Disable or whitelist sshguard

johnpoz

@pfnewb2016 said in Disable or whitelist sshguard:

believe sshguard is overriding the firewall rules allowing connections to ports 22, 443.

Its not overriding the rules - the rules still allow you to TALK to the port... sshguard is just blocking you from logging in because of failed login attempts..

The login protection section in the gui is pretty straight forward on the settings..

pfnewb2016

@johnpoz
Nope, sshguard blocks talking to the port, the webpage doesn't load. This is not a failed login, it happens before that and is documented here. The effect is that sshguard is overriding the Firewall Allow rules. In my case sshguard saw failed logins on snmp and ssh and blocked the the source IP from all service ports.

Re. "Login protection is straight forward": the gui simple enough, however:

It's not documented that by default, even with Firewall allow rules in place, it is possible for Login Protection to prevent access to the inside interface on both ssh and https.
There is no GUI that shows IP's currently or previously blocked by Login Protection. The log entry only shows the "attack", not the action or duration. IMO, there should be more logging and it s/b either under Firewall or it's own category.
The logs are not under Firewall rules, so when you can't login from one PC and then go to the firewall logs and don't see the block it's hard to troubleshoot.
The log entries in General are sourced or labeled sshguard, not Login Protection. This make it difficult to correlate the sshguard entry with Login Protection, particularly without any pfsense documentation.

stephenw10

You should see logged immediately before the sshguard line what triggered it's attack response:

Jun 24 00:17:49 	php-fpm 	30238 	/index.php: webConfigurator authentication error for user 'admin' from: 172.21.16.5
Jun 24 00:17:50 	sshguard 	65461 	Attack from "172.21.16.5" on service 380 with danger 10.

That should only ever be for services on the firewall itself.

Steve

bhagya_jani2277

I am facing the same problem!!
Did you found any solutions for it ??

Gertjan

@bhagya_jani2277 said in Disable or whitelist sshguard:

I am facing the same problem!!

What problem ?
The 'solution' was and still is : stop using wrong login name and/or passwords.

For SSH login : skip the password login all together, using a cert login.
Web login : have the browser remembering your password and you'll be ok.

If some (other) process in pour device (pc, portable, etc) is hammering port 22 or 80 or 443 on pfSRnse, then yes, your device - the IP - will get blocked.

bhagya_jani2277

@gertjan I am trying to access my pfsense from wan but SSHGUARD is blocking the both GUI and SSH ports and whenever I try to access from WAN so it refuses .

I found this thing by running this code pfctl -sr and in result i found this :

stephenw10

Those are default rules. They only block you if you've been locked out by entering the wrong credentials enough times.

https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#locked-out-by-too-many-failed-login-attempts

Steve

johnpoz

Why are 2 threads for the same thing?

bhagya_jani2277

@johnpoz I was searching for solution and saw this post, So just asked here that they get the solution or not.

stephenw10

Ok, let's continue this in the other thread since this appears unrealed to sshguard.
https://forum.netgate.com/topic/160415/having-issues-in-accessing-pfsense-using-ssh