Tons sshguard log entries and its not enabled

troysjanda

im getting this in my logs under the general tab

2022-02-15 14:39:00.022850-08:00 sshguard 23008 Now monitoring attacks.
2022-02-15 14:39:00.018828-08:00 sshguard 51357 Exiting on signal.

started after the upgrade to 22.01 @ 2022-02-14 19:28:00.047595-08:00 and I count over 40+ entries look to be every hour. I don't have ssh enabled, box unchecked system/advance/admin access/ secure shell

no sure how to stop.

stephenw10

You are probably hitting this:
https://redmine.pfsense.org/issues/12747

Either one of your logs is getting spammed and rotating often of the log size is set very small.
Increasing the log size mitigates to some extent.

Steve

troysjanda

@stephenw10

I looked at every log and they are all at the default size however if not noted I'm currently on 22.01 pfsense+ maybe that bug does not apply.

bcruze

@stephenw10 said in Tons sshguard log entries and its not enabled:

You are probably hitting this:
https://redmine.pfsense.org/issues/12747

Either one of your logs is getting spammed and rotating often of the log size is set very small.
Increasing the log size mitigates to some extent.

Steve

I did afresh install from the iso from Netgate on a net gate device and this still continues
So just ignore until the next release?

johnpoz

@troysjanda said in Tons sshguard log entries and its not enabled:

are all at the default size

Doesn't mean they are not rotating.. Up the size.. does the frequency of that go down.

stephenw10

Yeah, if you have very busy logs and the default log sizes you might still see this even if there are no actual errors.
For example I first noticed it because I had a number of IPSec tunnels and the ipsec logging options turned up above the defaults.

Steve

troysjanda

Still having issue with this and I have increased the log sizes. seems to happen whether of not ssh is enabled or not. Is there a way to disable shhguard if not using ssh, and only enable if I enable ssh?

johnpoz

@troysjanda I looked in my log and I see a total of 96 (starts and stops) going back to the 14th.. I believe this is related to me making changes in the firewall..

I can leave doing anything with it for a while and see if see any.. Latest entry I see is

Feb 17 11:01:00 sshguard 61273 Now monitoring attacks.

bcruze

@johnpoz

zero changes have been made to my firewall I have been at work since 5am
Feb 17 13:22:00 sshguard 77291 Now monitoring attacks.
Feb 17 13:22:00 sshguard 95660 Exiting on signal.
Feb 17 11:53:00 sshguard 95660 Now monitoring attacks.
Feb 17 11:53:00 sshguard 71573 Exiting on signal.
Feb 17 10:26:00 sshguard 71573 Now monitoring attacks.
Feb 17 10:26:00 sshguard 52424 Exiting on signal.
Feb 17 09:26:00 sshguard 52424 Now monitoring attacks.
Feb 17 09:26:00 sshguard 69608 Exiting on signal.
Feb 17 08:59:00 sshguard 69608 Now monitoring attacks.
Feb 17 08:59:00 sshguard 41750 Exiting on signal.
Feb 17 07:32:00 sshguard 41750 Now monitoring attacks.
Feb 17 07:32:00 sshguard 74171 Exiting on signal.
Feb 17 06:06:00 sshguard 74171 Now monitoring attacks.
Feb 17 06:06:00 sshguard 10870 Exiting on signal.
Feb 17 04:39:00 sshguard 10870 Now monitoring attacks.
Feb 17 04:39:00 sshguard 76561 Exiting on signal.
Feb 17 03:17:00 sshguard 76561 Now monitoring attacks.
Feb 17 03:17:00 sshguard 25392 Exiting on signal.
Feb 17 01:49:00 sshguard 25392 Now monitoring attacks.
Feb 17 01:49:00 sshguard 31908 Exiting on signal.
Feb 17 00:21:00 sshguard 31908 Now monitoring attacks.
Feb 17 00:21:00 sshguard 36299 Exiting on signal.

troysjanda

@johnpoz Yes I get these and these appear even if ssh is disabled. I mostly use the weg gui for administrating pfsense, and only use the ssh on occasion but never seen these in the logs before updating to 2.6, and then 22.01. to be honest I don't ever remember seeing a log entries for sshguard prior to 2.6/22.01 and have been using pfsense for years.

Feb 17 06:43:00 sshguard 4904 Now monitoring attacks.
Feb 17 06:43:00 sshguard 72981 Exiting on signal.
Feb 16 20:01:00 sshguard 72981 Now monitoring attacks.
Feb 16 20:01:00 sshguard 99149 Exiting on signal.

johnpoz

@troysjanda I do not recall seeing them before - for sure could be something new that now logged..

I think the sshguard is enabled by default, I don't see a way to turn it off specifically. I do have ssh enabled.

It seems to just be some log spam at the moment.. @stephenw10 is here - he is always helpful, but I am happy to help try and track it down as another install seeing them.. My logs are set to be pretty big, and don't have a lot of stuff in the logs overall... So will see if I can spot why its kicking off and stopping and starting..

I seem to be seeing them ever 2 hours

Feb 17 13:00:00 	sshguard 	39476 	Now monitoring attacks.
Feb 17 13:00:00 	sshguard 	61273 	Exiting on signal.
Feb 17 11:01:00 	sshguard 	61273 	Now monitoring attacks.
Feb 17 11:01:00 	sshguard 	70550 	Exiting on signal.
Feb 17 09:05:00 	sshguard 	70550 	Now monitoring attacks.
Feb 17 09:05:00 	sshguard 	51227 	Exiting on signal.

Well hmmm - this looks to be something for sure.. Look at the timestamps on the logs

-rw-------   1 root        wheel       148546 Feb 17 13:28 resolver.log
-rw-------   1 root        wheel       521113 Feb 17 13:00 resolver.log.0
-rw-------   1 root        wheel       513709 Feb 17 11:01 resolver.log.1
-rw-------   1 root        wheel       511581 Feb 17 09:05 resolver.log.2

stephenw10

It's almost certainly one of the logs rotating. When I dug into it that was always the cause.
https://redmine.pfsense.org/issues/12747

sshguard doesn't only protect ssh, it monitors the logs for any login failures including the webgui.

You didn't see this in previous versions because the circular logs did not get rotated out. It didn't need to restart.

Steve

johnpoz

@stephenw10 yeah look at my edit the times of sshguard match up perfect with this log rotation.

edit: not sure what would be in the "resolver" log that sshguard would need to look at ;) but I get what your saying.. And make complete sense that if a new log is being used, prob need to cycle the process looking at the logs.

edit2: I just upped my log size from the 512000 size it was showing to 1024000 that for sure should reduce the amount of those entries in the log.

stephenw10

Yeah, it's a bug. An unanticipated side affect of the logging change. Whilst it's just occasional log spam for most in some cases it actively fills the logs itself.

I also see no reason for it to be looking at, for example, the dns logs. There is room for improvement!

Steve

troysjanda

@stephenw10 I have this in the cron

*/1 * * * * root /usr/sbin/newsyslog is this a possible culprit checking every minute to see if logs need to re rotated. the resolver log seems to be my largest log I increased the log size again to 1024000 see how that goes.

this is just driving me crazy as I did not see this in the 2.6/22.01 versions. I don't use very elaborate pfsense box, no vpns, no vlans, only 1 lan rule for dns and 1 nat port forward rule for dns. everything else is default

stephenw10

No that's an expected cron entry. It's not causing the log rotations.

johnpoz

@troysjanda btw - it occurred to me, why was my unbound logs rotating so often.. I had forgotten that I set log queries and replies in the options box troubleshooting something for someone, and never turned it back off ;)

In my custom options, I have turned these back off.. That should drastically reduce how often the resolver log rotates ;)

#log-queries: yes
#log-replies: yes

I would look in your /var/log folder and see which logs are doing the most rotating - maybe changes to whatever that is could reduce the number of rotations that happen, in turn lowering the number of times you see the sshguard log entry.

serbus

Hello!

Not exactly sure how sshguard is wired into the system, but it could be that every time newsyslog SIGHUPs syslogd on any log rotation (/var/etc/newsyslog.conf.d/pfSense.conf), sshguard gets restarted (piped from syslogd) and all of the bad actors tracked by sshguard are flushed (?). IOW, sshguard could have marginal value if it is getting restarted all the time, especially if there are bigger values set in System > Advanced > Admin Access > Login Protection. Maybe...

I guess if it is really bugging you and sshguard isnt delivering any value, you can just rename /usr/local/etc/sshguard.conf to something else and it wont run (?).

John

stephenw10

Yeah after having dug into it further my understanding changed. Whilst sshguard can parse the logs to look for auth entries that isn't what it's doing here. Instead all auth logs are piped to it directly from syslogd. But that means it's restarted whenever syslogd is restarted which is when any of the logs is rotated.
Which means my first though if just excluding the irrelevant log files doesn't work. More thought required.

Steve

troysjanda

@stephenw10 thanks for digging and look forward to hear if another solution of fix comes from you looking into it further.