"Fossies" - the Fresh Open Source Software Archive

Member "sshdfilter-1.5.7/man/sshdfilterrc.pod" (7 Jun 2010, 13835 Bytes) of package /linux/privat/old/sshdfilter-1.5.7.tar.gz:

Caution: As a special service "Fossies" has tried to format the requested pod source page into HTML format but links to other pod pages may be missing or even erroneous. Alternatively you can here view or download the uninterpreted pod source code. A member file download can also be achieved by clicking within a package contents listing on the according byte size field.


sshdfilterrc - configuration file for sshd brute force blocker


sshd wrapper script that generates iptables DROP rules when sshd reports any of i) no identify string sent by client ii) attempted login to a non-existant account iii) mupliple password failures for a valid account. DROP rules are added in realtime. There are two install routes, either as an sshd wrapper, in which case sshd messages are read directly by sshdfilter, or as a separate standalone program that parses sshd output via a didicated syslog named pipe.


sshdfilter blocks the frequent brute force attacks on ssh daemons, it does this by directly reading the sshd logging output (or syslog output) and generating iptables rules, the process can be quick enough to block an attack before they get a chance to enter any password at all. The blocking policy is defined by a list of blockrules largely by user name or by the type of user name.

There are two install routes, the old style sshdfilter starts sshd itself, having started sshd with the -e and -D options. The newer style uses a syslog configuration line that writes sshd messages to a dedicated named pipe, normally /var/run/sshd.fifo. Regardless, this means sshdfilter can see events as they happenand act on them as they happen.


Configuration is divided into several sections, OPTIONS for general options, USERPOLICY for user based block rules, IPPOLICY for IP based block rules and SSHDLOG for sshd log message definitions.



How long (seconds) after the last activity from an ip that it can be removed from iptables block list. The default is 3600*24*3 (259200) seconds, which is 3 days.

maxchances=<number of guesses>

How many password guesses an existing user can make before going on the blocked list. sshdfilter runs with sshd with the -e -D options, with these options, sshd likes to output failure and success messages twice. So this value needs to be twice what you actually want, defaults to 6, ie, 3 failed passwords.

firewalladd=<firewall command run when a drop rule is added> =item firewalldel=<firewall command run when a drop rule is deleted>

These commands are executed, the following variables are available: $ip - IP address of the offending machine. $chain - Chain to add this IP to. $idx - the next free ipfw index number (if you are using ipfw). Typical examples are: firewalladd='iptables -A $chain -p tcp -s $ip --dport 22 -j DROP' firewalldel='iptables -D $chain -p tcp -s $ip --dport 22 -j DROP' or for ipfw: firewalladd='ipfw add $idx drop tcp from $ip to any dst-port 22' firewalldel='ipfw delete $idx drop tcp from $ip to any dst-port 22'

chain=<name of iptables chain for sshfilter>

Name of iptables chain where sshdfilter will store its rules. If you want to run multiple isolated instances of sshdfilter then you will need to change this, your iptables setup and use the SSHFILTERRC environment variable (see INSTALL). Defaults to SSHD.

ip6toip4=<boolean value>

Convert any IPv6 addresses to IPv4, necessary for iptables, as only ip6tables knows about IPv6. Setting this option to 0 also enables calling ip6tables instead of iptables, so you should generally leave it set to 1. Defaults to 1.

ipfwmin=<index number>
ipfwmax=<index number>

Enable the use of ipfw (for BSD, Solaris, Mac) instead of iptables. This pair specify the range of index numbers used by the rules. Pick a range of numbers that fit into your firewall. Read INSTALL.ipfw

mail=<email command sequence>

Email any block events using the given command sequence. sshdfilter runs this line with some more details on stdin. Note perl executes this line, so be careful with escaping. Using the debug option might be a good idea, as would logging debug level syslog events (thats /etc/syslog.conf). Defaults to the empty string, but can for example be: mail="mail -s \"sshdfilter event for $ip, $event\" greg\@abatis.flint"

logsource=<file name>

Where the sshd log messages come from, either from STDIN (sshd -e -D | sshdfilter), or via syslog, in which case the messages are read from a named pipe and you need to look at the sshdname and logpid options below.

logpid=<sshd pid>

Assuming standard sshd behaviour, children of sshd (one sshd per connection) log to syslog directly, so the pid reported by syslog will change every time. The parent of the reported pid will be constant, and that is what this value should be. Or, set to <=0, and all sshdname processes will be interpretted as the same sshd. Can be given on the command line, sshdfilter logpid=`cat /var/run/sshd.pid`. Normally set to 0, as you normally don't need this.


Any character matching this expression is removed from the username before matching, to ensure odd characters aren't processed. If satitisation changes a username, the username is called DIRTY and matches the DIRTY pattern below. Normally [^-a-zA-Z0-9_].

sshdname=<sshd log name>

The name of the sshd process, only needed to identify the sshd process from a none STDIN logsource. See also logpid above, which isn't required if you have only one sshd daemon process. Normally 'sshd'.

sshdpath=<path to sshd executable>

Where the sshd executable can be found, defaults to /usr/sbin/sshd.


Debugging mode can be enabled by setting debug to 1, this enables a more verbose message parser which should help in locating any problems. Defaults to 0.







By default sshdfilter checks for its configuration file in /etc/sshdfilterrc, setting this variable will instead use the given file. This will typically be used to run multiple instances of sshdfilter, when monitoring multiple ports.


None known. More likely there are features you don't like.




Written by Greg: greg at csc liv ac uk. Would welcome any comments.

LogWatch script written by Tommo: sshdfilter at gmail com.


This software is released under the terms of the GNU GPLv2.


Hey! The above document had some coding errors, which are explained below:

Around line 126:

You can't have =items (as at line 134) unless the first thing after the =over is an =item

Around line 268:

'=item' outside of any '=over'

Around line 274:

You forgot a '=back' before '=head1'