SSHGuard

https://www.sshguard.net/docs
Admin
SSHGuard protects hosts from brute-force attacks against SSH and other services by aggregating...
Tokens:3,218
Snippets:53
Trust Score:9.2
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install build dependencies by platform

Source: https://www.sshguard.net/docs/install.html

Commands to install required build tools on various operating systems.

```bash
apt install autoconf automake byacc flex gcc python-docutils
```

```bash
dnf install autoconf automake byacc flex gcc python-docutils
```

```bash
pkg install autotools byacc clang flex py27-docutils
```

```bash
brew install autoconf automake byacc docutils flex
```

--------------------------------

### Verify Build and Installation

Source: https://www.sshguard.net/docs/contributing.html

Command to ensure the source tarball builds and installs correctly before release.

```bash
make distcheck
```

--------------------------------

### Build SSHGuard from source archive

Source: https://www.sshguard.net/docs/install.html

Standard build process for a downloaded source distribution.

```bash
./configure
make && make install
```

--------------------------------

### Build SSHGuard from source repository

Source: https://www.sshguard.net/docs/install.html

Build process for cloning and compiling directly from the source repository.

```bash
git clone https://bitbucket.org/sshguard/sshguard.git
cd sshguard/
autoreconf -i
./configure
make && make install
```

--------------------------------

### Configure Whitelists via Command Line

Source: https://www.sshguard.net/docs/sshguard.html

Use the -w flag to whitelist specific IP addresses, CIDR blocks, or hostnames. Multiple -w flags can be provided to define multiple whitelist entries.

```bash
sshguard -w 192.168.1.10 -w 192.168.0.0/24 -w friend.example.com
    -w 2001:0db8:85a3:0000:0000:8a2e:0370:7334
    -w 2002:836b:4179::836b:0000/126
```

--------------------------------

### Tag a Release

Source: https://www.sshguard.net/docs/contributing.html

Command to create a signed git tag for a new version release.

```bash
git tag -s -m "Tag <version> release" v<version>
```

--------------------------------

### Inspect nftables Sets and Tables

Source: https://www.sshguard.net/docs/sshguard-setup.html

Commands to list the contents of sshguard sets and display the associated tables.

```bash
# nft list set ip sshguard attackers
# nft list set ip6 sshguard attackers
```

```bash
# nft list table ip sshguard
# nft list table ip6 sshguard
```

--------------------------------

### Configure syslog-ng 3.x for SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Add these lines to syslog-ng.conf to enable 3.x mode and route authentication logs to SSHGuard.

```text
# enable 3.x mode
@version:3.0

# pass only entries with auth+authpriv facilities from programs other than sshguard
filter f_sshguard { facility(auth, authpriv) and not program("sshguard"); };
# pass entries built with this format
destination sshguard {
program("/usr/sbin/sshguard"
template("$DATE $FULLHOST $MSGHDR$MESSAGE\n")
);
};
log { source(src); filter(f_sshguard); destination(sshguard); };
```

--------------------------------

### Configure firewalld for SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Use rich rules to drop traffic from sshguard4 and sshguard6 ipsets in specific zones.

```bash
# firewall-cmd --zone=zone-name --permanent \
    --add-rich-rule="rule source ipset=sshguard4 drop"
# firewall-cmd --zone=zone-name --permanent \
    --add-rich-rule="rule source ipset=sshguard6 drop"
```

```bash
# firewall-cmd --permanent --info-ipset=sshguard4
# firewall-cmd --permanent --info-ipset=sshguard6
```

--------------------------------

### Push Release Tags

Source: https://www.sshguard.net/docs/contributing.html

Command to push the newly created release tags to the remote repository.

```bash
git push --tags
```

--------------------------------

### Configure pf Firewall for SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Add these lines to pf.conf to define the sshguard table and block traffic from listed attackers.

```text
table <sshguard> persist
block in proto tcp from <sshguard>
```

```bash
# pfctl -t sshguard -T show
```

--------------------------------

### Verify SSHGuard process execution

Source: https://www.sshguard.net/docs/sshguard-setup.html

Displays the active SSHGuard process pipeline to confirm all components are running as expected.

```bash
/bin/sh /opt/sshguard/sbin/sshguard
tail -F -n 0 /tmp/log.txt
/opt/sshguard/libexec/sshg-parser
/opt/sshguard/libexec/sshg-blocker -a 30 -p 120 -s 1800 -N 128 -n 32
/bin/sh /usr/local/libexec/sshg-fw-null
```

--------------------------------

### Configure netfilter/iptables for SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Create a dedicated chain and integrate it into the INPUT chain to filter traffic.

```bash
# iptables -N sshguard      # for IPv4
# ip6tables -N sshguard     # for IPv6
```

```bash
# block any traffic from abusers
iptables -A INPUT -j sshguard
ip6tables -A INPUT -j sshguard
```

```bash
# block abusers only for SSH, FTP, POP, IMAP services (use "multiport" module)
iptables -A INPUT -m multiport -p tcp --destination-ports 21,22,110,143 -j sshguard
ip6tables -A INPUT -m multiport -p tcp --destination-ports 21,22,110,143 -j sshguard
```

```bash
iptables -N sshguard
# block whatever SSHGuard says be bad ...
iptables -A INPUT -j sshguard
# enable ssh, dns, http, https
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# and block everything else (default deny)
iptables -P INPUT DROP
```

--------------------------------

### Configure metalog for SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Add these lines to metalog.conf to direct relevant logs to the SSHGuard directory.

```text
Stuff to protect from brute force attacks :
    # for ssh
    facility = "*"
    program = "sshd"
    # other services ...
    # log to /var/log/sshguard directory
    logdir = "/var/log/sshguard"
```

--------------------------------

### Configure syslog-ng 2.x for SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Add these lines to syslog-ng.conf to filter authentication logs and pipe them to the SSHGuard process.

```text
# pass only entries with auth+authpriv facilities from programs other than sshguard
filter sshlogs { facility(auth, authpriv) and not match("sshguard"); };
# pass to this process with this template (avoids &lt;ID&gt; prefixes)
destination sshguardproc {
program("/usr/local/sbin/sshguard"
template("$DATE $FULLHOST $MESSAGE\n"));
};
log { source(src); filter(sshlogs); destination(sshguardproc); };
```

--------------------------------

### Configure ipfw Firewall for SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Use table 22 to block attackers within the ipfw ruleset.

```bash
# ipfw add 5000 reset ip from table(22) to me
```

```bash
# ipfw table 22 list
```

--------------------------------

### Configure ipset for SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Use ipsets as a source for iptables to drop traffic from identified attackers.

```bash
# iptables  -I INPUT -m set --match-set sshguard4 src -j DROP
# ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP
```

--------------------------------

### Monitor specific log files with SSHGuard

Source: https://www.sshguard.net/docs/sshguard-setup.html

Use this command to specify custom log files for SSHGuard to monitor while ignoring default file paths.

```bash
# sshguard /var/log/auth.log /var/log/maillog
```

--------------------------------

### Regenerate Autotools

Source: https://www.sshguard.net/docs/contributing.html

Command used to regenerate the autotools configuration files during the release process.

```bash
autoreconf -i
```

--------------------------------

### Sign Source Tarball

Source: https://www.sshguard.net/docs/contributing.html

Command to sign the generated source tarball using the project's distribution signing script.

```bash
./distsign <tarball>
```

--------------------------------

### Test attack recognition with sshg-parser

Source: https://www.sshguard.net/docs/sshguard-setup.html

Pipes log file content through the parser to identify which entries are recognized as attacks.

```bash
$ cat /var/log/auth.log | %PREFIX%/libexec/sshg-parser -a
```
Tokens:
Raw