sshguard

Source : http://howtounix.info/howto/sshguard-freebsd

sshguard is a security tool protecting networked hosts from brute force attacks against ssh servers. It detects these attacks and blocks attacker's address creating a firewall rule.

sshguard with pf

Installing sshguard from ports:

cd /usr/ports/security/sshguard-pf
make install clean

Add to /etc/syslog.conf:

auth.info;authpriv.info |exec /usr/local/sbin/sshguard -a 15 -p 9200 -s 12000

Edit pf.conf:

table <sshguard> persist
block in quick on re0 proto tcp from <sshguard> to any port ssh label "ssh brute"

change re0 to your external interface name.

This command will display addresses in the table:

pfctl -t sshguard -T show

To delete an address from the table (for example 192.168.1.5) use:

pfctl -t sshguard -T delete 192.168.1.5

sshguard with ipfw

It's easy to install and configure sshguard with ipfw.sshguard:

cd /usr/ports/security/sshguard-ipfw/
make install clean

There are no build options so you can get straight to configuring.

Configuring sshguard

Add to /etc/syslog.conf:

auth.info;authpriv.info |/usr/local/sbin/sshguard -w 192.168.1.10

-w command-line option is used for whitelisting. This option can add explicit addresses, host names and address blocks. Specify the address directly, like:

-w 192.168.1.10

or in multiple occurrences:

-w 192.168.1.10 -w 192.168.1.11 -w 192.168.1.12

sshguard detects 4 attack attempts as brute force by default. You can change this number using -a option. When brute force is detected sshguard adds new rule to firewall rules: deny ip from brute.ip.add.ress to me

This rule will be deleted in 420 seconds. If the attack from this address happens again block time doubles.

-b option is used for creating blacklists. -b 10:/var/db/sshguard/blacklist.db means that after 10 firewall blocks the address will be put on the blacklist and blocked forever. Blocking rules are in 55000-55050 IDs range.

source : http://www.sshguard.net/docs/man/sshguard/1_5/

Depending on the way chosen for giving logs to sshguard, and depending on the chosen blocking system, some setup may be needed. Instructions are documented at http://www.sshguard.net/docs/setup/.

sshguard does not make use of any configuration file. Instead, a combination of optional arguments can be passed to its process on the command line, for modifying its default behaviour:

-b [num:]filename

enable blacklisting: blacklist after num (or 3) blocked abuses, and hold the permanent blacklist in filename. SeeTOUCHINESS & BLACKLISTING below.

-v

print summary information on sshguard and exit.

-l source

enable the Log Sucker, and add source to the list of log sources to monitor. source is a filename, a FIFO name, or the magic symbol "-" to identify sshguard's standard input. sshguard handles autonomously file-like sources disappearing, reappearing, or "rotating". This option can be used multiple times. When omitted, source defaults to standard input. Otherwise, standard input is ignored unless explicitly added.

-a sAfety_thresh

block an attacker after it incurred a total dangerousness exceeding sAfety_thresh. Most attacks incur dangerousness 10. See http://www.sshguard.net/docs/reference/attack-signatures/ for details. (Default: 40)

-p secs

release a blocked address not sooner than secs seconds after being blocked. sshguard will release the address between X and 3/2 * X seconds. (Default: 7*60)

-s secs

forget about an address after secs seconds. If host A issues one attack every this many seconds, it will never be blocked. (Default: 20*60)

-w addr/host/block/file

see the WHITELISTING section.

-f servicecode:pidfile

see the LOG MESSAGE AUTHENTICATION section.

When sshguard is signalled with SIGTSTP, it suspends activity. When sshguard is signalled with SIGCONT, it resumes monitoring. During suspension, log entries are discarded without being analyzed

When sshguard senses the SSHGUARD_DEBUG environment variable, it enables debugging mode: logging is directed to standard error instead of syslog, and includes comprehensive details of the activity and parsing process. Debugging mode can help investigating patterns: once enabled, a pattern can be directly pasted into the tool from the console, and the behavior is immediately and minutely shown beneath.

WHITELISTING

sshguard supports address whitelisting. Whitelisted addresses are not blocked even if they appear to generate attacks. This is useful for protecting lame LAN users (or external friendly users) from being incidentally blocked.

Whitelist addresses are controlled through the -w command-line option. This option can add explicit addresses, host names and address blocks:

addresses

specify the numeric IPv4 or IPv6 address directly, like:

-w 192.168.1.10

or in multiple occurrences:

-w 192.168.1.10 -w 2001:0db8:85a3:0000:0000:8a2e:0370:7334

host names

specify the host name directly, like:

-w friendhost.enterprise.com

or in multiple occurrences:

-w friendhost.enterprise.com -w friend2.enterprise.com

All IPv4 and IPv6 addresses that the host resolves to are whitelisted. Hosts are resolved to addresses once, when sshguard starts up.

address blocks

specify the IPv4 or IPv6 address block in the usual CIDR notation:

-w 2002:836b:4179::836b:0000/126

or in multiple occurrences:

-w 192.168.0.0/24 -w 1.2.3.128/26

file

When longer lists are needed for whitelisting, they can be wrapped into a plain text file, one address/hostname/block per line, with the same syntax given above.
sshguard can take whitelists from files when the -w option argument begins with a `.' (dot) or `/' (slash). This is a sample whitelist file (say /etc/friends):

# comment line (a '#' as very first character)
#   a single IPv4 and IPv6 address
1.2.3.4
2001:0db8:85a3:08d3:1319:8a2e:0370:7344
#   address blocks in CIDR notation
127.0.0.0/8
10.11.128.0/17
192.168.0.0/24
2002:836b:4179::836b:0000/126
#   hostnames
rome-fw.enterprise.com
hosts.friends.com

And this is how sshguard is told to make a whitelist up from the /etc/friends file:

sshguard -w /etc/friends

The -w option can be used only once for files. For addresses, host names and address blocks it can be used with any multiplicity, even with mixes of them.

LOG MESSAGE AUTHENTICATION

Syslog and syslog-ng typically insert a PID of the generating process in every log line. This can be checked for authenticating the source of the message and avoid false attacks to be detected because malicious local users inject crafted log lines. This way sshguard can be safely used even on hosts where this assumption does not hold.

Log message authentication is only needed when sshguard is fed log messages from syslog or from syslog-ng. When a process logs directly to a raw file and sshguard is configured for polling logs directly from it, you only need to adjust the log file permissions so that only root can write on it.

For enabling log message authentication on a given service the -f option is used as follows:

-f 100:/var/run/sshd.pid

which associates the given pidfile to the ssh service (code 100). A list of well-known service codes is available athttp://www.sshguard.net/docs/reference/service-codes/.

The -f option can be used multiple times for associating different services with their pidfile:

sshguard -f 100:/var/run/sshd.pid -f 123:/var/run/mydaemon.pid

Services that are not configured for log message authentication follow a default-allow policy (all of their log messages are accepted by default).

PIDs are checked with the following policy:

1. the logging service is searched in the list of services configured for authentication. If not found, the entry is accepted.
2. the logged PID is compared with the pidfile. If it matches, the entry is accepted
3. the PID is checked for being a direct child of the authoritative process. If it is, the entry is accepted.
4. the entry is ignored.

Low I/O load is committed to the operating system because of an internal caching mechanism. Changes in the pidfile value are handled transparently.

TOUCHINESS & BLACKLISTING

In many cases, attacks against services are performed in bulk in an automated form. For example, the attacker goes trough a dictionary of 150 username/password pairs and sequentially tries to violate the SSH service with any of them, continuing blindly while blocked, and re-appearing once the block expires.

To counteract these cases, sshguard by default behaves with touchiness. Besides observing abuses from the log activity, it monitors also the overall behavior of attackers. The decision on when and how to block is thus made respective to the entire history of the attacker as well. For example, if address A attacks repeatedly and the base blocking time is 420 seconds, A will be blocked for 420 seconds (7 mins) at the first abuse, 2*420 (14 mins) the second, 2*2*420 (28 mins) the third ... and 2^(n-1)*420 the n-th time.

Touchiness has two major benefits: to legitimate users, it grants forgiving blockings on failed logins; to real attackers, it effectively renders large scale attacks infeasible, because the time to perform it explodes with the number of attempts.

Touchiness can be augmented with blacklisting (-b). With this option, after a number of abuses, the address is added to a list of attackers to be blocked permanently. The list is intended to be loaded at each startup, and maintained/extended with new entries during operation. sshguard inserts a new address after it exceeded a threshold of abuses. This threshold is configurable within the -b option argument. Blacklisted addresses are never scheduled for releasing.

The -b command line option enables blacklisting and requires the filename to use for permanent storage of the blacklist. Optionally, a custom blacklist threshold can be prefixed to this path, separated by ':'. For example,

-b 5:/var/db/sshguard/blacklist.db

requires to blacklist addresses after the 5th abuse, and store the blacklist in file /var/db/sshguard/blacklist.db. Although the blacklist file is not meant to be in human-readable format, the strings(1) command can be used to peek in it for listing the blacklisted addresses.

EXTENSIONS

sshguard operates firewalls through a general interface, which enables easy extension, and allows back-ends to be non-local (e.g. remote appliances), and non-blocking (e.g. report tools). Additions can be suggested athttp://www.sshguard.net/feedback/firewall/submit/.

Extending attack signatures needs some expertise with context-free parsers; users are welcome to submit samples of the desired log messages to http://www.sshguard.net/support/attacks/submit/.

SEE ALSO

syslog(1), syslog.conf(5)

sshguard website at: http://www.sshguard.net/

File Transfer Protocol (FTP)

The File Transfer Protocol (FTP) provides users with a simple way to transfer files to and from an FTP server. FreeBSD includes FTP server software, ftpd, in the base system.

FreeBSD provides several configuration files for controlling access to the FTP server. This section summarizes these files. Refer to ftpd(8) for more details about the built-in FTP server.

Configuration

The most important configuration step is deciding which accounts will be allowed access to the FTP server. A FreeBSD system has a number of system accounts which should not be allowed FTP access. The list of users disallowed any FTP access can be found in /etc/ftpusers. By default, it includes system accounts. Additional users that should not be allowed access to FTP can be added.

In some cases it may be desirable to restrict the access of some users without preventing them completely from using FTP. This can be accomplished be creating /etc/ftpchroot as described in ftpchroot(5). This file lists users and groups subject to FTP access restrictions.

To enable anonymous FTP access to the server, create a user named ftp on the FreeBSD system. Users will then be able to log on to the FTPserver with a username of ftp or anonymous. When prompted for the password, any input will be accepted, but by convention, an email address should be used as the password. The FTP server will call chroot(2) when an anonymous user logs in, to restrict access to only the home directory of the ftpuser.

There are two text files that can be created to specify welcome messages to be displayed to FTP clients. The contents of /etc/ftpwelcome will be displayed to users before they reach the login prompt. After a successful login, the contents of /etc/ftpmotd will be displayed. Note that the path to this file is relative to the login environment, so the contents of ~ftp/etc/ftpmotd would be displayed for anonymous users.

Once the FTP server has been configured, set the appropriate variable in /etc/rc.conf to start the service during boot:

ftpd_enable="YES"

To start the service now:

# service ftpd start

Test the connection to the FTP server by typing:

% ftp localhost

The ftpd daemon uses syslog(3) to log messages. By default, the system log daemon will write messages related to FTP in /var/log/xferlog. The location of the FTP log can be modified by changing the following line in /etc/syslog.conf:

ftp.info      /var/log/xferlog

Note: 

Be aware of the potential problems involved with running an anonymous FTP server. In particular, think twice about allowing anonymous users to upload files. It may turn out that the FTP site becomes a forum for the trade of unlicensed commercial software or worse. If anonymous FTP uploads are required, then verify the permissions so that these files can not be read by other anonymous users until they have been reviewed by an administrator.

https://www.freebsd.org/doc/handbook/network-ftp.html

Create user ftp only freebsd

FTP masih sering digunakan sebagai protokol untuk sharing file antar satu host ke host dengan menggunakan jaringan berbasis TCP semisal internet.

Berikut tutorial cara membuat account ftp pada server FreeBSD 9

1. Pertama kita aktifkan terlebih dahulu server ftp yang ada, pd kesempatan kali ini penulis gunakan ftpd
   • edit file /etc/inetd.conf hilangkan tanda pagar untuk ftpd :
   #vi /etc/inetd.conf
   ftp     stream  tcp     nowait  root    /usr/libexec/ftpd       ftpd -l
   ftp     stream  tcp6    nowait  root    /usr/libexec/ftpd       ftpd -l
   • tambahkan inetd_enable=”YES” dan ftpd_enable=”YES” pada /etc/rc.conf supaya bisa diload setiap kali booting
   • Jalankan inetd dengan perintah
   #/etc/rc.d/inetd start
   • Jalankan server ftpd dengan perintah
   #service ftpd start
2. 2. Membuat script untuk membatasi user account supaya tidak bisa login ke shell (via ssh)
   #vi /usr/sbin/ftponly
   #!/bin/sh -p
   echo ‘Account ini hanya untuk akses ftp saja.’
   exit 1
3. membuat user ftp dengan perintah adduser

# adduser
Username: bagus
Full name: Bagus Setiawan
Uid (Leave empty for default):
Login group [bagus]:
Login group is bagus. Invite bagus into other groups? []:
Login class [default]:
Shell (sh csh tcsh ftponly nologin) [sh]: ftponly
Home directory [/home/bagus]:
Home directory permissions (Leave empty for default):
Use password-based authentication? [yes]:
Use an empty password? (yes/no) [no]:
Use a random password? (yes/no) [no]:
Enter password:
Enter password again:
Lock out the account after creation? [no]:
Username   : bagus
Password   : *****
Full Name  : Bagus Setiawan
Uid        : 1005
Class      :
Groups     : bagus
Home       : /home/bagus
Home Mode  :
Shell      : /usr/sbin/ftponly
Locked     : no
OK? (yes/no): yes

Sumber : http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-ftp.html

screen: Keep Your Processes Running Despite A Dropped Connection

I guess you all know this: you are connected to your server with SSH and in the middle of compiling some software or doing some other task which takes lots of time, and suddenly your connection drops for some reason, and you lose your work. This can be very annoying, but fortunately there is a small utility called screen which lets you reattach to a previous session so that you can finish your task. This short tutorial shows how to use screen for just this purpose.

Using screen

With screen you can create one or more sessions in your current SSH terminal. Just run screen

Code:

beacon% screen

to start it. This creates a screen session or window (although you don't see it as such) in your current SSH terminal:

Press Space or Return to get to the command prompt:

Looks like your normal SSH terminal, doesn't it?
Now I'm going to describe the most important screen commands that you need to control screen. These commands begin with CTRL a to distinguish them from normal shell commands.
• Ctrl a c - Creates a new screen session so that you can use more than one screen session at once.
• Ctrl a w - See how many screen windows do you have.
• Ctrl a a - Switches to the previous screen window(if you use more than one).
• Ctrl a n - Switches to the window number n+1 (next on the list). Where n is number of the current window. 
• Ctrl a p - Switches to the window number n-1 (previous on the list). Where n is number of the current window.
• Ctrl a d - Detaches a screen session (without killing the processes in it - they continue).
• Ctrl a A - Give your window a unique name.

To close a screen session where all tasks are finished you can type:

Code:

beacon% exit

Now let's play around with it a little bit. In our screen window we run the command

Code:

beacon% top

Now let's create another screen session by typing

Code:

Ctrl a c

A new, blank screen session opens, and there we run ping command for e.g.

Code:

beacon% ping google.com

Now you can browse your two screen sessions by running
Ctrl a n, Ctrl a p , or the simplest way to switch between two recent used screen windows - Ctrl a a.
To see at which window you currently are issue Ctl a w command. The screen will output all the opened shell names in the bottom of the window. The current shell will be marked with asterisk(*).

Going further, let us give names to our windows. Type Ctl a A over the window you would like to rename. The screen will issue prompt "Set window's title to" in the bottom. Set the name you like. For example you can give name "ping" to the appropriate window.

Press Enter. The window is now given a unique name. Type Ctl a w to check that out.

To detach a screen session and return to your normal SSH terminal, type

Code:

Ctrl a d

Back on your normal SSH terminal, you can run

Code:

beacon% screen -ls

to get a list of your current screen sessions:

There is currently 1 screen session:

Code:

23746.pts-40.beacon     (Detached)

In case there is only one screen session you may reattach to it by issuing:

Code:

beacon% screen -r

Suppose, you want to bring up another screen session. All you have to do is to run again "screen" command on the normal ssh prompt.

Code:

beacon% screen

Now, if you detach all screen session and issue "screen -ls" again you will see there are 2 sessions now:

Code:

23746.pts-40.beacon     (Detached)
22140.pts-118.beacon    (Detached)

To reconnect to one of these sessions, run

Code:

beacon% screen -r 22140.pts-118.beacon

where 22140.pts-118.beacon is the name of one of the sessions from the screen -ls output.

My Connection Dropped - What Can I Do?

Now let's assume you edit source code in a screen session, something which normally takes a long time, and suddenly your connection drops. Thanks to screen your work isn't lost. Once your connection is back up, log in to your system with SSH again and run

Code:

beacon% screen -ls

as shown in earlier. From the results pick one session (e.g. 22140.pts-118.beacon) and reattach to it:

Code:

beacon% screen -r 22140.pts-118.beacon

If you picked the right session, you should find your code opened in the editor so that you can continue your work.


https://forums.freebsd.org/threads/screen-keep-your-processes-running-despite-a-dropped-connection.3599/

SSH Tunnel in 30 Seconds (Mac OSX & Linux)

Launch an SSH tunnel

To initiate your SSH tunnel, simply [open Mac OSX / Linux Terminal][1] and connect to your remote server via SSH with the following flags:

ssh -D 8080 -C -N username@example.com

This will launch our SSH tunnel on port 8080 and route all traffic (securely) through the server at example.com.

Browse the Web with Your SSH Tunnel (Chrome)

Now, let’s start browsing the web using our new SSH tunnel.

Mac OSX:

1. Open Google Chrome
2. Select ‘Chrome’ up the top left
3. Select ‘Preferences’
4. Select ‘Show advanced settings…’
5. Select ‘Change proxy settings…’
6. Select ‘SOCKS Proxy’
7. Enter ’127.0.0.1′
8. Enter port ’8080′
9. Save changes by selecting ‘OK’

Fedora Linux:

1. Open Google Chrome
2. Select the wrench icon on the top right
3. Select ‘Settings’
4. Select ‘Show advanced settings…’
5. Select ‘Change proxy settings…’
6. Select ‘SOCKS Proxy’
7. Enter ’127.0.0.1′
8. Enter port ’8080′
9. Save changes by selecting ‘OK’

Search Google for ‘my ip’ and take a look at what your IP address is now. Cool right? 

Exiting the SSH Tunnel

To exit the SSH tunnel, simply disable the SOCKS proxy within your browser.

Hope this helps, let me know if you have any suggestions in the comments below!