Tons sshguard log entries and its not enabled
-
@stephenw10 I have this in the cron
*/1 * * * * root /usr/sbin/newsyslog is this a possible culprit checking every minute to see if logs need to re rotated. the resolver log seems to be my largest log I increased the log size again to 1024000 see how that goes.
this is just driving me crazy as I did not see this in the 2.6/22.01 versions. I don't use very elaborate pfsense box, no vpns, no vlans, only 1 lan rule for dns and 1 nat port forward rule for dns. everything else is default
Dell Poweredge r210 II, Intel(R) Xeon(R) CPU E31240 @ 3.30GHz RAM: 16GB
Dell Enterprise HHD x1 500gb (ZFS)
Pfsense: 2.7.1(amd64)
Installed Pkg's: Cron, System_Patches. -
No that's an expected cron entry. It's not causing the log rotations.
-
S SteveITS referenced this topic on
-
S SteveITS referenced this topic on
-
@troysjanda btw - it occurred to me, why was my unbound logs rotating so often.. I had forgotten that I set log queries and replies in the options box troubleshooting something for someone, and never turned it back off ;)
In my custom options, I have turned these back off.. That should drastically reduce how often the resolver log rotates ;)
#log-queries: yes #log-replies: yesI would look in your /var/log folder and see which logs are doing the most rotating - maybe changes to whatever that is could reduce the number of rotations that happen, in turn lowering the number of times you see the sshguard log entry.
-
Hello!
Not exactly sure how sshguard is wired into the system, but it could be that every time newsyslog SIGHUPs syslogd on any log rotation (/var/etc/newsyslog.conf.d/pfSense.conf), sshguard gets restarted (piped from syslogd) and all of the bad actors tracked by sshguard are flushed (?). IOW, sshguard could have marginal value if it is getting restarted all the time, especially if there are bigger values set in System > Advanced > Admin Access > Login Protection. Maybe...
I guess if it is really bugging you and sshguard isnt delivering any value, you can just rename /usr/local/etc/sshguard.conf to something else and it wont run (?).
John
-
Yeah after having dug into it further my understanding changed. Whilst sshguard can parse the logs to look for auth entries that isn't what it's doing here. Instead all auth logs are piped to it directly from syslogd. But that means it's restarted whenever syslogd is restarted which is when any of the logs is rotated.
Which means my first though if just excluding the irrelevant log files doesn't work. More thought required.Steve
-
@stephenw10 thanks for digging and look forward to hear if another solution of fix comes from you looking into it further.
-
I noticed the same problem. The message occurs roughly every half hour and it's that frequent because of the firewall log file rotating - I turned off logging of the default deny rule and haven't had the message in the last 11 hours.
-
@ebcdic Where can you turn off logging of the default deny rule??
-
In Status > System Logs > Settings. Uncheck 'Log firewall default blocks'.
-
@stephenw10 Thanks, got it. Yes, I am also seeing the MANY SSHGuard starting and stopping in the log. I'll try disabling the default deny rule logging...would be an easy fix.
-
@jeff3820 said in Tons sshguard log entries and its not enabled:
I'll try disabling the default deny rule logging...would be an easy fix.
That seems a bit over the top - because I get a log entry every time my log rotations - I just won't log anything hitting my firewall that is blocked..
A bit a drastic fix for what is some log spam... Like that damn fly - let me hit him with this 20 lb sledge hammer..
Wouldn't it be simpler to just up the log size so they don't rotate as often?
-
I reverted back to 2.6.0 and I am not seeing those entries as often, in the last 2 days I have only seen it 3 times.
I did a fresh install to move back to 2.6.0 using a 22.01 config.xml backup and switched to the ZFS file system using 2 disks in mirroring mode. It went without issue. i'd love to use the ZFS widget but for now i'm staying put on 2.6.0 until some sort of clarity is officially released concerning the EULA and home use.
Not hopping on the Reddit clusterfud but don't want updates to stop or usage of packages to stop at the end of a year or at some point like I have been hearing.
Dell Poweredge r210 II, Intel(R) Xeon(R) CPU E31240 @ 3.30GHz RAM: 16GB
Dell Enterprise HHD x1 500gb (ZFS)
Pfsense: 2.7.1(amd64)
Installed Pkg's: Cron, System_Patches. -
@johnpoz What log size would you recommend? 1024000? 2048000?
-
@troysjanda after bumping my log to 1024K and turning off logging of all my dns queries and replies I saw 3 entries on the 19th..
Which I don't see how that could be even considered an issue.. 300 ok, bit of a log spam problem - 30 ok seems a bit excessive in a 24 hour period.. But 3.. Shoot HAproxy is way noisy that in its logs ;)
I had that at informational - just turned that down as well to error ;)
-
@jeff3820 said in Tons sshguard log entries and its not enabled:
1024000
this is what I have set mine to and currently all logs are utilizing 104K
-
@troysjanda Is this under DNS Resolver log settings??
<<turning off logging of all my dns queries and replies>>
-
@jeff3820 that was a manual setting you have to do in the custom box... I had turned it on for troubleshooting something for someone to show them, etc. And had forgotten to turn it back off.
I have also now taken a look at all my other log settings, openvpn had been set higher than default as well.. And haproxy was set pretty high.. Turning down logs to not be so spammy and upping the size before rotation should drastically reduce how many times the logs rotate and create that sshguard entry that your logs rotated, etc.
Currently I could see that dhcp server and noise on the firewall most likely would be the logs that normally have to rotate.. If you get a lot of noise on your wan from the default deny, or you have a lot of clients renewing dhcp.. You could prob up your lease time to lower the amount of those entries so clients don't renew as often..
If you continue to high a really high number of those sshguard entries... Look in your log directory and determine which log(s) are doing a lot of rotating - possible lower the amount of logging they do, or increase the log rotation size even higher..
If you do see lots and lots of noise on your wan - sure you could turn off logging of the default deny. But I would prob put something in its place to see what is hitting your wan. I log for example only syn and common udp ports.. Because yes the internet can be a noisy place - and while I want to see actual directed traffic to my wan - I really don't care much about some UDP noise to some random port, or non syn traffic..
-
@jeff3820 said in Tons sshguard log entries and its not enabled:
@troysjanda Is this under DNS Resolver log settings??
<<turning off logging of all my dns queries and replies>>
under ServicesDNS/ Resolver/AdvancedSettings set log level to 1 basic this is what I did and increased the size of logs in my previous comment
-
@johnpoz said in Tons sshguard log entries and its not enabled:
I log for example only syn and common udp ports
Can you provide the rules you use for this, im very new to rule writing.
-
An interesting observation...I have 2 weatherstations that are renewing their DHCP leases every MINUTE. Is there a way to not log those devices? I had them on a static IP but just took them off to see if that was an issue:
Feb 20 18:03:48 dhcpd 96898 DHCPACK on 192.168.40.63 to 60:01:94:32:db:92 (ESP_32DB92) via em1.40
Feb 20 18:03:48 dhcpd 96898 DHCPREQUEST for 192.168.40.63 (192.168.40.1) from 60:01:94:32:db:92 (ESP_32DB92) via em1.40
Feb 20 18:03:48 dhcpd 96898 reuse_lease: lease age 161 (secs) under 25% threshold, reply with unaltered, existing lease for 192.168.40.63
Feb 20 18:03:48 dhcpd 96898 DHCPOFFER on 192.168.40.63 to 60:01:94:32:db:92 (ESP_32DB92) via em1.40
Feb 20 18:03:48 dhcpd 96898 DHCPDISCOVER from 60:01:94:32:db:92 (ESP_32DB92) via em1.40
Feb 20 18:03:48 dhcpd 96898 reuse_lease: lease age 161 (secs) under 25% threshold, reply with unaltered, existing lease for 192.168.40.63
Feb 20 18:03:48 dhcpd 96898 DHCPACK on 192.168.40.64 to 2c:3a:e8:38:af:53 (ESP_38AF53) via em1.40
Feb 20 18:03:48 dhcpd 96898 DHCPREQUEST for 192.168.40.64 (192.168.40.1) from 2c:3a:e8:38:af:53 (ESP_38AF53) via em1.40
Feb 20 18:03:48 dhcpd 96898 reuse_lease: lease age 159 (secs) under 25% threshold, reply with unaltered, existing lease for 192.168.40.64
Feb 20 18:03:48 dhcpd 96898 DHCPOFFER on 192.168.40.64 to 2c:3a:e8:38:af:53 (ESP_38AF53) via em1.40
Feb 20 18:03:48 dhcpd 96898 DHCPDISCOVER from 2c:3a:e8:38:af:53 (ESP_38AF53) via em1.40
Feb 20 18:03:48 dhcpd 96898 reuse_lease: lease age 159 (secs) under 25% threshold, reply with unaltered, existing lease for 192.168.40.64
Feb 20 18:03:11 dhcpd 96898 DHCPACK on 192.168.40.63 to 60:01:94:32:db:92 (ESP_32DB92) via em1.40
Feb 20 18:03:11 dhcpd 96898 DHCPREQUEST for 192.168.40.63 (192.168.40.1) from 60:01:94:32:db:92 (ESP_32DB92) via em1.40
Feb 20 18:03:11 dhcpd 96898 reuse_lease: lease age 124 (secs) under 25% threshold, reply with unaltered, existing lease for 192.168.40.63
Feb 20 18:03:11 dhcpd 96898 DHCPOFFER on 192.168.40.63 to 60:01:94:32:db:92 (ESP_32DB92) via em1.40
Feb 20 18:03:11 dhcpd 96898 DHCPDISCOVER from 60:01:94:32:db:92 (ESP_32DB92) via em1.40
Feb 20 18:03:11 dhcpd 96898 reuse_lease: lease age 124 (secs) under 25% threshold, reply with unaltered, existing lease for 192.168.40.63
Feb 20 18:03:11 dhcpd 96898 DHCPACK on 192.168.40.64 to 2c:3a:e8:38:af:53 (ESP_38AF53) via em1.40
Feb 20 18:03:11 dhcpd 96898 DHCPREQUEST for 192.168.40.64 (192.168.40.1) from 2c:3a:e8:38:af:53 (ESP_38AF53) via em1.40
Feb 20 18:03:11 dhcpd 96898 reuse_lease: lease age 122 (secs) under 25% threshold, reply with unaltered, existing lease for 192.168.40.64
Feb 20 18:03:11 dhcpd 96898 DHCPOFFER on 192.168.40.64 to 2c:3a:e8:38:af:53 (ESP_38AF53) via em1.40
Feb 20 18:03:11 dhcpd 96898 DHCPDISCOVER from 2c:3a:e8:38:af:53 (ESP_38AF53) via em1.40
