Sshguard/zh-cn

sshguard 是一种入侵防御系统. sshguard 解析服务器日志，检测恶意行为，然后通过防火墙规则禁止恶意用户登录. sshguard 是用 C 写的，因此不需要额外的解析器.

工作原理
sshguard 是一个持续跟踪一个或多个日志文件的守护进程. 它通过分析由失败的登录尝试引发的守护进程的日志活动，通过更新系统的防火墙阻止这些用户进一步的连接尝试.

不像名字暗示的那样， sshguard 不仅可以解析 SSH 日志. 它也支持多种邮件系统和一些 FTP 系统. 它支持的服务的详细列表可以在 sshguard.net 网站找到.

Emerge
安装 ：

然后确保安装了 并被用作系统防火墙. 截止到本文写作时间，sshguard 还不支持.

更多关于使用和配置 Iptables 的信息可以参阅 IPtables 文章.

准备防火墙
sshguard 会使用 sshguard 链阻止恶意用户（通过阻止他们的 IP 地址）.

准备 iptable 链，并确保当检测到新的进入的连接会被触发：

监控日志文件
sshguard 背后的基本思路是，不通过 sshguard 的内置的配置文件，而是由管理员将需要监控的日志文件作为参数传给程序.

在 Gentoo 上，参数可以通过 文件进行配置：

FILES="/var/log/messages /var/log/auth.log"
 * 1) Space-separated list of log files to monitor. (optional, no default)

THRESHOLD=10 BLOCKTIME=60480 DETECTION_TIME=60480
 * 1) How many problematic attempts trigger a block
 * 1) Blocks last at least 24 hours (60480 seconds)
 * 1) Track IP addresses for 24 hours (60480 seconds)

IPV6_SUBNET=64 IPV4_SUBNET=24
 * 1) IPv6 subnet size to block. Defaults to a single address, CIDR notation. (optional, default to 128)
 * 1) IPv4 subnet size to block. Defaults to a single address, CIDR notation. (optional, default to 32)

PID_FILE=/run/sshguard.pid }}
 * 1) Full path to PID file (optional, no default)

确保日志文件对于运行 sshguard 的用户是可读的.

OpenRC
把 sshguard 加入到默认的运行级别，然后启动：

Blacklisting hosts
With the blacklisting option after a number of abuses the IP address of the attacker or a IP subnet will be blocked permanently. The blacklist will be loaded at each startup and extended with new entries during operation. inserts a new address after it exceeded a threshold of abuses.

Blacklisted addresses are never scheduled to be released (allowed) again.

To enable blacklisting, create an appropriate directory and file:

While defining a blacklist it is important to exclude trusted IP networks and hosts in a whitelist.

To enable whitelisting, create an appropriate directory and file:

The whitelist has to include the loopback interface, and should have at least 1 IP trusted network f.e. 192.0.2.0/24.

Add the BLACKLIST_FILE and WHITELIST_FILE file to the configuration:

Restart the daemon to have the changes take effect:

File '/var/log/auth.log' vanished while adding!
When starting up, sshguard reports the following error:

Such an error (the file path itself can be different) occurs when the target file is not available on the system. Make sure that it is created, or update the sshguard configuration to not add it for monitoring.

On a syslog-ng system with OpenRC, the following addition to can suffice:

Reload the configuration for the changes to take effect:

参考

 * Iptables, 在 Gentoo 上安装和配置 iptables

外部资源
sshguard 文档 提供了进一步优化的所有信息.