blob: 0c0f3f885ca2e04e7f71341b21371699cd188739 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
#!/bin/mkpkg
# description: Protect hosts from brute-force attacks by aggregating logs
# url: https://www.sshguard.net
name=sshguard
version=2.5.1
release=6
depends=(nftables)
services=(sshguard)
permissions=(
/var/db/sshguard:root:root:700
/etc/sshguard.conf:root:root:644
/etc/sshguard:root:root:755
/etc/sshguard/whitelist:root:root:644
)
source=(https://downloads.sourceforge.net/project/$name/$name/$version/$name-$version.tar.gz)
sha256sums=(
"997a1e0ec2b2165b4757c42f8948162eb534183946af52efc406885d97cb89fc"
)
build() {
cd $name-$version
./configure \
--prefix=/usr \
--sbindir=/usr/bin \
--libexecdir=/usr/lib/$name \
--sysconfdir=/etc \
--mandir=/usr/share/man
make
make DESTDIR=$PKG install
# configure has no backend switch; keep nft-sets and null only
for fw in firewalld hosts ipfilter ipfw ipset iptables pf; do
rm -f $PKG/usr/lib/$name/sshg-fw-$fw
done
}
post_build() {
install -d $PKG/etc/sshguard
install -d -m 700 $PKG/var/db/sshguard
# Addresses here are never blocked. Add the admin's LAN, static IP and
# VPN subnet, or a few failed logins can lock the admin out.
printf '%s\n' \
'# one address or CIDR block per line' \
'127.0.0.0/8' \
'::1/128' \
> $PKG/etc/sshguard/whitelist
printf '%s\n' \
'# rawnix sshguard.conf' \
'BACKEND="/usr/lib/sshguard/sshg-fw-nft-sets"' \
'# sshd logs via svlogd -tt; sshg-parser does not understand that prefix.' \
'# Strip it with a shell read loop: every line is written immediately.' \
'# (awk here buffered all output despite fflush(), so nothing reached' \
'# the parser and nothing was ever banned.)' \
'LOGREADER="LANG=C tail -F -n 0 /var/log/sshd/current | while read -r _ts line; do printf '"'"'%s\n'"'"' \"\$line\"; done"' \
'THRESHOLD=30' \
'BLOCK_TIME=120' \
'DETECTION_TIME=1800' \
'BLACKLIST_FILE=200:/var/db/sshguard/blacklist.db' \
'WHITELIST_FILE=/etc/sshguard/whitelist' \
'SSHGUARD_USER=nobody' \
> $PKG/etc/sshguard.conf
# runit service
install -d $PKG/etc/sv/sshguard/log
# The sshguard wrapper ends with trap "kill 0" EXIT, which signals its
# whole process group. Run it in its own group (chpst -P) so that a stop
# or restart cannot take runsv and the log svlogd down with it.
printf '%s\n' \
'#!/bin/sh' \
'exec 2>&1' \
'exec chpst -P sshguard' \
> $PKG/etc/sv/sshguard/run
# On restart the old backend deletes its tables from its own exit trap.
# Wait for it, so the next fw_init does not race that cleanup
# ("Could not initialize firewall").
printf '%s\n' \
'#!/bin/sh' \
'i=0' \
'while pgrep -f /usr/lib/sshguard/sshg-fw-nft-sets >/dev/null && [ $i -lt 20 ]; do' \
' sleep 0.25; i=$((i+1))' \
'done' \
'nft delete table ip sshguard 2>/dev/null' \
'nft delete table ip6 sshguard 2>/dev/null' \
'exit 0' \
> $PKG/etc/sv/sshguard/finish
printf '%s\n' \
'#!/bin/sh' \
'mkdir -p /var/log/sshguard' \
'exec svlogd -tt /var/log/sshguard' \
> $PKG/etc/sv/sshguard/log/run
chmod 755 $PKG/etc/sv/sshguard/run
chmod 755 $PKG/etc/sv/sshguard/finish
chmod 755 $PKG/etc/sv/sshguard/log/run
}
signify() {
untrusted comment: public key
RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}
# vim: filetype=sh
|
