sshguard-users

[SSHGuard-users] syslog-ng v3.5 with sshguard

[jungle B. <jun...@gm...>]

Hi All,

I'd like to use sshguard on a pine64 soc system with linux kernel
3.10.102-2-pine64-longsleep.

I have installed syslog-ng v3.5 from apt packages and I'm attempting
to configure sshguard + syslog-ng per this page:
http://www.sshguard.net/docs/setup/#syslog-ng


I believe there may be an issue with this line:

log { source(src); filter(f_sshguard); destination(sshguard); };

When that line is present in /etc/syslog-ng/syslog-ng.conf, I get this
when restarting syslog-ng:

sudo /etc/init.d/syslog-ng restart
Restarting syslog-ng (via systemctl): syslog-ng.serviceJob for
syslog-ng.service failed. See 'systemctl status syslog-ng.service' and
'journalctl -xn' for details.
 failed!

$ sudo systemctl status syslog-ng.service
â syslog-ng.service - System Logger Daemon
   Loaded: loaded (/lib/systemd/system/syslog-ng.service; enabled)
   Active: failed (Result: start-limit) since Mon 2016-08-08 19:03:05
UTC; 27s ago
     Docs: man:syslog-ng(8)
  Process: 32137 ExecStart=/usr/sbin/syslog-ng -F (code=exited, status=2)
 Main PID: 32137 (code=exited, status=2)
   Status: "Starting up... (Mon Aug  8 19:03:05 2016"

Aug 08 19:03:05 pine64 systemd[1]: Unit syslog-ng.service entered failed state.
Aug 08 19:03:05 pine64 systemd[1]: syslog-ng.service holdoff time
over, scheduling restart.
Aug 08 19:03:05 pine64 systemd[1]: Stopping System Logger Daemon...
Aug 08 19:03:05 pine64 systemd[1]: Starting System Logger Daemon...
Aug 08 19:03:05 pine64 systemd[1]: syslog-ng.service start request
repeated too quickly, refusing to start.
Aug 08 19:03:05 pine64 systemd[1]: Failed to start System Logger Daemon.
Aug 08 19:03:05 pine64 systemd[1]: Unit syslog-ng.service entered failed state.



Anyone have a valid log entry I can use for syslog 3.5?

Thanks!

-- 
-------
inum: 883510009027723
sip: jun...@si...

Re: [SSHGuard-users] syslog-ng v3.5 with sshguard

[Kevin Z. <kev...@gm...>]

On 08/08/2016 12:07, jungle Boogie wrote:
> I'd like to use sshguard on a pine64 soc system with linux kernel
> 3.10.102-2-pine64-longsleep.
> 
> I have installed syslog-ng v3.5 from apt packages and I'm attempting
> to configure sshguard + syslog-ng per this page:
> http://www.sshguard.net/docs/setup/#syslog-ng

I would recommend polling log files using sshg-logtail or the '-l'
option instead. Syslog daemons have a habit of sending SIGHUP to
SSHGuard at frequent intervals.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] syslog-ng v3.5 with sshguard

[jungle B. <jun...@gm...>]

Hi Kevin,
On 12 August 2016 at 13:30, Kevin Zheng <kev...@gm...> wrote:
> On 08/08/2016 12:07, jungle Boogie wrote:
>> I'd like to use sshguard on a pine64 soc system with linux kernel
>> 3.10.102-2-pine64-longsleep.
>>
>> I have installed syslog-ng v3.5 from apt packages and I'm attempting
>> to configure sshguard + syslog-ng per this page:
>> http://www.sshguard.net/docs/setup/#syslog-ng
>
> I would recommend polling log files using sshg-logtail or the '-l'
> option instead. Syslog daemons have a habit of sending SIGHUP to
> SSHGuard at frequent intervals.
>

Where can I find information about sshg-logtail?
Do you have a working example of sshguard + iptables + persistent log
monitoring?

Right now I'm doing:
/usr/local/sbin/sshguard -a 10 -l /var/log/auth.log -p 6000 &

This works but won't work after rebooting.

> Best,
> Kevin

Thanks!

>
> --
> Kevin Zheng
> kev...@gm... | ke...@be... | PGP: 0xC22E1090
>

-------
inum: 883510009027723
sip: jun...@si...

Re: [SSHGuard-users] syslog-ng v3.5 with sshguard

[Kevin Z. <kev...@gm...>]

On 08/12/2016 14:00, jungle Boogie wrote:
> Where can I find information about sshg-logtail?
> Do you have a working example of sshguard + iptables + persistent log
> monitoring?

Using '-l' should be fine.

> Right now I'm doing:
> /usr/local/sbin/sshguard -a 10 -l /var/log/auth.log -p 6000 &
> 
> This works but won't work after rebooting.

What do you mean it doesn't work after rebooting? Is it that the logs
don't get monitored, attackers need to be re-blocked, or something else?

Thanks,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090

Re: [SSHGuard-users] syslog-ng v3.5 with sshguard

[jungle B. <jun...@gm...>]

On 12 August 2016 at 14:11, Kevin Zheng <kev...@gm...> wrote:
> What do you mean it doesn't work after rebooting? Is it that the logs
> don't get monitored, attackers need to be re-blocked, or something else?

Sorry for not being clear enough.

It means after I reboot, I need to login and run the same command above.
Would putting that in /etc/init.d as a script be good enough to have
it launch after reboots?


-- 
-------
inum: 883510009027723
sip: jun...@si...

Re: [SSHGuard-users] syslog-ng v3.5 with sshguard

[Kevin Z. <kev...@gm...>]

On 08/12/2016 14:47, jungle Boogie wrote:
> It means after I reboot, I need to login and run the same command above.
> Would putting that in /etc/init.d as a script be good enough to have
> it launch after reboots?

I'm not the Linux expert here. If you installed via a distribution's
package manager, there should be startup scripts for SSHGuard. If you
use systemd, there's a sample unit file in examples/sshguard.service.
Throwing it into init.d/ should also work, but check your distribution's
documentation.

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090