sshguard generate an email

skogs

I was thinking about setting up another very limited honeypot (home/test net) and then I had the idea of simply using the pfsense that already has the capability to send email notifications.

Is there a way to utilize sshguard in pfsense to not only temporarily block a local IP that fails to log in 3 times, but to also kick off an extremely simple mail?

I have excellent telemetry internally but recently shut down the internal mail relay so the old notification setup doesn't function. The pfsense still manually emails out on its own and I'd like to utilize that function. If anybody besides me fails to log into it on the first try, an email summoning me home would be a high value item.

I just don't know where the sshguard config file is or if a simple local file addition would be respected through upgrades. Honestly something this quick and easy might be a decent 2 hour project to just add to the webconfig.

Gertjan

@skogs said in sshguard generate an email:

Is there a way to utilize sshguard in pfsense to not only temporarily block a local IP that fails to log in 3 times, but to also kick off an extremely simple mail?

True, pfSense doesn't have 'man'ual pages, but they exist : FreeBSD 15.0 man sshguard.
None of the program options offer you to mail (smtp out).
sshguard finds suspicious SSH login attempts by ... reading the system log.
Login attempts are logged by the sshd daemon, and as the source IP is known , sshguard grabs the IP, and puts it into the 'sshguard' table. This table is used by the pfSense firewall 'pf' with a 'block' rule.

'Sending a mail' isn't an option, so you have to create** this yourself.
For example : a (shell) script that parses the (auth) log, and when you find a sshd login failure message, send a mail.
** or add ?! sshguard, as FreeBSD itself is open source. So : modify its behavior ?
After all, the person that enters the honey pot will master all this. That is : no one on planet earth will try one IP after another if a SSH access is accessible. But ones the scripts find one = your honey pot IP, a real person will take over and this person will use everything he knows to discover about your exposed system.
I advise you strongly NOT to engage into this kind of games. You will loose.
Get a drink, some pop corn, 25 minutes, and have a look at this one.

This question really makes me think your are not a security expert :
( and most of us aren't, that's why we play it safe, use pfSense, and pass on to other things that can do manage well ^^

@skogs said in sshguard generate an email:

I just don't know where the sshguard config file is

Your question tells me that you don't know what is running on your pfSense.
Ask it ?
Here :

[26.03-RELEASE][root@pfSense.bhf.tld]/root: ps aux | grep 'sshguard'
root    23021   0.0  0.1  14216   2596  -  Is    2Apr26     0:00.00 daemon: sshguard[23123] (daemon)
root    23123   0.0  0.1  14780   3028  -  I     2Apr26     0:00.00 /bin/sh /usr/local/sbin/sshguard -i /var/run/sshguard.pid
root    23772   0.0  0.1  14740   3192  -  IC    2Apr26     0:00.43 /usr/local/libexec/sshg-blocker -a 20 -p 110 -s 1800 -w /usr/local/etc/sshguard.whitelist
root    23790   0.0  0.1  14780   3036  -  I     2Apr26     0:00.00 /bin/sh /usr/local/sbin/sshguard -i /var/run/sshguard.pid
root    47420   0.0  0.1  14196   2768  0  S+   08:31       0:00.00 grep sshguard

and this output shows some good news for you : sshguard isn't a some C compiled code, but a shell script
So : adding 'mail out' capabilities can be added in a "matter of minutes".

Btw : the same info can be shown here : Diagnostics > System Activity but that page can't be filtered, and refreshes every x seconds so it's difficult to look for things.

skogs

@Gertjan
That is a lot of words.

For future folks searching config file is

/usr/local/etc/sshguard.conf

It contains two lines by default. One to tell where the auth log is, the other for the backend /
usr/local/libexec/sshg-fw-pf

The backend could easily be edited to send a mail.
One could also modify the direct executable script that is always running as Gertjan suggests at /usr/local/sbin/sshguard.

If one had normal sendmail and were looking for actual logins, could just append:

sendmail name@somewhere.com < /root/notice.txt

and notice.txt be:
xXxWARNINGxXx Failed ssh attempt internal to network xyz xXxWARNINGxXx

However we're not that simple, nor do I want a real login. We can't have sendmail. I'll dig into the php and find some way to fiddle with it so that I don't have to figure it out again 2 years from now.

Gertjan

@skogs said in sshguard generate an email:

We can't have sendmail. I'll dig into the php

Send up at least one the pfSense notification source System > Advanced > Notifications.
Check out this file : /etc/inc/notcies, the very last "function notify_all_remote($msg)".
There you have your 'mail' out function ^^