Tons sshguard log entries and its not enabled

[stephenw10]

Yeah, the processes should look like:

root    77695   0.0  0.1  11384  2824  -  Ss   13:03     0:00.24 |-- /usr/sbin/syslogd -s -c -c -l /var/dhcpd/var/run/log -P /var/run/syslog.p
root    63461   0.0  0.1  11524  3048  -  Is   20:41     0:00.00 | `-- /bin/sh /usr/local/sbin/sshguard -i /var/run/sshguard.pid
root    63916   0.0  0.1  10620  2224  -  I    20:41     0:00.00 |   |-- /bin/cat
root    63956   0.0  0.2  17420  4420  -  IC   20:41     0:00.00 |   |-- /usr/local/libexec/sshg-parser
root    64030   0.0  0.1  12072  2796  -  IC   20:41     0:00.00 |   |-- /usr/local/libexec/sshg-blocker
root    64102   0.0  0.2  11524  3052  -  I    20:41     0:00.00 |   `-- /bin/sh /usr/local/sbin/sshguard -i /var/run/sshguard.pid
root    64566   0.0  0.1  11492  3044  -  I    20:41     0:00.00 |     `-- /bin/sh /usr/local/libexec/sshg-fw-pf

But after restarting syslogd manually:

root    38082   0.0  0.1  11372  2820  -  Ss   20:44     0:00.00 |-- /usr/sbin/syslogd -s -c -c -l /var/dhcpd/var/run/log -P /var/run/syslog.pid -f /etc/syslog.conf

And logging out and back in restarts it:

Jul 8 20:49:47 	sshd 	77257 	Received disconnect from 172.21.16.5 port 58362:11: disconnected by user
Jul 8 20:49:47 	sshd 	77257 	Disconnected from user admin 172.21.16.5 port 58362
Jul 8 20:49:47 	sshguard 	26522 	Now monitoring attacks.
Jul 8 20:49:52 	sshd 	27315 	Accepted keyboard-interactive/pam for admin from 172.21.16.5 port 58364 ssh2 

Hmm

[stephenw10]

Ok, it's not really a bug because the process is restarted as soon as there is a login attempt. And it still locks you out after three bad attempts.

[johnpoz]

@stephenw10 you could even call it a feature ;)

Why run a process if there is nothing to do.. Until there is a login attempt why monitor a log for something that isn't happening ;)

[stephenw10]

Mmm, but that begs the question, why run it continually at all?

[geovaneg]

@johnpoz

Following this line of reasoning, I wonder: is it really necessary for sshguard to keep recording in the system log each time it restarts along with rotate, if it is really protecting the ssh service?
Is there another unwanted side effect of the rotate occurring every 2 minutes? It wouldn't matter much to me, as long as it doesn't fill up my filesystem, as the logs are sent remotely.
Isn't there a way to disable sshguard restart log in the system logs?

[geovaneg]

@stephenw10 said in Tons sshguard log entries and its not enabled:

Mmm, but that begs the question, why run it continually at all?

exactly!

[stephenw10]

In some systems the CPU required to compress the logs when rotates can become significant. It's worth disabling the compression if that's the case.

[johnpoz]

@stephenw10 said in Tons sshguard log entries and its not enabled:

It's worth disabling the compression if that's the case.

Yeah I would turn that off, especially if your only going to keep 6 logs, and they at most could be 1M..

Also if your on zfs believe its recommended not to compress them because zfs is already compressing, etc.

Now if you were say logging files were set for say 100M and storing lots of them rotated, and you were tight on space compression might make sense.

If your logging remotely - would it be possible to just disable local logging? There is an option for that I believe.

[geovaneg]

@johnpoz @stephenw10

Good morning guys.

I've never had any CPU problems with this machine. It is a VM hosted on VMWare with good hardware features.

My file system is UFS and I don't intend to change that now.

I don't know if there is an option to disable logs locally. Even if there is, I have no intention of doing that, because we usually do a daily overview of the system logs, via the web console, to assess the latest events and the overall health of the system. Remote logs are primarily intended for audits.

Talking to you, I decided to implement some of your suggestions:

• I kept disabled the log packets matched from the default block rules in the ruleset to reduce the amount of system logs. It is worth remembering that these logs were enabled in version 2.5.1 and I didn't experience any issues;
• I increased the size of the log files to 10 MB;
• Even though I didn't have any CPU problems, I disabled file compression. CPU is never too much ;
• As the local logs don't interest me much, I reduced the retention to only 4 files in the log rotation.

Result:

All this is giving me less than an hour of peace, without the "sshguard" generating restart logs.
The main drawback of this is that it can fill the system logs page on the web interface with this filth and distract me from some really important event during my daily inspections.

-rw------- 1 root wheel 5554233 Jul 11 09:53 filter.log
-rw------- 1 root wheel 10558634 Jul 11 09:43 filter.log.0
-rw------- 1 root wheel 10289157 Jul 11 09:19 filter.log.1
-rw------- 1 root wheel 10304545 Jul 11 08:47 filter.log.2
-rw------- 1 root wheel 10279009 Jul 11 07:40 filter.log.3

Thank you for your suggestions and if you have any more they are welcome.

Thanks

Geovane

[johnpoz]

@geovaneg said in Tons sshguard log entries and its not enabled:

because we usually do a daily overview of the system logs,

You mean a last 16 minutes or so overview ;) Well your other logs could be longer I guess.. Just the one that cycles ever 2 minutes is pretty useless..

[geovaneg]

Good Morning @johnpoz !

Firewall logs are not mixed with system logs in the web interface.

[johnpoz]

@geovaneg yeah - it was my morning before coffee attempt at humor ;) heheh

[stephenw10]

Right now your only options there are larger logs and/or log less. You could probably go to 100MB files for the filter log easily. I have seen users with log file set in the GB. I would not recommend that though!

[geovaneg]

Hi @stephenw10

Let's try an ideal combination of the two.
But for today I'll just follow the behavior.

Thanks.

Geovane

[geovaneg]

Change of plans:

My quiet time dropped to less than 20 minutes in the last rotation, with the arrival of users on the wifi network.

I am changing the size of the log files to 100MB and the retention to 2 files.

[geovaneg]

Good morning gentlemen,

Thanks to you, we are evolving towards a satisfactory configuration.
I was looking for logs to disable and I noticed that the squid access logs are being written locally to the /var/log/nginx.log file and also to the /var/squid/logs/access.log folder.
Do you know if there's a way to solve this without affecting the sending to the remote server?
Note: I have the LightSquid package installed as well.

Thanks.

[stephenw10]

Hmm, nothing I'm aware of but I've never tried to solve that before. You mean prevent Squid writing to the nginx log? You certainly need local logging for LightSquid to work.

[geovaneg]

@stephenw10

Good Morning,

Yes, LightSquid uses log files from the "/var/squid/logs" folder. I reduced the space used by changing the retention of logs in the squid from 30 to 3 files.
Regarding the same logs that go to "/var/log/nginx.log" it seems that they are sent remotely to syslog, so there's not much to do there.

[geovaneg]

Sirs,

Thanks again for the suggestions.
I believe that we have reached a suitable configuration for our case.

I'll report the actions in case anyone finds this useful in the future:

PfSense 2.6.0 - FW/GW/Proxy wifi network approx 1300 daily users.
Logs are sent remotely for auditing purposes. Lots of filter logs!

Our final configuration to avoid "sshguard" spam looked like this:

• We increased log file size to 100MB;
• To avoid excessive disk consumption, retention has been changed to only two files in "log settings";

-rw------- 1 root wheel 97239550 Jul 14 11:35 filter.log
-rw------- 1 root wheel 102682474 Jul 13 16:16 filter.log.0
-rw------- 1 root wheel 102697059 Jul 13 11:31 filter.log.1

• To avoid the risk of unnecessary CPU consumption, log compression was disabled (UFS);
• We disabled the log packets matched from the default block rules in the ruleset to reduce the amount of system logs;
• We reviewed the other firewall rules and kept the logs strictly necessary;
• Also to avoid space consumption, squid log retention has been reduced from 30 to 3 files.

Thanks,

Geovane

[noplan]

ok run into same thing ...
gonna have a look into this

2.6CE

brNP