sshguard-users — User questions and answers, bugs, and general support

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Robert S <rob...@gm...>]

> You would try running "/usr/local/sbin/sshguard" from the command
> line and
> pasting this line in its input (from keyboard)
>
> Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
>

This seems to work (compiled with debugging):

# /usr/local/sbin/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
Matched IP address 1.2.3.4
Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
Matched IP address 1.2.3.4
Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
Matched IP address 1.2.3.4
Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4
Matched IP address 1.2.3.4
Blocking 1.2.3.4: 4 failures over 3 seconds.

Setting environment: SSHG_ADDR=1.2.3.4;SSHG_ADDRKIND=4;SSHG_SERVICE=10.
Run command "case $SSHG_ADDRKIND in 4) exec /sbin/iptables -A sshguard
-s $SSHG_ADDR -j DROP ;; 6) exec /sbin/ip6tables -A sshguard -s
$SSHG_ADDR -j DROP ;; *) exit -2 ;; esac": exited 0.
Got exit signal, flushing blocked addresses and exiting...
ip6tables: No chain/target/match by that name
Run command "/sbin/iptables -F sshguard ; /sbin/ip6tables -F
sshguard": exited 256.

> paste it 4 times then check "iptables -L" to see if a drop rule for

This confirms that the address 1.2.3.4 is DROPed

> # tail -n0 -F /var/log/secure.log | tee -a /dev/stderr | ./src/sshguard

No luck when I use a username that exists on the system:

# tail -n0 -F /var/log/messages | tee -a /dev/stderr | /usr/local/sbin/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Jun 28 07:13:28 etch sshd[5789]: Failed password for robert from
192.168.2.40 port 40727 ssh2
Jun 28 07:13:34 etch sshd[5798]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
user=robert
Jun 28 07:13:37 etch sshd[5798]: Failed password for robert from
192.168.2.40 port 40729 ssh2
Jun 28 07:13:39 etch sshd[5798]: Failed password for robert from
192.168.2.40 port 40729 ssh2
Jun 28 07:13:42 etch sshd[5798]: Failed password for robert from
192.168.2.40 port 40729 ssh2
Jun 28 07:13:48 etch sshd[5800]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
user=robert
Jun 28 07:13:49 etch sshd[5800]: Failed password for robert from
192.168.2.40 port 40730 ssh2
Jun 28 07:13:52 etch sshd[5800]: Failed password for robert from
192.168.2.40 port 40730 ssh2
Jun 28 07:13:56 etch sshd[5800]: Failed password for robert from
192.168.2.40 port 40730 ssh2
<etc>

On the other hand - if I use a non-existent user the following happens:

# tail -n0 -F /var/log/messages | tee -a /dev/stderr | /usr/local/sbin/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Jun 28 07:24:44 etch sshd[5922]: Invalid user foobar from 192.168.2.40
Jun 28 07:24:45 etch sshd[5922]: Failed none for invalid user foobar
from 192.168.2.40 port 58171 ssh2
Matched IP address 192.168.2.40
Jun 28 07:24:48 etch sshd[5922]: (pam_unix) check pass; user unknown
Jun 28 07:24:48 etch sshd[5922]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
Jun 28 07:24:50 etch sshd[5922]: Failed password for invalid user
foobar from 192.168.2.40 port 58171 ssh2
Jun 28 07:24:55 etch sshd[5922]: (pam_unix) check pass; user unknown
Jun 28 07:24:56 etch sshd[5922]: Failed password for invalid user
foobar from 192.168.2.40 port 58171 ssh2
Jun 28 07:25:01 etch sshd[5922]: (pam_unix) check pass; user unknown
Jun 28 07:25:03 etch sshd[5922]: Failed password for invalid user
foobar from 192.168.2.40 port 58171 ssh2
Jun 28 07:25:04 etch sshd[5924]: Invalid user foobar from 192.168.2.40
Jun 28 07:25:04 etch sshd[5924]: Failed none for invalid user foobar
from 192.168.2.40 port 58172 ssh2
Matched IP address 192.168.2.40
Jun 28 07:25:06 etch sshd[5924]: (pam_unix) check pass; user unknown
Jun 28 07:25:06 etch sshd[5924]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
Jun 28 07:25:09 etch sshd[5924]: Failed password for invalid user
foobar from 192.168.2.40 port 58172 ssh2
Jun 28 07:25:13 etch sshd[5924]: (pam_unix) check pass; user unknown
Jun 28 07:25:15 etch sshd[5924]: Failed password for invalid user
foobar from 192.168.2.40 port 58172 ssh2
Jun 28 07:25:16 etch sshd[5924]: (pam_unix) check pass; user unknown
Jun 28 07:25:18 etch sshd[5924]: Failed password for invalid user
foobar from 192.168.2.40 port 58172 ssh2
Jun 28 07:25:20 etch sshd[5926]: Invalid user foobar from 192.168.2.40
Jun 28 07:25:20 etch sshd[5926]: Failed none for invalid user foobar
from 192.168.2.40 port 58173 ssh2
Matched IP address 192.168.2.40
Jun 28 07:25:21 etch sshd[5926]: (pam_unix) check pass; user unknown
Jun 28 07:25:21 etch sshd[5926]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=basement.schmidli.com.au
Jun 28 07:25:23 etch sshd[5926]: Failed password for invalid user
foobar from 192.168.2.40 port 58173 ssh2
Jun 28 07:25:25 etch sshd[5928]: Invalid user foobar from 192.168.2.40
Jun 28 07:25:25 etch sshd[5928]: Failed none for invalid user foobar
from 192.168.2.40 port 58174 ssh2
Matched IP address 192.168.2.40
Blocking 192.168.2.40: 4 failures over 40 seconds.

Setting environment: SSHG_ADDR=192.168.2.40;SSHG_ADDRKIND=4;SSHG_SERVICE=10.
Run command "case $SSHG_ADDRKIND in 4) exec /sbin/iptables -A sshguard
-s $SSHG_ADDR -j DROP ;; 6) exec /sbin/ip6tables -A sshguard -s
$SSHG_ADDR -j DROP ;; *) exit -2 ;; esac": exited 0.

Strangely, I am still able to log into "etch".  iptables -L gives me:

Chain sshguard (0 references)
target     prot opt source               destination
DROP       0    --  myhost.mydomain.com.au  anywhere

Further - if I run sshguard with no input, and feed it "Failed
password for robert from 192.168.2.40 port 40727 ssh2", it does
nothing:

# /usr/local/sbin/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2
Failed password for robert from 192.168.2.40 port 40727 ssh2

It appears to me that sshguard doesn't recognise most of my log messages??

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Mij <mi...@bi...>]

On 27/giu/07, at 00:07, Robert S wrote:

>> 2) for syslogd, external procs are not started when syslogd is
>> restarted, but at the first occurrence of a log for them. So, restart
>> syslogd and try a ssh login before checking ps.
>
> I tried using syslog-ng - no luck.
>
>> I am interested in your report. Could you please:
>> 1) disable syslog config for sshguard
>> 2) reinstall sshguard
>> 3) run sshguard from the command line as
>> /usr/local/sbin/sshguard
>
> I have tried these things.  I get no output when I do this:
>
> # /usr/local/sbin/sshguard

this is the correct behaviour; it is expecting input to scan.
With 1.1beta you have "-d" to dump logging to standard output;
otherwise they go to syslog


> When I do Ctrl-C I get:
>
> ip6tables: No chain/target/match by that name
>
> (I assume this is normal because I don't have any ip6tables chain - I
> get this on my gentoo machine that works OK)

correct; on shutdown blocking rules are flushed for consistency;  
iptables
and ip6tables are called for IPv4 and IPv6


> My /var/log/messages gives me these messages, but there is no sign
> that sshguard is being activated when a failed login occurs:
>
> Jun 27 17:48:06 etch sshguard[11412]: Started successfully
> [(a,p,s)=(4, 420, 1200)], now ready to scan.
> Jun 27 17:48:55 etch sshguard[11412]: Got exit signal, flushing
> blocked addresses and exiting...
>
> These are the messages I get in my logs when a failed login occurs (I
> tried disabling PAM):
>
> Jun 27 17:49:25 etch sshd[11521]: Failed password for robert from
> 192.168.2.40 port 33202 ssh2
> Jun 27 17:49:28 etch sshd[11523]: Failed password for robert from
> 192.168.2.40 port 33203 ssh2
> Jun 27 17:49:29 etch sshd[11523]: Failed password for robert from
> 192.168.2.40 port 33203 ssh2
>
> With PAM enabled I get these messages:
>
> Jun 27 17:58:28 etch sshd[11575]: (pam_unix) authentication failure;
> logname= uid=0 euid=0 tty=ssh ruser= rhost=myhost.mydomain.com.au
> user=robert
> Jun 27 17:58:31 etch sshd[11575]: Failed password for robert from
> 192.168.2.40 port 57699 ssh2
> Jun 27 17:58:33 etch sshd[11575]: Failed password for robert from
> 192.168.2.40 port 57699 ssh2
> Jun 27 17:58:36 etch sshd[11575]: Failed password for robert from
> 192.168.2.40 port 57699 ssh2
>
> I hope this is of some help.
>
> Robert.

it will not react if you start from the command line without feeding  
log messages.
You would try running "/usr/local/sbin/sshguard" from the command  
line and
pasting this line in its input (from keyboard)

Jan 1 10:11:12 voodoo sshd[1234]: Invalid user admin from 1.2.3.4

paste it 4 times then check "iptables -L" to see if a drop rule for  
1.2.3.4 exist. Check
on another terminal without interrupting sshguard, otherwise it will  
flush all rules.

Then try feeding from tail. If attacks are not blocked then the only  
possibility
is that sshd is logging unrecognized messages. I definitely do not  
expect this.
Anyway, with "sshguard -d" (1.1beta) or compiling sshguard with - 
DDEBUG (use
"CFLAGS=-DDEBUG make -e" from the shell) (1.0) you have a report on  
stdout, eg

# tail -n0 -F /var/log/secure.log | tee -a /dev/stderr | ./src/sshguard
Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.
Jun 27 12:22:19 portabilis sshd[5355]: Invalid user asd from 127.0.0.1
Matched IP address 127.0.0.1
Jun 27 12:22:19 portabilis sshd[5355]: Failed none for invalid user  
asd from 127.0.0.1 port 49512 ssh2

(this is on Mac OS X).

If both these work, then the problem is in the way sshguard is called  
or messages are
passed to it from syslog-ng.

bye

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Robert S <rob...@gm...>]

> 2) for syslogd, external procs are not started when syslogd is
> restarted, but at the first occurrence of a log for them. So, restart
> syslogd and try a ssh login before checking ps.

I tried using syslog-ng - no luck.

> I am interested in your report. Could you please:
> 1) disable syslog config for sshguard
> 2) reinstall sshguard
> 3) run sshguard from the command line as
> /usr/local/sbin/sshguard

I have tried these things.  I get no output when I do this:

# /usr/local/sbin/sshguard

When I do Ctrl-C I get:

ip6tables: No chain/target/match by that name

(I assume this is normal because I don't have any ip6tables chain - I
get this on my gentoo machine that works OK)

My /var/log/messages gives me these messages, but there is no sign
that sshguard is being activated when a failed login occurs:

Jun 27 17:48:06 etch sshguard[11412]: Started successfully
[(a,p,s)=(4, 420, 1200)], now ready to scan.
Jun 27 17:48:55 etch sshguard[11412]: Got exit signal, flushing
blocked addresses and exiting...

These are the messages I get in my logs when a failed login occurs (I
tried disabling PAM):

Jun 27 17:49:25 etch sshd[11521]: Failed password for robert from
192.168.2.40 port 33202 ssh2
Jun 27 17:49:28 etch sshd[11523]: Failed password for robert from
192.168.2.40 port 33203 ssh2
Jun 27 17:49:29 etch sshd[11523]: Failed password for robert from
192.168.2.40 port 33203 ssh2

With PAM enabled I get these messages:

Jun 27 17:58:28 etch sshd[11575]: (pam_unix) authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=myhost.mydomain.com.au
user=robert
Jun 27 17:58:31 etch sshd[11575]: Failed password for robert from
192.168.2.40 port 57699 ssh2
Jun 27 17:58:33 etch sshd[11575]: Failed password for robert from
192.168.2.40 port 57699 ssh2
Jun 27 17:58:36 etch sshd[11575]: Failed password for robert from
192.168.2.40 port 57699 ssh2

I hope this is of some help.

Robert.

Re: [Sshguard-users] sshguard won't work on debian or ubuntu

[Mij <mi...@bi...>]

On 26/giu/07, at 13:50, Robert S wrote:

> I have installed sshguard using the following with debian/etch (the
> same occurs with ubuntu):
>
> ./configure --with-firewall=iptables --with-iptables=/sbin
> make
> make install
>
> I have used the recommended method for installation with syslog and
> syslog-ng.  In both cases sshguard won't start when I start
> syslog/syslog-ng - ie, it does not appear in the system log or when I
> do 'ps ax'.

for the archives, mind a couple of things on this problem:
1) some older syslogd implementations do not support forwarding
to external processes, and overwrite the binary with a FIFO; both
debian 3.1 and ubuntu feisty are among them afaik.
See http://sshguard.sourceforge.net/doc/setup/loggingsyslog.html

2) for syslogd, external procs are not started when syslogd is
restarted, but at the first occurrence of a log for them. So, restart
syslogd and try a ssh login before checking ps.


> If I use the "tail" method I get the following, and
> sshguard is not activated when a failed login occurs:
>
> # tail -n0 -F /var/log/auth.log | /usr/local/sbin/sshguard
> /usr/local/sbin/sshguard: line 1: syntax error near unexpected  
> token `('
> /usr/local/sbin/sshguard: line 1: `Jun 25 07:37:56 etch sshd[10186]:
> (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh
> ruser= rhost=myhost.mydomain.com.au  user=robert'
>
> This is strange, because when a failed login occurs, the following
> appears in my logs (I have tried disabling PAM):
>
> Jun 27 07:41:27 myhost sshd[19437]: Failed password for robert from
> 192.168.2.40 port 39753 ssh2
> Jun 27 07:41:28 myhost sshd[19437]: Failed password for robert from
> 192.168.2.40 port 39753 ssh2
> Jun 27 07:41:30 myhost sshd[19437]: Failed password for robert from
> 192.168.2.40 port 39753 ssh2

I am interested in your report. Could you please:
1) disable syslog config for sshguard
2) reinstall sshguard
[[ these ones are for making sure no former problem 1) applies ]]
3) run sshguard from the command line as
/usr/local/sbin/sshguard
(add the "-d" argument if you're using 1.0-beta1)

thanks


> I have installed it on a gentoo machine and it works flawlessly.
>
> Does anybody know how to get this to work?
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] sshguard exited on signal 6 (core dumped)

[Mij <mi...@bi...>]

I will have a look at this during the next week end.

thanks


On 24/giu/07, at 11:09, Hans Lambermont wrote:

> Hi all,
>
> I hope coredumping on 'syslogd reload' is not intended behaviour.
>
> System: FreeBSD 6.2-RELEASE, IPFW, sshguard-ipfw-1.0_1, syslog line :
>   auth.info;authpriv.info | exec /usr/local/sbin/sshguard -a 1
>
> ps axgwww | grep sshguard
> 51586  ??  Ss     0:00.01 /usr/local/sbin/sshguard -a 1
>
> /etc/rc.d/syslogd reload
> Reloading syslogd config files.
>
> 10:36:45 sshguard[51586]: Got exit signal, flushing blocked  
> addresses and exiting...
> 10:36:45 kernel: pid 51586 (sshguard), uid 0: exited on signal 6  
> (core dumped)
> 10:36:45 sshguard[55614]: Started successfully [(a,p,s)=(1, 420,  
> 1200)], now ready to scan.
>
> So the old sshguard dumps core, and the new one starts fine
> (and works too:
> 01:30:32 sshguard[55614]: Blocking 221.204.251.32: 2 failures over  
> 4 seconds.
> 01:30:32 sshguard[55614]: running: '/sbin/ipfw add 55021 drop ip  
> from 221.204.251.32 to me'
> 01:39:27 sshguard[55614]: Releasing 221.204.251.32 after 535 seconds.
> 01:39:27 sshguard[55614]: running: '/sbin/ipfw delete 55021'
> )
>
> Here's a backtrace of one of sshguard's coredumps:
>
> gdb /usr/local/sbin/sshguard /sshguard.core
> GNU gdb 6.1.1 [FreeBSD]
> Copyright 2004 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License,  
> and you are
> welcome to change it and/or distribute copies of it under certain  
> conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for  
> details.
> This GDB was configured as "i386-marcel-freebsd"...(no debugging  
> symbols found)...
> Core was generated by `sshguard'.
> Program terminated with signal 6, Aborted.
> Reading symbols from /lib/libpthread.so.2...(no debugging symbols  
> found)...done.
> Loaded symbols for /lib/libpthread.so.2
> Reading symbols from /lib/libc.so.6...(no debugging symbols  
> found)...done.
> Loaded symbols for /lib/libc.so.6
> Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols  
> found)...done.
> Loaded symbols for /libexec/ld-elf.so.1
> #0  0x280a7537 in pthread_testcancel () from /lib/libpthread.so.2
> [New Thread 0x805a400 (sleeping)]
> [New Thread 0x805a200 (LWP 100231)]
> [New Thread 0x805a000 (LWP 100234)]
> (gdb) bt
> #0  0x280a7537 in pthread_testcancel () from /lib/libpthread.so.2
> #1  0x2809689a in sigaction () from /lib/libpthread.so.2
> #2  0x2809088d in pthread_kill () from /lib/libpthread.so.2
> #3  0x28090256 in raise () from /lib/libpthread.so.2
> #4  0x28169b78 in abort () from /lib/libc.so.6
> #5  0x28106fdb in _UTF8_init () from /lib/libc.so.6
> #6  0xbfbfef58 in ?? ()
> #7  0x28170dd3 in sys_nsig () from /lib/libc.so.6
> #8  0x28170cd3 in sys_nsig () from /lib/libc.so.6
> #9  0x28170d30 in sys_nsig () from /lib/libc.so.6
> #10 0x00000000 in ?? ()
> #11 0x2817bd80 in ?? () from /lib/libc.so.6
> #12 0xbfbfed18 in ?? ()
> #13 0x28107009 in _UTF8_init () from /lib/libc.so.6
> #14 0x2817bd80 in ?? () from /lib/libc.so.6
> #15 0x08050bb0 in optarg ()
> #16 0xbfbfedc8 in ?? ()
> #17 0x28107d69 in _UTF8_init () from /lib/libc.so.6
> #18 0x00000000 in ?? ()
> #19 0xbfbfed64 in ?? ()
> #20 0x2807b200 in ?? ()
> #21 0x0104887f in ?? ()
> #22 0x0bea6495 in ?? ()
> #23 0x280bef6a in ?? () from /lib/libc.so.6
> #24 0x28074558 in ?? () from /libexec/ld-elf.so.1
> #25 0x280aa4b4 in ?? () from /lib/libpthread.so.2
> #26 0x08052800 in ?? ()
> #27 0x00000000 in ?? ()
> #28 0x00000000 in ?? ()
> #29 0x00000000 in ?? ()
> #30 0x28170dc5 in sys_nsig () from /lib/libc.so.6
> #31 0x00000001 in ?? ()
> #32 0xbfbfed9c in ?? ()
> #33 0x280a83d1 in __error () from /lib/libpthread.so.2
> Previous frame inner to this frame (corrupt stack?)
>
> I hope this is enough info, I can make a debug build if needed.
>
> So, is coredumping on 'syslogd reload' intended or is this a bug,  
> or am
> I doing something wrong ?
>
> regards,
>   Hans Lambermont
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] sshguard won't work on debian or ubuntu

[Robert S <rob...@gm...>]

I have installed sshguard using the following with debian/etch (the
same occurs with ubuntu):

./configure --with-firewall=iptables --with-iptables=/sbin
make
make install

I have used the recommended method for installation with syslog and
syslog-ng.  In both cases sshguard won't start when I start
syslog/syslog-ng - ie, it does not appear in the system log or when I
do 'ps ax'.  If I use the "tail" method I get the following, and
sshguard is not activated when a failed login occurs:

# tail -n0 -F /var/log/auth.log | /usr/local/sbin/sshguard
/usr/local/sbin/sshguard: line 1: syntax error near unexpected token `('
/usr/local/sbin/sshguard: line 1: `Jun 25 07:37:56 etch sshd[10186]:
(pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh
ruser= rhost=myhost.mydomain.com.au  user=robert'

This is strange, because when a failed login occurs, the following
appears in my logs (I have tried disabling PAM):

Jun 27 07:41:27 myhost sshd[19437]: Failed password for robert from
192.168.2.40 port 39753 ssh2
Jun 27 07:41:28 myhost sshd[19437]: Failed password for robert from
192.168.2.40 port 39753 ssh2
Jun 27 07:41:30 myhost sshd[19437]: Failed password for robert from
192.168.2.40 port 39753 ssh2

I have installed it on a gentoo machine and it works flawlessly.

Does anybody know how to get this to work?

[Sshguard-users] sshguard exited on signal 6 (core dumped)

[<ha...@la...>]

Hi all,

I hope coredumping on 'syslogd reload' is not intended behaviour.

System: FreeBSD 6.2-RELEASE, IPFW, sshguard-ipfw-1.0_1, syslog line :
  auth.info;authpriv.info | exec /usr/local/sbin/sshguard -a 1

ps axgwww | grep sshguard
51586  ??  Ss     0:00.01 /usr/local/sbin/sshguard -a 1

/etc/rc.d/syslogd reload
Reloading syslogd config files.

10:36:45 sshguard[51586]: Got exit signal, flushing blocked addresses and exiting...
10:36:45 kernel: pid 51586 (sshguard), uid 0: exited on signal 6 (core dumped)
10:36:45 sshguard[55614]: Started successfully [(a,p,s)=(1, 420, 1200)], now ready to scan.

So the old sshguard dumps core, and the new one starts fine
(and works too:
01:30:32 sshguard[55614]: Blocking 221.204.251.32: 2 failures over 4 seconds.
01:30:32 sshguard[55614]: running: '/sbin/ipfw add 55021 drop ip from 221.204.251.32 to me'                                                                     
01:39:27 sshguard[55614]: Releasing 221.204.251.32 after 535 seconds.
01:39:27 sshguard[55614]: running: '/sbin/ipfw delete 55021'
)

Here's a backtrace of one of sshguard's coredumps:

gdb /usr/local/sbin/sshguard /sshguard.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...(no debugging symbols found)...
Core was generated by `sshguard'.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libpthread.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.2
Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols found)...done.
Loaded symbols for /libexec/ld-elf.so.1
#0  0x280a7537 in pthread_testcancel () from /lib/libpthread.so.2
[New Thread 0x805a400 (sleeping)]
[New Thread 0x805a200 (LWP 100231)]
[New Thread 0x805a000 (LWP 100234)]
(gdb) bt
#0  0x280a7537 in pthread_testcancel () from /lib/libpthread.so.2
#1  0x2809689a in sigaction () from /lib/libpthread.so.2
#2  0x2809088d in pthread_kill () from /lib/libpthread.so.2
#3  0x28090256 in raise () from /lib/libpthread.so.2
#4  0x28169b78 in abort () from /lib/libc.so.6
#5  0x28106fdb in _UTF8_init () from /lib/libc.so.6
#6  0xbfbfef58 in ?? ()
#7  0x28170dd3 in sys_nsig () from /lib/libc.so.6
#8  0x28170cd3 in sys_nsig () from /lib/libc.so.6
#9  0x28170d30 in sys_nsig () from /lib/libc.so.6
#10 0x00000000 in ?? ()
#11 0x2817bd80 in ?? () from /lib/libc.so.6
#12 0xbfbfed18 in ?? ()
#13 0x28107009 in _UTF8_init () from /lib/libc.so.6
#14 0x2817bd80 in ?? () from /lib/libc.so.6
#15 0x08050bb0 in optarg ()
#16 0xbfbfedc8 in ?? ()
#17 0x28107d69 in _UTF8_init () from /lib/libc.so.6
#18 0x00000000 in ?? ()
#19 0xbfbfed64 in ?? ()
#20 0x2807b200 in ?? ()
#21 0x0104887f in ?? ()
#22 0x0bea6495 in ?? ()
#23 0x280bef6a in ?? () from /lib/libc.so.6
#24 0x28074558 in ?? () from /libexec/ld-elf.so.1
#25 0x280aa4b4 in ?? () from /lib/libpthread.so.2
#26 0x08052800 in ?? ()
#27 0x00000000 in ?? ()
#28 0x00000000 in ?? ()
#29 0x00000000 in ?? ()
#30 0x28170dc5 in sys_nsig () from /lib/libc.so.6
#31 0x00000001 in ?? ()
#32 0xbfbfed9c in ?? ()
#33 0x280a83d1 in __error () from /lib/libpthread.so.2
Previous frame inner to this frame (corrupt stack?)

I hope this is enough info, I can make a debug build if needed.

So, is coredumping on 'syslogd reload' intended or is this a bug, or am
I doing something wrong ?

regards,
  Hans Lambermont

Re: [Sshguard-users] sshguard only blocks LAN attackers

[Akis M. <ph...@at...>]

O/H Mij έγραψε:
> hello akis
>
>
>   
>> Jun 17 23:51:53 sextus sshguard[3753]: Matched IP address  
>> 194.24.158.16
>> Jun 17 23:51:53 sextus sshguard[3753]: Blocking 194.24.158.16: 3  
>> failures over 12 seconds.
>>     
>
> good to see helpful debugging messages in your report, bravo.
> These pair of lines tells you that sshguard correctly resolved the  
> hostname to address 194.24.158.16,
> and then blocked this IP.
>
>
>   
>> iptables -L:
>>
>> Chain sshguard (0 references)
>> target     prot opt source               destination
>> DROP       0    --  lime-gw16.one.at     anywhere
>> DROP       0    --  lime-gw16.one.at     anywhere
>> DROP       0    --  lime-gw16.one.at     anywhere
>> DROP       0    --  lime-gw16.one.at     anywhere
>> DROP       0    --  lime-gw16.one.at     anywhere
>> DROP       0    --  lime-gw16.one.at     anywhere
>> DROP       0    --  lime-gw16.one.at     anywhere
>>
>>
>>
>> The strange thing, is that the DROP Rule, contains the hostname of the
>> "attacker", and NOT the IP address.
>>     
>
> this is iptables reversing addresses for better readability: with  
> "iptables -Ln" you should
> get 194.24.158.16 .
>
> sshguard did its job in putting the blocking rule in the "sshguard"  
> chain, so I guess
> this address is not blocked because you have not demanded the INPUT  
> chain to this one,
> possible?
>
> "iptables -Ln" should give you
>
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
> sshguard   tcp  --  anywhere             anywhere            tcp dpt:ssh
>
> [...]
>
> if this is missing, follow the commands in
> http://sshguard.sourceforge.net/doc/setup/blockingiptables.html
>
> bye
>
>   
>> Running an nslookup  in lime-gw16.one.at gives:
>>
>> Server:         193.92.150.3
>> Address:        193.92.150.3#53
>>
>> Non-authoritative answer:
>> Name:   lime-gw16.one.at
>> Address: 194.24.158.16
>>
>> Which successfully resolves to the "attacker' s" IP. But does not  
>> block
>> the attacker..
>> What is going wrong? I guess it has something to do with the hostname
>> and not the IP in the drop Rule.
>>
>>
>>
>>
>> P.S.
>> I should point out, that the detected "attacker's" IP is a friend of
>> mine, trying to test the behavior of sshguard, not an actual attacker.
>>
>>
>>
>>
>>
>>
>> ---------------------------------------------------------------------- 
>> ---
>> This SF.net email is sponsored by DB2 Express
>> Download DB2 Express C - the FREE version of DB2 express and take
>> control of your XML. No limits. Just data. Click to get it now.
>> http://sourceforge.net/powerbar/db2/
>> _______________________________________________
>> Sshguard-users mailing list
>> Ssh...@li...
>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>>     
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>
>
>   

oops,
I forgot to input this command: iptables -A INPUT -p tcp --dport 22 -j 
sshguard
Works like a charm now !
You were correct
Thank you Mij :)

Re: [Sshguard-users] sshguard only blocks LAN attackers

[Mij <mi...@bi...>]

hello akis


> Jun 17 23:51:53 sextus sshguard[3753]: Matched IP address  
> 194.24.158.16
> Jun 17 23:51:53 sextus sshguard[3753]: Blocking 194.24.158.16: 3  
> failures over 12 seconds.

good to see helpful debugging messages in your report, bravo.
These pair of lines tells you that sshguard correctly resolved the  
hostname to address 194.24.158.16,
and then blocked this IP.


> iptables -L:
>
> Chain sshguard (0 references)
> target     prot opt source               destination
> DROP       0    --  lime-gw16.one.at     anywhere
> DROP       0    --  lime-gw16.one.at     anywhere
> DROP       0    --  lime-gw16.one.at     anywhere
> DROP       0    --  lime-gw16.one.at     anywhere
> DROP       0    --  lime-gw16.one.at     anywhere
> DROP       0    --  lime-gw16.one.at     anywhere
> DROP       0    --  lime-gw16.one.at     anywhere
>
>
>
> The strange thing, is that the DROP Rule, contains the hostname of the
> "attacker", and NOT the IP address.

this is iptables reversing addresses for better readability: with  
"iptables -Ln" you should
get 194.24.158.16 .

sshguard did its job in putting the blocking rule in the "sshguard"  
chain, so I guess
this address is not blocked because you have not demanded the INPUT  
chain to this one,
possible?

"iptables -Ln" should give you

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
sshguard   tcp  --  anywhere             anywhere            tcp dpt:ssh

[...]

if this is missing, follow the commands in
http://sshguard.sourceforge.net/doc/setup/blockingiptables.html

bye

> Running an nslookup  in lime-gw16.one.at gives:
>
> Server:         193.92.150.3
> Address:        193.92.150.3#53
>
> Non-authoritative answer:
> Name:   lime-gw16.one.at
> Address: 194.24.158.16
>
> Which successfully resolves to the "attacker' s" IP. But does not  
> block
> the attacker..
> What is going wrong? I guess it has something to do with the hostname
> and not the IP in the drop Rule.
>
>
>
>
> P.S.
> I should point out, that the detected "attacker's" IP is a friend of
> mine, trying to test the behavior of sshguard, not an actual attacker.
>
>
>
>
>
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] sshguard only blocks LAN attackers

[Akis M. <ph...@at...>]

Hello,

Trying to get sshguard to work, I've come to a strange problem.
Testing it from LAN environment, sshguard successfully blocks the LAN 
attacker.

In the case the attacker is from an non LAN IP, it detects the attack 
and applies the IPTABLE rule

/var/log/auth.log:

Jun 17 23:46:48 sextus sshd[4590]: Invalid user avl from 194.24.158.16
Jun 17 23:46:48 sextus sshd[4590]: Failed none for invalid user avl from 
194.24.158.16 port 28446 ssh2
Jun 17 23:46:49 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:46:49 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:47:49 sextus sshd(pam_unix)[4590]: check pass; user unknown
Jun 17 23:47:49 sextus sshd(pam_unix)[4590]: authentication failure; 
logname= uid=0 euid=0 tty=ssh ruser= rhost=194.24.158.16
Jun 17 23:47:51 sextus sshd[4590]: Failed password for invalid user avl 
from 194.24.158.16 port 28446 ssh2
Jun 17 23:47:52 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:47:52 sextus sshguard[3753]: Blocking 194.24.158.16: 3 
failures over 63 seconds.
Jun 17 23:47:52 sextus sshguard[3753]: Running command "/usr/sbin/iptables"
Jun 17 23:49:07 sextus sshd[4609]: Invalid user avl from 194.24.158.16
Jun 17 23:49:07 sextus sshd[4609]: Failed none for invalid user avl from 
194.24.158.16 port 28723 ssh2
Jun 17 23:49:08 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:49:08 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:49:44 sextus sshd(pam_unix)[4609]: check pass; user unknown
Jun 17 23:49:44 sextus sshd(pam_unix)[4609]: authentication failure; 
logname= uid=0 euid=0 tty=ssh ruser= rhost=lime-gw16.one.at
Jun 17 23:49:46 sextus sshd[4609]: Failed password for invalid user avl 
from 194.24.158.16 port 28723 ssh2
Jun 17 23:49:47 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:49:47 sextus sshguard[3753]: Blocking 194.24.158.16: 3 
failures over 39 seconds.
Jun 17 23:49:47 sextus sshguard[3753]: Running command "/usr/sbin/iptables"
Jun 17 23:49:57 sextus sshd(pam_unix)[4609]: check pass; user unknown
Jun 17 23:49:58 sextus sshd[4609]: Failed password for invalid user avl 
from 194.24.158.16 port 28723 ssh2
Jun 17 23:49:59 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:50:10 sextus sshd(pam_unix)[4609]: check pass; user unknown
Jun 17 23:50:13 sextus sshd[4609]: Failed password for invalid user avl 
from 194.24.158.16 port 28723 ssh2
Jun 17 23:50:14 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:50:29 sextus sshd[4631]: Invalid user avl from 194.24.158.16
Jun 17 23:50:29 sextus sshd[4631]: Failed none for invalid user avl from 
194.24.158.16 port 28926 ssh2
Jun 17 23:50:30 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:50:30 sextus sshguard[3753]: Blocking 194.24.158.16: 3 
failures over 31 seconds.
Jun 17 23:50:30 sextus sshguard[3753]: Running command "/usr/sbin/iptables"
Jun 17 23:50:30 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:50:34 sextus sshd(pam_unix)[4631]: check pass; user unknown
Jun 17 23:50:34 sextus sshd(pam_unix)[4631]: authentication failure; 
logname= uid=0 euid=0 tty=ssh ruser= rhost=lime-gw16.one.at
Jun 17 23:50:36 sextus sshd[4631]: Failed password for invalid user avl 
from 194.24.158.16 port 28926 ssh2
Jun 17 23:50:37 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:50:43 sextus sshd(pam_unix)[4631]: check pass; user unknown
Jun 17 23:50:45 sextus sshd[4631]: Failed password for invalid user avl 
from 194.24.158.16 port 28926 ssh2
Jun 17 23:50:46 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:50:46 sextus sshguard[3753]: Blocking 194.24.158.16: 3 
failures over 16 seconds.
Jun 17 23:50:46 sextus sshguard[3753]: Running command "/usr/sbin/iptables"
Jun 17 23:50:50 sextus sshd(pam_unix)[4631]: check pass; user unknown
Jun 17 23:50:52 sextus sshd[4631]: Failed password for invalid user avl 
from 194.24.158.16 port 28926 ssh2
Jun 17 23:50:53 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:02 sextus sshd[4636]: Invalid user avl from 194.24.158.16
Jun 17 23:51:02 sextus sshd[4636]: Failed none for invalid user avl from 
194.24.158.16 port 28995 ssh2
Jun 17 23:51:02 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:02 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:02 sextus sshguard[3753]: Blocking 194.24.158.16: 3 
failures over 9 seconds.
Jun 17 23:51:02 sextus sshguard[3753]: Running command "/usr/sbin/iptables"
Jun 17 23:51:06 sextus sshd(pam_unix)[4636]: check pass; user unknown
Jun 17 23:51:06 sextus sshd(pam_unix)[4636]: authentication failure; 
logname= uid=0 euid=0 tty=ssh ruser= rhost=lime-gw16.one.at
Jun 17 23:51:08 sextus sshd[4636]: Failed password for invalid user avl 
from 194.24.158.16 port 28995 ssh2
Jun 17 23:51:09 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:10 sextus sshd[4636]: Failed password for invalid user avl 
from 194.24.158.16 port 28995 ssh2
Jun 17 23:51:11 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:14 sextus sshd(pam_unix)[4636]: check pass; user unknown
Jun 17 23:51:16 sextus sshd[4636]: Failed password for invalid user avl 
from 194.24.158.16 port 28995 ssh2
Jun 17 23:51:17 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:17 sextus sshguard[3753]: Blocking 194.24.158.16: 3 
failures over 8 seconds.
Jun 17 23:51:17 sextus sshguard[3753]: Running command "/usr/sbin/iptables"
Jun 17 23:51:40 sextus sshd[4650]: Invalid user \316\261\316\262\316\273 
from 194.24.158.16
Jun 17 23:51:40 sextus sshd[4650]: Failed none for invalid user 
\316\261\316\262\316\273 from 194.24.158.16 port 29166 ssh2
Jun 17 23:51:41 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:41 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:52 sextus sshd(pam_unix)[4650]: bad username [αβλ]
Jun 17 23:51:52 sextus sshd[4650]: Failed password for invalid user 
\316\261\316\262\316\273 from 194.24.158.16 port 29166 ssh2
Jun 17 23:51:53 sextus sshguard[3753]: Matched IP address 194.24.158.16
Jun 17 23:51:53 sextus sshguard[3753]: Blocking 194.24.158.16: 3 
failures over 12 seconds.


iptables -L:

Chain sshguard (0 references)
target     prot opt source               destination                
DROP       0    --  lime-gw16.one.at     anywhere           
DROP       0    --  lime-gw16.one.at     anywhere           
DROP       0    --  lime-gw16.one.at     anywhere           
DROP       0    --  lime-gw16.one.at     anywhere           
DROP       0    --  lime-gw16.one.at     anywhere           
DROP       0    --  lime-gw16.one.at     anywhere           
DROP       0    --  lime-gw16.one.at     anywhere           
         


The strange thing, is that the DROP Rule, contains the hostname of the 
"attacker", and NOT the IP address.
Running an nslookup  in lime-gw16.one.at gives:

Server:         193.92.150.3
Address:        193.92.150.3#53

Non-authoritative answer:
Name:   lime-gw16.one.at
Address: 194.24.158.16

Which successfully resolves to the "attacker' s" IP. But does not block 
the attacker..
What is going wrong? I guess it has something to do with the hostname 
and not the IP in the drop Rule.




P.S.
I should point out, that the detected "attacker's" IP is a friend of 
mine, trying to test the behavior of sshguard, not an actual attacker.

[Sshguard-users] sshguard 1.0 stable released

[Mij <mi...@bi...>]

I have finally released sshguard 1.0 stable.

This major version has a lot of new features with respect to 0.9,  
notably
support for IPv6, address whitelisting and a powerful parser that  
supports
several logging formats (like multilog) and automatically recognizes
and translates host names in log messages.

The relevant hooks for more informations are wrapped here:

http://sourceforge.net/forum/forum.php?forum_id=701923

The source code is available here:

http://downloads.sourceforge.net/sshguard/sshguard-1.0.tar.bz2

bye

Re: [Sshguard-users] sshguard 1.0 create huge amount log in suse 10.1 with default setting

[Mij <mi...@bi...>]

On 22/mag/07, at 05:36, Truffe Champagne wrote:

> Hi Mij
>
> I have solved the message loop problem specifying in the
> /etc/syslog-ng/syslog-ng.conf,
>
>   filter sshlogs { facility(auth, authpriv) and match('^sshd\['); };
>   destination sshguardproc { program("/usr/local/sbin/sshguard"
> template("$DATE $FULLHOST $MESSAGE\n")); };
>   log { source(src); filter(sshlogs); destination(sshguardproc); };
>
> "match('^sshd\[')" can solve the problem.  If this is not specified,
> message containing
> "sshd" in any position in the log can be parsed into sshguard.

This is correct because the parsing result logging includes the original
string, which contained sshd and is then passed again in a loop.
Sorry for having missed that.


> I think it's better to include this instruction for README/manuals.  
> Otherwise,
> some people could get huge log files and use up disk quota :-)

I have chosen to remove that parser result logging, which is definitely
excessive even for DEBUG. This is simpler, cleaner and spares some
load to the logging system. This will appear in beta3, along with a  
slighlty
modified backend for iptables.

If you like to apply this modification immediately, you can remove the
sshguard_log() line in src/sshguard.c, line 142 and recompile the app.

thanks for your trials and reports


> Thanks,
> truffe.
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

Re: [Sshguard-users] sshguard 1.0 create huge amount log in suse 10.1 with default setting

[Truffe C. <tru...@gm...>]

Hi Mij

I have solved the message loop problem specifying in the
/etc/syslog-ng/syslog-ng.conf,

  filter sshlogs { facility(auth, authpriv) and match('^sshd\['); };
  destination sshguardproc { program("/usr/local/sbin/sshguard"
template("$DATE $FULLHOST $MESSAGE\n")); };
  log { source(src); filter(sshlogs); destination(sshguardproc); };

"match('^sshd\[')" can solve the problem.  If this is not specified,
message containing
"sshd" in any position in the log can be parsed into sshguard.

I think it's better to include this instruction for README/manuals. Otherwise,
some people could get huge log files and use up disk quota :-)

Thanks,
truffe.

Re: [Sshguard-users] sshguard 1.0 create huge amount log in suse 10.1 with default setting

[Truffe C. <tru...@gm...>]

Hi Mij,

> If you use syslog-ng I suggest you to go the simpler (#2): specify
> the following
> filter for sshguard
>              filter sshlogs { facility(auth, authpriv) and match
> ("sshd"); };

According to the instruction, I have included following lines in the
/etc/syslog-ng/syslog-ng.conf:
filter sshlogs { facility(auth, authpriv) and match("sshd"); };
destination sshguardproc { program("/usr/local/sbin/sshguard"
template("$DATE $FULLHOST $MESSAGE\n")); };
log { source(src); filter(sshlogs); destination(sshguardproc); };

Then syslog-ng was restarted well with following message:
May 22 11:01:57 hostname sshguard[4098]: Started successfully
[(a,p,s)=(4, 420, 1200)], now ready to scan.

However, at the first remote ssh login after restarting syslog-ng,
same message loop happened.
If I use tail option, tail -n0 -F /var/log/messages | /usr/local/sbin/sshguard,
I got similar result.

truffe


> On 21/mag/07, at 19:09, Truffe Champagne wrote:
>
> > I have installed sshguard-1.0beta2 on suse 10.1 with iptables,
> > following instruction described in README.
> > Installation and configuration following README seemed to work fine.
> >
> > However, after killall -HUP syslog-ng, HUGE amount
> > (several GBs in a few minutes) of log is written in /var/log/
> > messages .
> > The messages are just in finite repeat of following message:
> >
> > ++++++++++++++++++++++++++++++++++
> > May 22 01:54:01 hostname sshguard[24897]: Parsing line 'May 22
> > 01:54:01 hostname sshguard[24897]: Parsing line 'May 22 01:54:01
> > hostname sshguard[24897]: Parsing line 'May22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> > sshguard[24897]: Parsing line 'May 22 01:54:01 mesioa sshguard[24897]:
> > Parsing line 'May 22 01:54:01 hostname sshguard[24897]: Parsing line
> > 'May 22 01:42:13 hostname sshd': skip. ': skip. ': skip. ': skip. ':
> > skip. ': skip. ': skip. ': skip. ': skip. ': skip. ': skip. ': skip.
> > ': skip.
> > ++++++++++++++++++++++++++++++++++
> >
> > Now sshguard is stopped by commenting syslog-ng conf file and restart
> > syslog-ng.
> >
> > Probably I have mistaken at some steps in configuration.
> > Is someone tell me what is wrong in my configuration?
> >
> > Thanks,
> >
> > ----------------------------------------------------------------------
> > ---
> > This SF.net email is sponsored by DB2 Express
> > Download DB2 Express C - the FREE version of DB2 express and take
> > control of your XML. No limits. Just data. Click to get it now.
> > http://sourceforge.net/powerbar/db2/
> > _______________________________________________
> > Sshguard-users mailing list
> > Ssh...@li...
> > https://lists.sourceforge.net/lists/listinfo/sshguard-users
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

Re: [Sshguard-users] sshguard 1.0 create huge amount log in suse 10.1 with default setting

[Mij <mi...@bi...>]

Truffe,

this is the mechanism that causes that loop:
1) log lines of the auth facility are given to sshguard
2) sshguard parses each line; the parser generates a log message
with "debug" level on its work result. All sshguard logging happens to
the auth facility
3) syslog takes these logs back to sshguard which then generates
further logging

I was aware of this possibility and relied on either of these  
assumptions
for avoiding step 3 (and thus the whole loop):
# debug logs are typically discarded or directed to a specific log  
file, e.g. "debug.log"
# log messages with "sshd" are filtered before passing to sshguard

If you use syslog-ng I suggest you to go the simpler (#2): specify  
the following
filter for sshguard
             filter sshlogs { facility(auth, authpriv) and match 
("sshd"); };

In the future I will possibly remove that debug message.

Thanks for making me put this remark on the archives.


On 21/mag/07, at 19:09, Truffe Champagne wrote:

> I have installed sshguard-1.0beta2 on suse 10.1 with iptables,
> following instruction described in README.
> Installation and configuration following README seemed to work fine.
>
> However, after killall -HUP syslog-ng, HUGE amount
> (several GBs in a few minutes) of log is written in /var/log/ 
> messages .
> The messages are just in finite repeat of following message:
>
> ++++++++++++++++++++++++++++++++++
> May 22 01:54:01 hostname sshguard[24897]: Parsing line 'May 22
> 01:54:01 hostname sshguard[24897]: Parsing line 'May 22 01:54:01
> hostname sshguard[24897]: Parsing line 'May22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
> sshguard[24897]: Parsing line 'May 22 01:54:01 mesioa sshguard[24897]:
> Parsing line 'May 22 01:54:01 hostname sshguard[24897]: Parsing line
> 'May 22 01:42:13 hostname sshd': skip. ': skip. ': skip. ': skip. ':
> skip. ': skip. ': skip. ': skip. ': skip. ': skip. ': skip. ': skip.
> ': skip.
> ++++++++++++++++++++++++++++++++++
>
> Now sshguard is stopped by commenting syslog-ng conf file and restart
> syslog-ng.
>
> Probably I have mistaken at some steps in configuration.
> Is someone tell me what is wrong in my configuration?
>
> Thanks,
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] sshguard 1.0 create huge amount log in suse 10.1 with default setting

[Truffe C. <tru...@gm...>]

I have installed sshguard-1.0beta2 on suse 10.1 with iptables,
following instruction described in README.
Installation and configuration following README seemed to work fine.

However, after killall -HUP syslog-ng, HUGE amount
(several GBs in a few minutes) of log is written in /var/log/messages .
The messages are just in finite repeat of following message:

++++++++++++++++++++++++++++++++++
May 22 01:54:01 hostname sshguard[24897]: Parsing line 'May 22
01:54:01 hostname sshguard[24897]: Parsing line 'May 22 01:54:01
hostname sshguard[24897]: Parsing line 'May22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 hostname
sshguard[24897]: Parsing line 'May 22 01:54:01 mesioa sshguard[24897]:
Parsing line 'May 22 01:54:01 hostname sshguard[24897]: Parsing line
'May 22 01:42:13 hostname sshd': skip. ': skip. ': skip. ': skip. ':
skip. ': skip. ': skip. ': skip. ': skip. ': skip. ': skip. ': skip.
': skip.
++++++++++++++++++++++++++++++++++

Now sshguard is stopped by commenting syslog-ng conf file and restart
syslog-ng.

Probably I have mistaken at some steps in configuration.
Is someone tell me what is wrong in my configuration?

Thanks,

[Sshguard-users] sshguard release 1.0

[Mij <mi...@bi...>]

sshguard 1.0 has just been released.

While it has a lot of improvements, please notice that it is a beta  
version.

The announcement on the project news has more info on this release:

http://sourceforge.net/forum/forum.php?forum_id=693985

bye

Re: [Sshguard-users] Adding whitelist regex

[Mij <mi...@bi...>]

On 16/apr/07, at 19:51, Philip Kizer wrote:

> Through a series of links, I made my way to sshguard which looks
> functional enough for my systems that do not have pf(4) and its built-
> in limits available.  One of them was:
>
> 	http://hawking.nonlogic.org/#e2007-03-12T03_45_55.txt
>
> that also contains a modification to the SSHCRACK_REGEX pattern.

thank you for reporting this.
Covering *all* the possible attack patterns (they vary on different  
OSes) is tough
and I've thus provided

	http://sshguard.sourceforge.net/newattackpatt.php

for gathering and tracking them. I'm quite impressed I got more mails  
with
patches extending SSHCRACK_REGEX than example submissions to this page.

In any case, in version sshguard 1.0 (soon to be released)  
SSHCRACK_REGEX
does no longer exist (replaced by a grammar-based context-free parser).

The grammar of this parser will take into account the user-submitted  
extensions I
got for the regex.


>
> Playing with the program I also want to make sure certain hosts are
> never blocked for a variety of reasons.  Ideally I would prefer to
> match on a set of CIDR blocks/etc like I can innately with pf(4), but
> since some of my systems cannot do that I added another regex.

the whitelist thing is a very good idea for a new feature.
Anyway,a boolean function that takes the candidate IP and tells if it  
can be blocked
appears more elegant and flexible than a further parser.
White patterns could be added on the command line, e.g. with "-w  
10.11.12.0/24".


> Here is a patch that includes the one from the hawking page as well
> as a trivial white-list addition:
>
> diff -ru sshguard-0.91-orig/sshguard.c sshguard-0.91/sshguard.c
> --- sshguard-0.91-orig/sshguard.c	2007-02-10 09:40:17.000000000 -0600
> +++ sshguard-0.91/sshguard.c	2007-04-16 12:41:00.000000000 -0500
> @@ -41,6 +41,7 @@
> void sighand(int sig);
> regex_t crackre;
> +regex_t whitere;
> int main(int argc, char *argv[]) {
>       char ip[IP_LEN], logline[MAX_LOGLINE_LEN];
> @@ -56,6 +57,13 @@
>           exit(1);
>       }
> +    retv = regcomp(&whitere, SSHGUARD_WHITELIST, REG_EXTENDED);
> +    if (retv != 0) {
> +        regerror(retv, &whitere, logline, MAX_LOGLINE_LEN);
> +        fprintf(stderr, "%s\n", logline);
> +        exit(1);
> +    }
> +
>       list_init(&limbo);
>       list_init(&hell);
> @@ -107,13 +115,19 @@
>           /* extract the IP address */
>           extractIP(logline, ip, pmatch[REGEXIPENTRY].rm_so, pmatch
> [REGEXIPENTRY].rm_eo);
>           sshguard_log(LOG_DEBUG, "Matched IP address %s\n", ip);
> -
> +
> +        if ( regexec(&whitere, ip, 0, NULL, 0) == 0 ) {
> +            sshguard_log(LOG_DEBUG, "Ignoring IP address, matched
> whitelist: %s\n", ip);
> +            continue;
> +        }
> +
>           /* report IP */
>           reportIP(ip);
>       }
>       /* cleanup */
>       regfree(&crackre);
> +    regfree(&whitere);
>       if (fw_fin() != 0) sshguard_log(LOG_ERR, "Cound not finalize
> firewall.");
>       sshguard_log_fin();
> @@ -228,6 +242,7 @@
>       closelog();
>       regfree(&crackre);
> +    regfree(&whitere);
>       exit(0);
> }
> diff -ru sshguard-0.91-orig/sshguard.h sshguard-0.91/sshguard.h
> --- sshguard-0.91-orig/sshguard.h	2007-02-10 09:00:47.000000000 -0600
> +++ sshguard-0.91/sshguard.h	2007-04-16 12:41:15.000000000 -0500
> @@ -17,8 +17,10 @@
>    *
>    */
> /* regex for log entries representing brute force trials */
> -#define SSHCRACK_REGEX      "sshd\\[[0-9]+\\]: (Failed|Illegal user|
> Invalid user|User) .+from ((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]
> ([0-9])?)(\\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]([0-9])?|0)){3})
> ( not allowed)?"
> +#define SSHCRACK_REGEX	"sshd\\[[0-9]+\\]: (Failed|Illegal user|
> Invalid user|User|pam_unix\\(sshd:auth\\): authentication failure;).+
> (from |rhost=)((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]([0-9])?)(\\.(25
> [0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]([0-9])?|0)){3})( not allowed)?"
> /* field number in SSHCRACK_REGEX containing the attacker IP  
> address */
> -#define REGEXIPENTRY        2
> +#define REGEXIPENTRY        3
> +
> +#define SSHGUARD_WHITELIST	"ADD\\.SOME\\.IP\\.HERE|OR\\.SUBNET\
> \.BLOCK\\."
> #endif
>
>
> ---------------------------------------------------------------------- 
> ---
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] Adding whitelist regex

[Philip K. <pc...@no...>]

Through a series of links, I made my way to sshguard which looks  
functional enough for my systems that do not have pf(4) and its built- 
in limits available.  One of them was:

	http://hawking.nonlogic.org/#e2007-03-12T03_45_55.txt

that also contains a modification to the SSHCRACK_REGEX pattern.


Playing with the program I also want to make sure certain hosts are  
never blocked for a variety of reasons.  Ideally I would prefer to  
match on a set of CIDR blocks/etc like I can innately with pf(4), but  
since some of my systems cannot do that I added another regex.


Here is a patch that includes the one from the hawking page as well  
as a trivial white-list addition:

diff -ru sshguard-0.91-orig/sshguard.c sshguard-0.91/sshguard.c
--- sshguard-0.91-orig/sshguard.c	2007-02-10 09:40:17.000000000 -0600
+++ sshguard-0.91/sshguard.c	2007-04-16 12:41:00.000000000 -0500
@@ -41,6 +41,7 @@
void sighand(int sig);
regex_t crackre;
+regex_t whitere;
int main(int argc, char *argv[]) {
      char ip[IP_LEN], logline[MAX_LOGLINE_LEN];
@@ -56,6 +57,13 @@
          exit(1);
      }
+    retv = regcomp(&whitere, SSHGUARD_WHITELIST, REG_EXTENDED);
+    if (retv != 0) {
+        regerror(retv, &whitere, logline, MAX_LOGLINE_LEN);
+        fprintf(stderr, "%s\n", logline);
+        exit(1);
+    }
+
      list_init(&limbo);
      list_init(&hell);
@@ -107,13 +115,19 @@
          /* extract the IP address */
          extractIP(logline, ip, pmatch[REGEXIPENTRY].rm_so, pmatch 
[REGEXIPENTRY].rm_eo);
          sshguard_log(LOG_DEBUG, "Matched IP address %s\n", ip);
-
+
+        if ( regexec(&whitere, ip, 0, NULL, 0) == 0 ) {
+            sshguard_log(LOG_DEBUG, "Ignoring IP address, matched  
whitelist: %s\n", ip);
+            continue;
+        }
+
          /* report IP */
          reportIP(ip);
      }
      /* cleanup */
      regfree(&crackre);
+    regfree(&whitere);
      if (fw_fin() != 0) sshguard_log(LOG_ERR, "Cound not finalize  
firewall.");
      sshguard_log_fin();
@@ -228,6 +242,7 @@
      closelog();
      regfree(&crackre);
+    regfree(&whitere);
      exit(0);
}
diff -ru sshguard-0.91-orig/sshguard.h sshguard-0.91/sshguard.h
--- sshguard-0.91-orig/sshguard.h	2007-02-10 09:00:47.000000000 -0600
+++ sshguard-0.91/sshguard.h	2007-04-16 12:41:15.000000000 -0500
@@ -17,8 +17,10 @@
   *
   */
/* regex for log entries representing brute force trials */
-#define SSHCRACK_REGEX      "sshd\\[[0-9]+\\]: (Failed|Illegal user| 
Invalid user|User) .+from ((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9] 
([0-9])?)(\\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]([0-9])?|0)){3}) 
( not allowed)?"
+#define SSHCRACK_REGEX	"sshd\\[[0-9]+\\]: (Failed|Illegal user| 
Invalid user|User|pam_unix\\(sshd:auth\\): authentication failure;).+ 
(from |rhost=)((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]([0-9])?)(\\.(25 
[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]([0-9])?|0)){3})( not allowed)?"
/* field number in SSHCRACK_REGEX containing the attacker IP address */
-#define REGEXIPENTRY        2
+#define REGEXIPENTRY        3
+
+#define SSHGUARD_WHITELIST	"ADD\\.SOME\\.IP\\.HERE|OR\\.SUBNET\ 
\.BLOCK\\."
#endif

Re: [Sshguard-users] Release command failed

[David V. K. <dk...@su...>]

I have moved my SSH accept rule to a higher number than 55050 which  
solves the issues I mentioned. Many thanks for your prompt replies!

-David

On 03.04.2007, at 23:48, Mij wrote:

> I suppose you opted in for "Use IPFW as firewall backend".
>
> In this case, can you see blocking rules just after a "Blocking
> 1.2.3.4: 4 failures over X seconds"?
> get ipfw rules with "ipfw list". Sshguard rule IDs in IPFW range
> between 55000 and 55050 by default.
>
> It is likely that you have ssh enabled in a higher rules, so those
> blocking rules are not passed (IPFW
> has a "first match win" policy)
>
>
> On 03/apr/07, at 23:20, David V. Kocher wrote:
>
>> I use IPFW. The sshguard version installed is from ports
>> (sshguard-0.91_1) [1].
>>
>> -David
>>
>> [1] http://www.freshports.org/security/sshguard/
>>
>> On 03.04.2007, at 23:01, Mij wrote:
>>
>>> hello david
>>>
>>> what firewall are you using on you freebsd box? Is the sshguard fw
>>> backend consistent with it?
>>>
>>>
>>> On 03/apr/07, at 17:27, David V. Kocher wrote:
>>>
>>>> I can see the following in my log
>>>>> Apr  2 20:23:19 gdp-bsd-231-218 sshguard[118]: Blocking
>>>>> 195.140.140.35: 4 failures over 0 seconds.
>>>>> Apr  2 20:23:19 gdp-bsd-231-218 sshd[782]: Failed password for
>>>>> illegal user rpc from 195.140.140.35 port 47790 ssh2
>>>>> Apr  2 20:23:20 gdp-bsd-231-218 sshd[787]: Failed password for
>>>>> illegal user gopher from 195.140.140.35 port 47817 ssh2
>>>>> Apr  2 20:30:44 gdp-bsd-231-218 sshguard[118]: Release command
>>>>> failed. Exited: 17664
>>>>>
>>>>
>>>> I am wondering why there are still failed login attempts after
>>>> sshguard claims to have blocked the IP address in question and what
>>>> the 'Release command failed' error message which appears numerous
>>>> times means.
>>>>
>>>> My system is FreeBSD 5.4-RELEASE-p14.
>>>>
>>>> Thanks.
>>>> -David
>>>>
>>>> ------------------------------------------------------------------- 
>>>> -
>>>> --
>>>> ---
>>>> Take Surveys. Earn Cash. Influence the Future of IT
>>>> Join SourceForge.net's Techsay panel and you'll get the chance to
>>>> share your
>>>> opinions on IT & business topics through brief surveys-and earn  
>>>> cash
>>>> http://www.techsay.com/default.php?
>>>> page=join.php&p=sourceforge&CID=DEVDEV
>>>> _______________________________________________
>>>> Sshguard-users mailing list
>>>> Ssh...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>>>
>>>
>>> -------------------------------------------------------------------- 
>>> -
>>> ----
>>> Take Surveys. Earn Cash. Influence the Future of IT
>>> Join SourceForge.net's Techsay panel and you'll get the chance to
>>> share your
>>> opinions on IT & business topics through brief surveys-and earn cash
>>> http://www.techsay.com/default.php?
>>> page=join.php&p=sourceforge&CID=DEVDEV
>>> _______________________________________________
>>> Sshguard-users mailing list
>>> Ssh...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>>>
>>
>
>
> ---------------------------------------------------------------------- 
> ---
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to  
> share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php? 
> page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

Re: [Sshguard-users] Release command failed

[Mij <mi...@bi...>]

I suppose you opted in for "Use IPFW as firewall backend".

In this case, can you see blocking rules just after a "Blocking  
1.2.3.4: 4 failures over X seconds"?
get ipfw rules with "ipfw list". Sshguard rule IDs in IPFW range  
between 55000 and 55050 by default.

It is likely that you have ssh enabled in a higher rules, so those  
blocking rules are not passed (IPFW
has a "first match win" policy)


On 03/apr/07, at 23:20, David V. Kocher wrote:

> I use IPFW. The sshguard version installed is from ports  
> (sshguard-0.91_1) [1].
>
> -David
>
> [1] http://www.freshports.org/security/sshguard/
>
> On 03.04.2007, at 23:01, Mij wrote:
>
>> hello david
>>
>> what firewall are you using on you freebsd box? Is the sshguard fw
>> backend consistent with it?
>>
>>
>> On 03/apr/07, at 17:27, David V. Kocher wrote:
>>
>>> I can see the following in my log
>>>> Apr  2 20:23:19 gdp-bsd-231-218 sshguard[118]: Blocking
>>>> 195.140.140.35: 4 failures over 0 seconds.
>>>> Apr  2 20:23:19 gdp-bsd-231-218 sshd[782]: Failed password for
>>>> illegal user rpc from 195.140.140.35 port 47790 ssh2
>>>> Apr  2 20:23:20 gdp-bsd-231-218 sshd[787]: Failed password for
>>>> illegal user gopher from 195.140.140.35 port 47817 ssh2
>>>> Apr  2 20:30:44 gdp-bsd-231-218 sshguard[118]: Release command
>>>> failed. Exited: 17664
>>>>
>>>
>>> I am wondering why there are still failed login attempts after
>>> sshguard claims to have blocked the IP address in question and what
>>> the 'Release command failed' error message which appears numerous
>>> times means.
>>>
>>> My system is FreeBSD 5.4-RELEASE-p14.
>>>
>>> Thanks.
>>> -David
>>>
>>> -------------------------------------------------------------------- 
>>> --
>>> ---
>>> Take Surveys. Earn Cash. Influence the Future of IT
>>> Join SourceForge.net's Techsay panel and you'll get the chance to
>>> share your
>>> opinions on IT & business topics through brief surveys-and earn cash
>>> http://www.techsay.com/default.php?
>>> page=join.php&p=sourceforge&CID=DEVDEV
>>> _______________________________________________
>>> Sshguard-users mailing list
>>> Ssh...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>>
>>
>> --------------------------------------------------------------------- 
>> ----
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to  
>> share your
>> opinions on IT & business topics through brief surveys-and earn cash
>> http://www.techsay.com/default.php? 
>> page=join.php&p=sourceforge&CID=DEVDEV
>> _______________________________________________
>> Sshguard-users mailing list
>> Ssh...@li...
>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>>
>

Re: [Sshguard-users] Release command failed

[David V. K. <dk...@su...>]

I use IPFW. The sshguard version installed is from ports  
(sshguard-0.91_1) [1].

-David

[1] http://www.freshports.org/security/sshguard/

On 03.04.2007, at 23:01, Mij wrote:

> hello david
>
> what firewall are you using on you freebsd box? Is the sshguard fw
> backend consistent with it?
>
>
> On 03/apr/07, at 17:27, David V. Kocher wrote:
>
>> I can see the following in my log
>>> Apr  2 20:23:19 gdp-bsd-231-218 sshguard[118]: Blocking
>>> 195.140.140.35: 4 failures over 0 seconds.
>>> Apr  2 20:23:19 gdp-bsd-231-218 sshd[782]: Failed password for
>>> illegal user rpc from 195.140.140.35 port 47790 ssh2
>>> Apr  2 20:23:20 gdp-bsd-231-218 sshd[787]: Failed password for
>>> illegal user gopher from 195.140.140.35 port 47817 ssh2
>>> Apr  2 20:30:44 gdp-bsd-231-218 sshguard[118]: Release command
>>> failed. Exited: 17664
>>>
>>
>> I am wondering why there are still failed login attempts after
>> sshguard claims to have blocked the IP address in question and what
>> the 'Release command failed' error message which appears numerous
>> times means.
>>
>> My system is FreeBSD 5.4-RELEASE-p14.
>>
>> Thanks.
>> -David
>>
>> --------------------------------------------------------------------- 
>> -
>> ---
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to
>> share your
>> opinions on IT & business topics through brief surveys-and earn cash
>> http://www.techsay.com/default.php?
>> page=join.php&p=sourceforge&CID=DEVDEV
>> _______________________________________________
>> Sshguard-users mailing list
>> Ssh...@li...
>> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>
>
> ---------------------------------------------------------------------- 
> ---
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to  
> share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php? 
> page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

Re: [Sshguard-users] Release command failed

[Mij <mi...@bi...>]

hello david

what firewall are you using on you freebsd box? Is the sshguard fw  
backend consistent with it?


On 03/apr/07, at 17:27, David V. Kocher wrote:

> I can see the following in my log
>> Apr  2 20:23:19 gdp-bsd-231-218 sshguard[118]: Blocking
>> 195.140.140.35: 4 failures over 0 seconds.
>> Apr  2 20:23:19 gdp-bsd-231-218 sshd[782]: Failed password for
>> illegal user rpc from 195.140.140.35 port 47790 ssh2
>> Apr  2 20:23:20 gdp-bsd-231-218 sshd[787]: Failed password for
>> illegal user gopher from 195.140.140.35 port 47817 ssh2
>> Apr  2 20:30:44 gdp-bsd-231-218 sshguard[118]: Release command
>> failed. Exited: 17664
>>
>
> I am wondering why there are still failed login attempts after
> sshguard claims to have blocked the IP address in question and what
> the 'Release command failed' error message which appears numerous
> times means.
>
> My system is FreeBSD 5.4-RELEASE-p14.
>
> Thanks.
> -David
>
> ---------------------------------------------------------------------- 
> ---
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to  
> share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php? 
> page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users

[Sshguard-users] Release command failed

[David V. K. <dk...@su...>]

I can see the following in my log
> Apr  2 20:23:19 gdp-bsd-231-218 sshguard[118]: Blocking  
> 195.140.140.35: 4 failures over 0 seconds.
> Apr  2 20:23:19 gdp-bsd-231-218 sshd[782]: Failed password for  
> illegal user rpc from 195.140.140.35 port 47790 ssh2
> Apr  2 20:23:20 gdp-bsd-231-218 sshd[787]: Failed password for  
> illegal user gopher from 195.140.140.35 port 47817 ssh2
> Apr  2 20:30:44 gdp-bsd-231-218 sshguard[118]: Release command  
> failed. Exited: 17664
>

I am wondering why there are still failed login attempts after  
sshguard claims to have blocked the IP address in question and what  
the 'Release command failed' error message which appears numerous  
times means.

My system is FreeBSD 5.4-RELEASE-p14.

Thanks.
-David

Re: [Sshguard-users] Unable to start sshguard

[Mij <mi...@bi...>]

1) you must reload syslogd AND make sshd generate some logging before 
checking
2) check with "ps ax | grep sshguard", not top


On 2007-03-17 15:14:57 +0100 Noiano <no...@x-...> wrote:

> Mij wrote:
>> It may be the case that the space after the pipe symbol is taken as
>> program name. Please try
>> 
>> auth.info;authpriv.info		|/usr/local/sbin/sshguard
>> 
>> and let me know if it does not work.
> The error is not displayed any more. However sshguard is not listed in
> the top command. I assume there are still problems.
> 
> Noiano
> 
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to 
> share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV_______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>