Date: Tue, 29 Sep 2015 08:59:35 -0400 From: "Michael B. Eichorn" <ike@michaeleichorn.com> To: Alexandre <axelbsd@ymail.com>, FreeBSD Questions Mailing List FreeBSD Questions Mailing List <freebsd-questions@freebsd.org> Subject: Re: SSHguard & IPFW Message-ID: <1443531575.1236.13.camel@michaeleichorn.com> In-Reply-To: <DUB118-W2564316B09E855F03F7D11B44E0@phx.gbl> References: <DUB118-W2564316B09E855F03F7D11B44E0@phx.gbl>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Tue, 2015-09-29 at 14:04 +0200, Alexandre wrote: > Hi, > > I installed and configured IPFW on my box. I installed > security/sshguard-ipfw to block unwanted SSH connections. > I did not added the line sshguard_enable="YES" in /etc/rc.conf. > Without this line in /etc/rc.conf, Bots IP addresses seems to be > blocked as expected (/var/log/messages): > > Sep 25 18:39:27 BoxName sshguard[7243]: Blocking 62.212.230.2:4 > for>945secs: 40 danger in 4 attacks over 514 seconds (all: 80d in 2 > abuses over 2059s). > > With the command $ sudo ipfw list I can see the blocked IP adresse in > the deny list : > 55031 deny ip from 62.212.230.2 to me > > Anyone can confirm (or not if I am wrong) that the line > sshguard_enable="YES" is requested only if I install security/sshguard > port? Nope, sshguard_enable applies to all of them the sshguard-* ports are just sshguard with different configure options. From /usr/local/etc/rc.d/sshguard (sshguard-pf, but should be the same with -ipfw): # Add the following lines to /etc/rc.conf to enable sshguard: # sshguard_enable (bool): Set to "NO" by default. # Set it to "YES" to enable sshguard At a guess something happened to kick off sshguard without the rc script, but for most setups the rc script is the proper way to start sshguard. Is there any chance that you might have followed an old guide? In sshguard < 1.5 a valid configuration option was to use syslog to kickoff sshguard and not use sshguard enable, but this is now depreciated in favor of the new 'Log Sucker' introduced in v1.5. > > > About the blocking rules reservation in IPFW (from rule 55000 to > 55050), anyone experienced yet full use of these rules? > By default, fifteen addresses can be blocked together. But how SSHGUARD > works in this case for the newest one (51th)? > > Thank you in advance for your clarifications. > Alexandre > > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to " > freebsd-questions-unsubscribe@freebsd.org" [-- Attachment #2 --] 0 *H 010 `He 0 *H 000]0 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 150613202446Z 160614003550Z0H1 0 U ike@michaeleichorn.com1%0# *H ike@michaeleichorn.com0"0 *H 0 UՀ,k9D %Z|Y6J<rrK g;&|uNlUE9)V.[ט̊:qS](#v SYDz* CpugYݔ,v<`j(w aS#ڒ6n(K5'KVLåErv< J=[}W bLA%gޭnVb| I?M7D :$׃bM_T[,ƃ\ 00 U 0 0 U 0 U %0++0 U jj: γ+39啖0 U #0Sr풜\|~5NԸQ0!U 0ike@michaeleichorn.com0LU C0?0; +70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U /0-0+)'%http://crl.startssl.com/crtu1-crl.crl0+009+0-http://ocsp.startssl.com/sub/class1/client/ca0B+06http://aia.startssl.com/certs/sub.class1.client.ca.crt0#U 0http://www.startssl.com/0 *H x+ȐF}pw.X vF?rg P]EOp)L˻yA ;hi0u2]m [Sbp$_ gr Xm*YP3 #H>mKAǠt)HO|=@} 3ӝ'iO81> 03 v'h5U "H;ECZtpҗ4rWHu^6+i*kJL8shAV|5;?HMc\ j[j|+000]0 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 150613202446Z 160614003550Z0H1 0 U ike@michaeleichorn.com1%0# *H ike@michaeleichorn.com0"0 *H 0 UՀ,k9D %Z|Y6J<rrK g;&|uNlUE9)V.[ט̊:qS](#v SYDz* CpugYݔ,v<`j(w aS#ڒ6n(K5'KVLåErv< J=[}W bLA%gޭnVb| I?M7D :$׃bM_T[,ƃ\ 00 U 0 0 U 0 U %0++0 U jj: γ+39啖0 U #0Sr풜\|~5NԸQ0!U 0ike@michaeleichorn.com0LU C0?0; +70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U /0-0+)'%http://crl.startssl.com/crtu1-crl.crl0+009+0-http://ocsp.startssl.com/sub/class1/client/ca0B+06http://aia.startssl.com/certs/sub.class1.client.ca.crt0#U 0http://www.startssl.com/0 *H x+ȐF}pw.X vF?rg P]EOp)L˻yA ;hi0u2]m [Sbp$_ gr Xm*YP3 #H>mKAǠt)HO|=@} 3ӝ'iO81> 03 v'h5U "H;ECZtpҗ4rWHu^6+i*kJL8shAV|5;?HMc\ j[j|+040 0 *H 0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 071024210155Z 171024210155Z01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0"0 *H 0 -).2AUGo#G B|NDRpM-B=o -we5JQpa>O.#._<V [~**pz~3WG .ᘟMlr[<Ce6fqO"uxfWN#uicgkv$Lb%y`_{`xK'GN 00U 00U 0 U Sr풜\|~5NԸQ0 U #0N @[i04hCA0f+Z0X0'+0http://ocsp.startssl.com/ca0-+0!http://www.startssl.com/sfsca.crt0[U T0R0'%#!http://www.startssl.com/sfsca.crl0'%#!http://crl.startssl.com/sfsca.crl0U y0w0u +70f0.+"http://www.startssl.com/policy.pdf04+(http://www.startssl.com/intermediate.pdf0 *H }x,\c^ #wMq}>UK/^yX֏y frMIŲB61ymQҨݬZ0& ;@#13qۑ& ̢o 6r_;GO>*I( 74XS1r3)!LJy6Kotˆ# _wSr ;B ADp(fs 䰷6%.W0J3:bC<8t X1<Cn=t==wST~\wkBf|15zUP)(IjVB!OfI=bb\4-*em/нSJm7N[]'@ڽ D9Kr>R7/|o^I@ټ'Pa $ z9a'L)( I}vcH]۸D*W} m>Q|C.(,lQ10001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 `He 0 *H 1 *H 0 *H 1 150929125935Z0O *H 1B@:gUȹnP;in??EOK;{~UƿHm?,idgBiOw1 60 +71001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 *H 101 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 *H \L_0 x 8ѷȾvfބ_!uD#80}mP9 ",| &$ V=%UT=>Օ{<q~>ֺ[ XPmxM&v;' UČNU*&! # @ߦ2)1x'P nd s [ζA;yaRu8Yt2.IF~!F?) =|Ày`~Ed)\QP#
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1443531575.1236.13.camel>