 etch sshd[11575]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=myhost.mydomain.com.au
user=robert
Jun 27 17:58:31 etch sshd[11575]: Failed password for robert from
192.168.2.40 port 57699 ssh2
Jun 27 17:58:33 etch sshd[11575]: Failed password for robert from
192.168.2.40 port 57699 ssh2
Jun 27 17:58:36 etch sshd[11575]: Failed password for robert from
192.168.2.40 port 57699 ssh2

I hope this is of some help.

Robert.

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Mij <mi...@bi...>]

On 26/giu/07, at 13:50, Robert S wrote:

> I have installed sshguard using the following with debian/etch (the
> same occurs with ubuntu):
>
> ./configure --with-firewall=iptables --with-iptables=/sbin
> make
> make install
>
> I have used the recommended method for installation with syslog and
> syslog-ng.  In both cases sshguard won't start when I start
> syslog/syslog-ng - ie, it does not appear in the system log or when I
> do 'ps ax'.

for the archives, mind a couple of things on this problem:
1) some older syslogd implementations do not support forwarding
to external processes, and overwrite the binary with a FIFO; both
debian 3.1 and ubuntu feisty are among them afaik.
See http://sshguard.sourceforge.net/doc/setup/loggingsyslog.html

2) for syslogd, external procs are not started when syslogd is
restarted, but at the first occurrence of a log for them. So, restart
syslogd and try a ssh login before checking ps.


> If I use the "tail" method I get the following, and
> sshguard is not activated when a failed login occurs:
>
> # tail -n0 -F /var/log/auth.log | /usr/local/sbin/sshguard
> /usr/local/sbin/sshguard: line 1: syntax error near unexpected  
> token `('
> /usr/local/sbin/sshguard: line 1: `Jun 25 07:37:56 etch sshd[10186]:
> (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh
> ruser= rhost=myhost.mydomain.com.au  user=robert'
>
> This is strange, because when a failed login occurs, the following
> appears in my logs (I have tried disabling PAM):
>
> Jun 27 07:41:27 myhost sshd[19437]: Failed password for robert from
> 192.168.2.40 port 39753 ssh2
> Jun 27 07:41:28 myhost sshd[19437]: Failed password for robert from
> 192.168.2.40 port 39753 ssh2
> Jun 27 07:41:30 myhost sshd[19437]: Failed password for robert from
> 192.168.2.40 port 39753 ssh2

I am interested in your report. Could you please:
1) disable syslog config for sshguard
2) reinstall sshguard
[[ these ones are for making sure no former problem 1) applies ]]
3) run sshguard from the command line as
/usr/local/sbin/sshguard
(add the "-d" argument if you're using 1.0-beta1)

thanks


> I have installed it on a gentoo machine and it works flawlessly.
>
> Does anybody know how to get this to work?
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] sshguard exited on signal 6 (core dumped)

[Mij <mi...@bi...>]

I will have a look at this during the next week end.

thanks


On 24/giu/07, at 11:09, Hans Lambermont wrote:

> Hi all,
>
> I hope coredumping on 'syslogd reload' is not intended behaviour.
>
> System: FreeBSD 6.2-RELEASE, IPFW, sshguard-ipfw-1.0_1, syslog line :
>   auth.info;authpriv.info | exec /usr/local/sbin/sshguard -a 1
>
> ps axgwww | grep sshguard
> 51586  ??  Ss     0:00.01 /usr/local/sbin/sshguard -a 1
>
> /etc/rc.d/syslogd reload
> Reloading syslogd config files.
>
> 10:36:45 sshguard[51586]: Got exit signal, flushing blocked  
> addresses and exiting...
> 10:36:45 kernel: pid 51586 (sshguard), uid 0: exited on signal 6  
> (core dumped)
> 10:36:45 sshguard[55614]: Started successfully [(a,p,s)=(1, 420,  
> 1200)], now ready to scan.
>
> So the old sshguard dumps core, and the new one starts fine
> (and works too:
> 01:30:32 sshguard[55614]: Blocking 221.204.251.32: 2 failures over  
> 4 seconds.
> 01:30:32 sshguard[55614]: running: '/sbin/ipfw add 55021 drop ip  
> from 221.204.251.32 to me'
> 01:39:27 sshguard[55614]: Releasing 221.204.251.32 after 535 seconds.
> 01:39:27 sshguard[55614]: running: '/sbin/ipfw delete 55021'
> )
>
> Here's a backtrace of one of sshguard's coredumps:
>
> gdb /usr/local/sbin/sshguard /sshguard.core
> GNU gdb 6.1.1 [FreeBSD]
> Copyright 2004 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License,  
> and you are
> welcome to change it and/or distribute copies of it under certain  
> conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for  
> details.
> This GDB was configured as "i386-marcel-freebsd"...(no debugging  
> symbols found)...
> Core was generated by `sshguard'.
> Program terminated with signal 6, Aborted.
> Reading symbols from /lib/libpthread.so.2...(no debugging symbols  
> found)...done.
> Loaded symbols for /lib/libpthread.so.2
> Reading symbols from /lib/libc.so.6...(no debugging symbols  
> found)...done.
> Loaded symbols for /lib/libc.so.6
> Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols  
> found)...done.
> Loaded symbols for /libexec/ld-elf.so.1
> #0  0x280a7537 in pthread_testcancel () from /lib/libpthread.so.2
> [New Thread 0x805a400 (sleeping)]
> [New Thread 0x805a200 (LWP 100231)]
> [New Thread 0x805a000 (LWP 100234)]
> (gdb) bt
> #0  0x280a7537 in pthread_testcancel () from /lib/libpthread.so.2
> #1  0x2809689a in sigaction () from /lib/libpthread.so.2
> #2  0x2809088d in pthread_kill () from /lib/libpthread.so.2
> #3  0x28090256 in raise () from /lib/libpthread.so.2
> #4  0x28169b78 in abort () from /lib/libc.so.6
> #5  0x28106fdb in _UTF8_init () from /lib/libc.so.6
> #6  0xbfbfef58 in ?? ()
> #7  0x28170dd3 in sys_nsig () from /lib/libc.so.6
> #8  0x28170cd3 in sys_nsig () from /lib/libc.so.6
> #9  0x28170d30 in sys_nsig () from /lib/libc.so.6
> #10 0x00000000 in ?? ()
> #11 0x2817bd80 in ?? () from /lib/libc.so.6
> #12 0xbfbfed18 in ?? ()
> #13 0x28107009 in _UTF8_init () from /lib/libc.so.6
> #14 0x2817bd80 in ?? () from /lib/libc.so.6
> #15 0x08050bb0 in optarg ()
> #16 0xbfbfedc8 in ?? ()
> #17 0x28107d69 in _UTF8_init () from /lib/libc.so.6
> #18 0x00000000 in ?? ()
> #19 0xbfbfed64 in ?? ()
> #20 0x2807b200 in ?? ()
> #21 0x0104887f in ?? ()
> #22 0x0bea6495 in ?? ()
> #23 0x280bef6a in ?? () from /lib/libc.so.6
> #24 0x28074558 in ?? () from /libexec/ld-elf.so.1
> #25 0x280aa4b4 in ?? () from /lib/libpthread.so.2
> #26 0x08052800 in ?? ()
> #27 0x00000000 in ?? ()
> #28 0x00000000 in ?? ()
> #29 0x00000000 in ?? ()
> #30 0x28170dc5 in sys_nsig () from /lib/libc.so.6
> #31 0x00000001 in ?? ()
> #32 0xbfbfed9c in ?? ()
> #33 0x280a83d1 in __error () from /lib/libpthread.so.2
> Previous frame inner to this frame (corrupt stack?)
>
> I hope this is enough info, I can make a debug build if needed.
>
> So, is coredumping on 'syslogd reload' intended or is this a bug,  
> or am
> I doing something wrong ?
>
> regards,
>   Hans Lambermont
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] sshguard won't work on debian or ubuntu

[Robert S <rob...@gm...>]

I have installed sshguard using the following with debian/etch (the
same occurs with ubuntu):

./configure --with-firewall=iptables --with-iptables=/sbin
make
make install

I have used the recommended method for installation with syslog and
syslog-ng.  In both cases sshguard won't start when I start
syslog/syslog-ng - ie, it does not appear in the system log or when I
do 'ps ax'.  If I use the "tail" method I get the following, and
sshguard is not activated when a failed login occurs:

# tail -n0 -F /var/log/auth.log | /usr/local/sbin/sshguard
/usr/local/sbin/sshguard: line 1: syntax error near unexpected token `('
/usr/local/sbin/sshguard: line 1: `Jun 25 07:37:56 etch sshd[10186]:
(pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh
ruser= rhost=myhost.mydomain.com.au  user=robert'

This is strange, because when a failed login occurs, the following
appears in my logs (I have tried disabling PAM):

Jun 27 07:41:27 myhost sshd[19437]: Failed password for robert from
192.168.2.40 port 39753 ssh2
Jun 27 07:41:28 myhost sshd[19437]: Failed password for robert from
192.168.2.40 port 39753 ssh2
Jun 27 07:41:30 myhost sshd[19437]: Failed password for robert from
192.168.2.40 port 39753 ssh2

I have installed it on a gentoo machine and it works flawlessly.

Does anybody know how to get this to work?