SSHGuard does not work

designator · 06-12-2009, 10:12 AM

I'm trying to protect CentOS 5.2 from brute force ssh attacks.

Downloaded SSHGuard, compiled and installed successfully, but it does not work.

I set it up according to instructions on their site. syslog.conf contains:

Code:

auth.info;authpriv.info    |/usr/local/sbin/sshguard

I also logged the same thing to a file to make sure syslog works and I see all those messages, but SSHGuard never starts.

Any suggestions welcome!
Thanks.

designator · 06-12-2009, 11:08 AM

Well, I gave up on sshguard, but I got fail2ban to work effortlessly.

unSpawn · 06-12-2009, 11:12 AM

Not so quick, what do you mean "never starts" or "does not work"? Doesn't it add rules to the table?

designator · 06-12-2009, 11:58 AM

Well, according to sshguard docs, it should start and continue running after syslog sends the first line. So I should be able to see it with

Code:

ps -A|grep sshguard

and I don't.

It doesn't add any iptables rules either which is pretty obvious since it isn't running.

Code:

iptables -L

only shows CentOS rules.

unSpawn · 06-13-2009, 07:38 AM

I built sshguard with this minimal .spec file:

Code:

%define debug_packages	%{nil}
%define debug_package %{nil}
%define name sshguard
%define ver 1.4rc4
%define rel 1

%define _docdir /usr/local/share/doc
%define _mandir /usr/local/share/man
%define _bindir /usr/local/bin
%define _sbindir /usr/local/sbin

Name: %{name}
Summary: %{name}, an iptables-based SSH-port blocker 
Version: %{ver}
Release: %{rel}
License: GPL
Group: Utilities/System
Source0: %{name}-%{ver}.tar.bz2
Prereq: /sbin/iptables
Provides: %{name}
Vendor: mij@bitchx.it
URL: http://sshguard.sourceforge.net
BuildRoot: %{_tmppath}/%{name}-%{version}

%description 
%{name} is an iptables-based SSH-port blocker.

%prep
%setup -n %{name}-%{ver}

%build
%configure --with-firewall=iptables
make

%install
if [ "$RPM_BUILD_ROOT" = "%{_tmppath}/%{name}-%{version}" ]; then
	rm -rf $RPM_BUILD_ROOT; make DESTDIR=$RPM_BUILD_ROOT install
else
	echo "Invalid Build root "${RPM_BUILD_ROOT}"."; exit 1
fi
						
%clean
if [ "$RPM_BUILD_ROOT" = "%{_tmppath}/%{name}-%{version}" ]; then
	rm -rf $RPM_BUILD_ROOT
else
	echo "Invalid Build root "${RPM_BUILD_ROOT}"."; exit 1
fi

%postun
if [ "$1" = "0" ]; then
	if [ `/sbin/iptables  -n -L %{name}|wc -l)` -ne 0 ]; then
		echo "iptables chain %{name} still contains rules."
		echo "Please review, remove chain and contents manually."
	fi
fi

%files
%defattr(-,root,root)
%doc examples/* scripts/* README Changes
%attr(755,root,root) %{_sbindir}/%{name}
%attr(644,root,root) %{_mandir}/man8/%{name}.8

%changelog
* Sat Jun 12 2009 unSpawn -
- Create minimal .spec.

then tried three options: syslog pipe, FIFO and tailing a logfile.
The syslog pipe needs

Code:

module sshguard 1.0;

require {
        type syslogd_t;
        type sbin_t;
        class dir search;
        class file { read write ioctl };
}

#============= syslogd_t ==============
allow syslogd_t sbin_t:dir search;
allow syslogd_t sbin_t:file { read write ioctl };

but still fails to work as the pipe dies w/o debug output.

FIFO and tail work OK but when you use a FIFO as the docs suggest no auth* messages will end up in the syslog.conf configured logfile, and loss of auditing caps leaves only tailing a logfile as input method.

[EDIT]
Since you were the first to note problems with the package I'd like to add the developer has a user mailing list at http://lists.sourceforge.net/lists/l...sshguard-users, so please feel free to at least tell him it's not working as advertised. Thanks in advance.
[/EDIT]

designator · 06-14-2009, 05:49 PM

Unfortunately, I was working with a production box so I can't use it as a test case to help developer fix the problem. If you have time to provide him additional details, please send the message. I should have time next week to set up a virtual machine to play with SSHGuard and I will then reply to or start the discussion on the mailing list.

Thanks.