Sshguard

Resources

Home

Open Hub

sshguard 是一种入侵防御系统。 sshguard 解析服务器日志，检测恶意行为，然后通过防火墙规则禁止恶意用户登录。 sshguard 是用 C 写的，因此不需要额外的解析器。

工作原理

sshguard 是一个持续跟踪一个或多个日志文件的守护进程。它通过分析由失败的登录尝试引发的守护进程的日志活动，通过更新系统的防火墙阻止这些用户进一步的连接尝试。

不像名字暗示的那样， sshguard 不仅可以解析 SSH 日志。它也支持多种邮件系统和一些 FTP 系统。它支持的服务的详细列表可以在 sshguard.net 网站找到。

安装

Emerge

安装 app-admin/sshguard：

root #emerge --ask app-admin/sshguard

然后确保安装了 net-firewall/iptables 并被用作系统防火墙。截止到本文写作时间，sshguard 还不支持 net-firewall/nftables。

root #emerge --ask net-firewall/iptables

更多关于使用和配置 Iptables 的信息可以参阅 IPtables 文章。

配置

准备防火墙

When sshguard blocks any malicious users (by blocking their IP addresses), it will use the sshguard chain.

准备 iptable 链，并确保当检测到新的进入的连接会被触发：

root #iptables -N sshguard

root #iptables -A INPUT -j sshguard

监控日志文件

sshguard 背后的基本思路是，不通过 sshguard 的内置的配置文件，而是由管理员将需要监控的日志文件作为参数传给程序。

在 Gentoo 上，参数可以通过 /etc/conf.d/sshguard 文件进行配置：

FILE /etc/conf.d/sshguard配置 sshguard 读取 /var/log/messages

PARDONTIME="3600" # Blocks last at least 1 hour (3600 seconds)
WATCHTIME="360"   # Track IP addresses for 5 minutes (360 seconds)
THRESHOLD="10"    # How many problematic attempts trigger a block
  
LOGFILES="-l /var/log/messages"                      # Watch this file...
LOGFILES="${LOGFILES} -l /var/log/auth.log"          # And this one
  
SSHGUARD_OPTS="-p ${PARDONTIME} -s ${WATCHTIME} -a ${THRESHOLD} ${LOGFILES}"

1. Space-separated list of log files to monitor. (optional, no default)

FILES="/var/log/messages /var/log/auth.log"

1. How many problematic attempts trigger a block

THRESHOLD=10

1. Blocks last at least 24 hours (60480 seconds)

BLOCKTIME=60480

1. Track IP addresses for 24 hours (60480 seconds)

DETECTION_TIME=60480

1. IPv6 subnet size to block. Defaults to a single address, CIDR notation. (optional, default to 128)

IPV6_SUBNET=64

1. IPv4 subnet size to block. Defaults to a single address, CIDR notation. (optional, default to 32)

IPV4_SUBNET=24

1. Full path to PID file (optional, no default)

PID_FILE=/run/sshguard.pid }}

确保日志文件对于运行 sshguard 的用户是可读的。

Services

OpenRC

把 sshguard 加入到默认的运行级别，然后启动：

root #rc-update add sshguard default

root #rc-service sshguard start

Blacklisting hosts

With the blacklisting option after a number of abuses the IP address of the attacker or a IP subnet will be blocked permanently. The blacklist will be loaded at each startup and extended with new entries during operation. sshguard inserts a new address after it exceeded a threshold of abuses.

Blacklisted addresses are never scheduled to be released (allowed) again.

To enable blacklisting, create an appropriate directory and file:

root #mkdir -p /var/lib/sshguard

root #touch /var/lib/sshguard/blacklist.db

While defining a blacklist it is important to exclude trusted IP networks and hosts in a whitelist.

To enable whitelisting, create an appropriate directory and file:

root #mkdir -p /etc/sshguard

root #touch /etc/sshguard/whitelist

The whitelist has to include the loopback interface, and should have at least 1 IP trusted network f.e. 192.0.2.0/24.

FILE /etc/sshguard/whitelistWhitelisting trusted networks

127.0.0.0/8
::1/128
192.0.2.0/24

Note
The 192.0.2.0/24 entry has to be adjusted to fit the own needs.

Add the BLACKLIST_FILE and WHITELIST_FILE file to the configuration:

FILE /etc/conf.d/sshguardConfiguring sshguard to blacklist abusers

BACKEND="/usr/libexec/sshg-fw-iptables"
FILES="/var/log/auth.log"

THRESHOLD=10
BLOCK_TIME=43200
DETECTION_TIME=604800

IPV4_SUBNET=24
IPV6_SUBNET=64

PID_FILE=/run/sshguard.pid

# Add following lines
BLACKLIST_FILE=10:/var/lib/sshguard/blacklist.db
WHITELIST_FILE=/etc/sshguard/whitelist

Restart the sshguard daemon to have the changes take effect:

root #/etc/init.d/sshguard restart

Troubleshooting

File '/var/log/auth.log' vanished while adding!

When starting up, sshguard reports the following error:

CODE Error message when trying to add a monitor for /var/log/auth.log

Sep 23 03:39:11 foo.bar.com sshguard[64933]: File '/var/log/auth.log' vanished while adding!

Such an error (the file path itself can be different) occurs when the target file is not available on the system. Make sure that it is created, or update the sshguard configuration to not add it for monitoring.

On a syslog-ng system with OpenRC, the following addition to syslog-ng.conf can suffice:

FILE /etc/syslog-ng/syslog-ng.confcreating auth.log file

log { source(src); destination(messages); };
log { source(src); destination(console_all); };
 
destination authlog {file("/var/log/auth.log"); };
filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
log { source(src);  filter(f_authpriv);  destination(authlog);  };

Reload the configuration for the changes to take effect:

root #rc-service syslog-ng reload

参考

• Iptables - An article on installing and configuring the iptables firewall on Gentoo.

外部资源

sshguard 文档 提供了进一步优化的所有信息。