### Install build dependencies by platform Source: https://www.sshguard.net/docs/install.html Commands to install required build tools on various operating systems. ```bash apt install autoconf automake byacc flex gcc python-docutils ``` ```bash dnf install autoconf automake byacc flex gcc python-docutils ``` ```bash pkg install autotools byacc clang flex py27-docutils ``` ```bash brew install autoconf automake byacc docutils flex ``` -------------------------------- ### Verify Build and Installation Source: https://www.sshguard.net/docs/contributing.html Command to ensure the source tarball builds and installs correctly before release. ```bash make distcheck ``` -------------------------------- ### Build SSHGuard from source archive Source: https://www.sshguard.net/docs/install.html Standard build process for a downloaded source distribution. ```bash ./configure make && make install ``` -------------------------------- ### Build SSHGuard from source repository Source: https://www.sshguard.net/docs/install.html Build process for cloning and compiling directly from the source repository. ```bash git clone https://bitbucket.org/sshguard/sshguard.git cd sshguard/ autoreconf -i ./configure make && make install ``` -------------------------------- ### Configure Whitelists via Command Line Source: https://www.sshguard.net/docs/sshguard.html Use the -w flag to whitelist specific IP addresses, CIDR blocks, or hostnames. Multiple -w flags can be provided to define multiple whitelist entries. ```bash sshguard -w 192.168.1.10 -w 192.168.0.0/24 -w friend.example.com -w 2001:0db8:85a3:0000:0000:8a2e:0370:7334 -w 2002:836b:4179::836b:0000/126 ``` -------------------------------- ### Tag a Release Source: https://www.sshguard.net/docs/contributing.html Command to create a signed git tag for a new version release. ```bash git tag -s -m "Tag release" v ``` -------------------------------- ### Inspect nftables Sets and Tables Source: https://www.sshguard.net/docs/sshguard-setup.html Commands to list the contents of sshguard sets and display the associated tables. ```bash # nft list set ip sshguard attackers # nft list set ip6 sshguard attackers ``` ```bash # nft list table ip sshguard # nft list table ip6 sshguard ``` -------------------------------- ### Configure syslog-ng 3.x for SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Add these lines to syslog-ng.conf to enable 3.x mode and route authentication logs to SSHGuard. ```text # enable 3.x mode @version:3.0 # pass only entries with auth+authpriv facilities from programs other than sshguard filter f_sshguard { facility(auth, authpriv) and not program("sshguard"); }; # pass entries built with this format destination sshguard { program("/usr/sbin/sshguard" template("$DATE $FULLHOST $MSGHDR$MESSAGE\n") ); }; log { source(src); filter(f_sshguard); destination(sshguard); }; ``` -------------------------------- ### Configure firewalld for SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Use rich rules to drop traffic from sshguard4 and sshguard6 ipsets in specific zones. ```bash # firewall-cmd --zone=zone-name --permanent \ --add-rich-rule="rule source ipset=sshguard4 drop" # firewall-cmd --zone=zone-name --permanent \ --add-rich-rule="rule source ipset=sshguard6 drop" ``` ```bash # firewall-cmd --permanent --info-ipset=sshguard4 # firewall-cmd --permanent --info-ipset=sshguard6 ``` -------------------------------- ### Push Release Tags Source: https://www.sshguard.net/docs/contributing.html Command to push the newly created release tags to the remote repository. ```bash git push --tags ``` -------------------------------- ### Configure pf Firewall for SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Add these lines to pf.conf to define the sshguard table and block traffic from listed attackers. ```text table persist block in proto tcp from ``` ```bash # pfctl -t sshguard -T show ``` -------------------------------- ### Verify SSHGuard process execution Source: https://www.sshguard.net/docs/sshguard-setup.html Displays the active SSHGuard process pipeline to confirm all components are running as expected. ```bash /bin/sh /opt/sshguard/sbin/sshguard tail -F -n 0 /tmp/log.txt /opt/sshguard/libexec/sshg-parser /opt/sshguard/libexec/sshg-blocker -a 30 -p 120 -s 1800 -N 128 -n 32 /bin/sh /usr/local/libexec/sshg-fw-null ``` -------------------------------- ### Configure netfilter/iptables for SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Create a dedicated chain and integrate it into the INPUT chain to filter traffic. ```bash # iptables -N sshguard # for IPv4 # ip6tables -N sshguard # for IPv6 ``` ```bash # block any traffic from abusers iptables -A INPUT -j sshguard ip6tables -A INPUT -j sshguard ``` ```bash # block abusers only for SSH, FTP, POP, IMAP services (use "multiport" module) iptables -A INPUT -m multiport -p tcp --destination-ports 21,22,110,143 -j sshguard ip6tables -A INPUT -m multiport -p tcp --destination-ports 21,22,110,143 -j sshguard ``` ```bash iptables -N sshguard # block whatever SSHGuard says be bad ... iptables -A INPUT -j sshguard # enable ssh, dns, http, https iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p udp --dport 53 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT # and block everything else (default deny) iptables -P INPUT DROP ``` -------------------------------- ### Configure metalog for SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Add these lines to metalog.conf to direct relevant logs to the SSHGuard directory. ```text Stuff to protect from brute force attacks : # for ssh facility = "*" program = "sshd" # other services ... # log to /var/log/sshguard directory logdir = "/var/log/sshguard" ``` -------------------------------- ### Configure syslog-ng 2.x for SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Add these lines to syslog-ng.conf to filter authentication logs and pipe them to the SSHGuard process. ```text # pass only entries with auth+authpriv facilities from programs other than sshguard filter sshlogs { facility(auth, authpriv) and not match("sshguard"); }; # pass to this process with this template (avoids <ID> prefixes) destination sshguardproc { program("/usr/local/sbin/sshguard" template("$DATE $FULLHOST $MESSAGE\n")); }; log { source(src); filter(sshlogs); destination(sshguardproc); }; ``` -------------------------------- ### Configure ipfw Firewall for SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Use table 22 to block attackers within the ipfw ruleset. ```bash # ipfw add 5000 reset ip from table(22) to me ``` ```bash # ipfw table 22 list ``` -------------------------------- ### Configure ipset for SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Use ipsets as a source for iptables to drop traffic from identified attackers. ```bash # iptables -I INPUT -m set --match-set sshguard4 src -j DROP # ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP ``` -------------------------------- ### Monitor specific log files with SSHGuard Source: https://www.sshguard.net/docs/sshguard-setup.html Use this command to specify custom log files for SSHGuard to monitor while ignoring default file paths. ```bash # sshguard /var/log/auth.log /var/log/maillog ``` -------------------------------- ### Regenerate Autotools Source: https://www.sshguard.net/docs/contributing.html Command used to regenerate the autotools configuration files during the release process. ```bash autoreconf -i ``` -------------------------------- ### Sign Source Tarball Source: https://www.sshguard.net/docs/contributing.html Command to sign the generated source tarball using the project's distribution signing script. ```bash ./distsign ``` -------------------------------- ### Test attack recognition with sshg-parser Source: https://www.sshguard.net/docs/sshguard-setup.html Pipes log file content through the parser to identify which entries are recognized as attacks. ```bash $ cat /var/log/auth.log | %PREFIX%/libexec/sshg-parser -a ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.