sshguard-users — User questions and answers, bugs, and general support

Re: [Sshguard-users] I can't get it to work.

[Mij <mi...@bi...>]

> Hi all.
>
>    I installed sshguard on Open suse. by
>
> ./configure --prefix=/usr --with-firewall=iptables
>
> make
>
> su - root
>
> make install
>
> i add
> iptables -N sshguard
> iptables -A INPUT -p tcp --dport 22 -j sshguard

this is correct


> chmod +s /usr/sbin/sshguard

please don't make sshguard setuid. Besides being useless, this is very
lame and dangerous. A local user could simply run sshguard and feed it
some crafted lines of text with arbitrary IP addresses and make the
machine block them. This is a major mistake.


> then i edit
>
> /etc/syslog-ng/syslog-ng.conf
>
>
> concatenate
>
> filter sshlogs { facility(authpriv) and match(ssh); };
> destination sshguardproc { program("/usr/sbin/sshguard"); };
> log { source(src); filter(sshlogs); destination(sshguardproc); };
>
> killall -HUP syslog-ng

this is correct


> ln -s /usr/sbin/ip* /sbin/

not idea what this orrible thing should serve for :)


> then i ssh with the wrong password 3 times and it does sshguard does not
start automatically nor it blocks ip. I started sshguard manually with
-a 2
> -p 3& and it starts but it does not block ips.

sshguard detects attackers by analyzing log entries it's given in its
standard input. If it's not started by syslog-ng, the problem is in
syslog-ng configuration. But for spotting this problem, just try to run
sshguard manually like this (as root!):

tail -n0 -F /var/log/auth.log | /usr/sbin/sshguard

replace auth.log with the file in which sshd logs to, find it with:

cd /var/log
grep -rl 'sshd\[' .


> After i tried it on a redhat 3.0 AS test server. with a few variations
to the configuration but again it did not start the sshguard nor it
blocked the
> ip.
>
> Did i missed anything on the configuration?
>
> Any help is appreciated.

Please try to run sshguard as said above, try some logins as non-existent
user for example, and report what happens.


>
>
> Giovanni
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users
>

[Sshguard-users] I can't get it to work.

[Kuroro <inf...@gm...>]

Hi all.

   I installed sshguard on Open suse. by

./configure --prefix=/usr --with-firewall=iptables

make

su - root

make install

i add
iptables -N sshguard
iptables -A INPUT -p tcp --dport 22 -j sshguard

chmod +s /usr/sbin/sshguard

then i edit

/etc/syslog-ng/syslog-ng.conf


concatenate

filter sshlogs { facility(authpriv) and match(ssh); };
destination sshguardproc { program("/usr/sbin/sshguard"); };
log { source(src); filter(sshlogs); destination(sshguardproc); };

killall -HUP syslog-ng

ln -s /usr/sbin/ip* /sbin/

then i ssh with the wrong password 3 times and it does sshguard does not
start automatically nor it blocks ip. I started sshguard manually with -a 2
-p 3& and it starts but it does not block ips.

After i tried it on a redhat 3.0 AS test server. with a few variations to
the configuration but again it did not start the sshguard nor it blocked the
ip.

Did i missed anything on the configuration?

Any help is appreciated.


Giovanni

[Sshguard-users] Unable to start sshguard

[Noiano <no...@x-...>]

Hi everybody
I have a little problem with sshguard. I followed the instruction in the
readme file but syslogd says: "exec: /usr/local/sbin/sshguard : No such
file or directory". If i type that path on a command line and then I
execute ps

noiano    6731  0.0  0.0   9860   652 pts/1    Sl+  11:52   0:00
/usr/local/sbin/sshguard

sshguard seems running. Is this related to the fact that I have the sshd
logs stored in /var/log/daemon.log?

How can I realize if sshguard is running properly?

Thanks for your help