1 files changed, 111 insertions, 0 deletions
diff --git a/opt/sshguard/MAKEPKG b/opt/sshguard/MAKEPKG
new file mode 100644
index 0000000..0c0f3f8
--- /dev/null
+++ b/opt/sshguard/MAKEPKG
@@ -0,0 +1,111 @@
+#!/bin/mkpkg
+# description: Protect hosts from brute-force attacks by aggregating logs
+# url: https://www.sshguard.net
+
+name=sshguard
+version=2.5.1
+release=6
+depends=(nftables)
+services=(sshguard)
+permissions=(
+    /var/db/sshguard:root:root:700
+    /etc/sshguard.conf:root:root:644
+    /etc/sshguard:root:root:755
+    /etc/sshguard/whitelist:root:root:644
+)
+source=(https://downloads.sourceforge.net/project/$name/$name/$version/$name-$version.tar.gz)
+
+sha256sums=(
+    "997a1e0ec2b2165b4757c42f8948162eb534183946af52efc406885d97cb89fc"
+)
+
+build() {
+    cd $name-$version
+
+    ./configure \
+        --prefix=/usr \
+        --sbindir=/usr/bin \
+        --libexecdir=/usr/lib/$name \
+        --sysconfdir=/etc \
+        --mandir=/usr/share/man
+
+    make
+    make DESTDIR=$PKG install
+
+    # configure has no backend switch; keep nft-sets and null only
+    for fw in firewalld hosts ipfilter ipfw ipset iptables pf; do
+        rm -f $PKG/usr/lib/$name/sshg-fw-$fw
+    done
+}
+
+post_build() {
+    install -d $PKG/etc/sshguard
+    install -d -m 700 $PKG/var/db/sshguard
+
+    # Addresses here are never blocked. Add the admin's LAN, static IP and
+    # VPN subnet, or a few failed logins can lock the admin out.
+    printf '%s\n' \
+        '# one address or CIDR block per line' \
+        '127.0.0.0/8' \
+        '::1/128' \
+        > $PKG/etc/sshguard/whitelist
+
+    printf '%s\n' \
+        '# rawnix sshguard.conf' \
+        'BACKEND="/usr/lib/sshguard/sshg-fw-nft-sets"' \
+        '# sshd logs via svlogd -tt; sshg-parser does not understand that prefix.' \
+        '# Strip it with a shell read loop: every line is written immediately.' \
+        '# (awk here buffered all output despite fflush(), so nothing reached' \
+        '# the parser and nothing was ever banned.)' \
+        'LOGREADER="LANG=C tail -F -n 0 /var/log/sshd/current | while read -r _ts line; do printf '"'"'%s\n'"'"' \"\$line\"; done"' \
+        'THRESHOLD=30' \
+        'BLOCK_TIME=120' \
+        'DETECTION_TIME=1800' \
+        'BLACKLIST_FILE=200:/var/db/sshguard/blacklist.db' \
+        'WHITELIST_FILE=/etc/sshguard/whitelist' \
+        'SSHGUARD_USER=nobody' \
+        > $PKG/etc/sshguard.conf
+
+    # runit service
+    install -d $PKG/etc/sv/sshguard/log
+
+    # The sshguard wrapper ends with trap "kill 0" EXIT, which signals its
+    # whole process group. Run it in its own group (chpst -P) so that a stop
+    # or restart cannot take runsv and the log svlogd down with it.
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'exec 2>&1' \
+        'exec chpst -P sshguard' \
+        > $PKG/etc/sv/sshguard/run
+
+    # On restart the old backend deletes its tables from its own exit trap.
+    # Wait for it, so the next fw_init does not race that cleanup
+    # ("Could not initialize firewall").
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'i=0' \
+        'while pgrep -f /usr/lib/sshguard/sshg-fw-nft-sets >/dev/null && [ $i -lt 20 ]; do' \
+        '    sleep 0.25; i=$((i+1))' \
+        'done' \
+        'nft delete table ip sshguard 2>/dev/null' \
+        'nft delete table ip6 sshguard 2>/dev/null' \
+        'exit 0' \
+        > $PKG/etc/sv/sshguard/finish
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'mkdir -p /var/log/sshguard' \
+        'exec svlogd -tt /var/log/sshguard' \
+        > $PKG/etc/sv/sshguard/log/run
+
+    chmod 755 $PKG/etc/sv/sshguard/run
+    chmod 755 $PKG/etc/sv/sshguard/finish
+    chmod 755 $PKG/etc/sv/sshguard/log/run
+}
+
+signify() {
+    untrusted comment: public key
+    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
+}
+
+# vim: filetype=sh