Sshguard/it

sshguard è un sistema di prevenzione delle intrusioni che analizza i log del server, determina le attività dannose e utilizza il firewall di sistema per bloccare gli indirizzi IP delle connessioni malevole. sshguard è scritto in C quindi non necessita di un interprete.

Come funziona
sshguard è un semplice demone che setaccia in continuazione uno o più file di log. Esso analizza i log che i demoni inviano in caso di tentativi di accesso non riusciti e poi blocca ogni ulteriore tentativo da quelle connessioni aggiornando il firewall del sistema.

Rispetto a quello che può suggerire il nome, sshguard non funziona solo con log di SSH. Esso supporta anche molti sistemi di mail nonché alcuni FTP. Una lista completa di servizi supportati è disponibile sul sshguard.net sito

Emerge
installa :

Additional software
Depending on the init system and the desired firewall backend to be used by sshguard, additional software may be required to be emerged in order for sshguard to block malicious actors.

More information on various supported backends can be found by reading the setup manpage:

iptables
When iptables are being used as the system firewall.

Maggiori informazioni riguardo l'uso e la configurazione di IPtables possono essere trovati nel IPtables article.

nftables
When nftables are being used as the system firewall:

Preparare il firewall
When blocks any malicious users (by blocking their IP addresses), it will use the  chain.

Prepare the chain with iptables and make sure it is also triggered when new incoming connections are detected:

Then verify that the appropriate path to the iptables backend library is set in :

Osservare i file log
The basic idea behind sshguard is that the administrator passes on the log file(s) to watch as options to the application - there is no native sshguard configuration file.

On Gentoo, the options can be best configured in the file:

Make sure that the log files are accessible for the runtime user that sshguard uses.

OpenRC
Have sshguard be started by default by adding it to the default runlevel, and then start it:

systemd
Use systemd's conventional way to enable it, and then start it:

Blacklisting hosts
With the blacklisting option after a number of abuses the IP address of the attacker or a IP subnet will be blocked permanently. The blacklist will be loaded at each startup and extended with new entries during operation. inserts a new address after it exceeded a threshold of abuses.

Blacklisted addresses are never scheduled to be released (allowed) again.

To enable blacklisting, create an appropriate directory and file:

While defining a blacklist it is important to exclude trusted IP networks and hosts in a whitelist.

To enable whitelisting, create an appropriate directory and file:

The whitelist has to include the loopback interface, and should have at least 1 IP trusted network f.e. 192.0.2.0/24.

Add the BLACKLIST_FILE and WHITELIST_FILE file to the configuration. Example configuration listed blocks all hosts after the first login attempt. To setup a less agressive blocking policy, adjust the THRESHOLD and BLACKLIST_FILE integer, and set it to f.e. 10 instead of 2:

Restart the daemon to have the changes take effect:

File '/var/log/auth.log' vanished while adding!
When starting up, sshguard reports the following error:

Such an error (the file path itself can be different) occurs when the target file is not available on the system. Make sure that it is created, or update the sshguard configuration to not add it for monitoring.

On a syslog-ng system with OpenRC, the following addition to can suffice:

Reload the configuration for the changes to take effect:

Risorse esterne
La documentazione sshguard fornisce tutte le informazioni necessarie per ottimizzare ulteriormente l'applicazione.