Skip to content

Commit 80e6438

Browse files
shaohmeshaohme
committed
initial commit
0 parents  commit 80e6438

File tree

7 files changed

+418
-0
lines changed

7 files changed

+418
-0
lines changed

‎.gitignore

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
# Created by https://www.toptal.com/developers/gitignore/api/c,linux,emacs
2+
# Edit at https://www.toptal.com/developers/gitignore?templates=c,linux,emacs
3+
4+
### C ###
5+
# Prerequisites
6+
*.d
7+
8+
# Object files
9+
*.o
10+
*.ko
11+
*.obj
12+
*.elf
13+
14+
# Linker output
15+
*.ilk
16+
*.map
17+
*.exp
18+
19+
# Precompiled Headers
20+
*.gch
21+
*.pch
22+
23+
# Libraries
24+
*.lib
25+
*.a
26+
*.la
27+
*.lo
28+
29+
# Shared objects (inc. Windows DLLs)
30+
*.dll
31+
*.so
32+
*.so.*
33+
*.dylib
34+
35+
# Executables
36+
*.exe
37+
*.out
38+
*.app
39+
*.i*86
40+
*.x86_64
41+
*.hex
42+
43+
# Debug files
44+
*.dSYM/
45+
*.su
46+
*.idb
47+
*.pdb
48+
49+
# Kernel Module Compile Results
50+
*.mod*
51+
*.cmd
52+
.tmp_versions/
53+
modules.order
54+
Module.symvers
55+
Mkfile.old
56+
dkms.conf
57+
58+
### Emacs ###
59+
# -*- mode: gitignore; -*-
60+
*~
61+
\#*\#
62+
/.emacs.desktop
63+
/.emacs.desktop.lock
64+
*.elc
65+
auto-save-list
66+
tramp
67+
.\#*
68+
69+
# Org-mode
70+
.org-id-locations
71+
*_archive
72+
73+
# flymake-mode
74+
*_flymake.*
75+
76+
# eshell files
77+
/eshell/history
78+
/eshell/lastdir
79+
80+
# elpa packages
81+
/elpa/
82+
83+
# reftex files
84+
*.rel
85+
86+
# AUCTeX auto folder
87+
/auto/
88+
89+
# cask packages
90+
.cask/
91+
dist/
92+
93+
# Flycheck
94+
flycheck_*.el
95+
96+
# server auth directory
97+
/server/
98+
99+
# projectiles files
100+
.projectile
101+
102+
# directory configuration
103+
.dir-locals.el
104+
105+
# network security
106+
/network-security.data
107+
108+
109+
### Linux ###
110+
111+
# temporary files which can be created if a process still has a handle open of a deleted file
112+
.fuse_hidden*
113+
114+
# KDE directory preferences
115+
.directory
116+
117+
# Linux trash folder which might appear on any partition or disk
118+
.Trash-*
119+
120+
# .nfs files are created when an open file is removed but is still being accessed
121+
.nfs*
122+
123+
# End of https://www.toptal.com/developers/gitignore/api/c,linux,emacs
124+
125+
build/
126+
.cache/
127+
.markdown-preview.html
128+
compile_commands.json

‎LICENSE

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Copyright (c) 2022 Martin Kjær Jørgensen <[email protected]>
2+
3+
Permission to use, copy, modify, and distribute this software for any
4+
purpose with or without fee is hereby granted, provided that the above
5+
copyright notice and this permission notice appear in all copies.
6+
7+
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8+
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9+
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
10+
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11+
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12+
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13+
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

‎Makefile

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
LOCALBASE?= /usr/local/
2+
3+
PROG= filter-sshglogger
4+
MAN= filter-sshglogger.8
5+
BINDIR= ${LOCALBASE}/libexec/smtpd/
6+
MANDIR= ${LOCALBASE}/man/man
7+
8+
SRCS+= main.c
9+
10+
CFLAGS+=-I${LOCALBASE}/include
11+
CFLAGS+=-Wall -I${.CURDIR}
12+
CFLAGS+=-Wstrict-prototypes -Wmissing-prototypes
13+
CFLAGS+=-Wmissing-declarations
14+
CFLAGS+=-Wshadow -Wpointer-arith -Wcast-qual
15+
CFLAGS+=-Wsign-compare
16+
LDFLAGS+=-L${LOCALBASE}/lib
17+
LDADD+= -levent -lopensmtpd
18+
DPADD= ${LIBEVENT}
19+
20+
bindir:
21+
${INSTALL} -d ${DESTDIR}${BINDIR}
22+
23+
.include <bsd.prog.mk>

‎Makefile.gnu

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
LOCALBASE?= /usr/
2+
3+
PROG= filter-sshglogger
4+
MAN= filter-sshglogger.8
5+
BINDIR= ${LOCALBASE}/libexec/opensmtpd/
6+
MANDIR= ${LOCALBASE}/share/man/man8
7+
8+
SRCS+= main.c
9+
10+
CFLAGS+= -I${LOCALBASE}/include
11+
CFLAGS+= -DPROG=${PROG}
12+
CFLAGS+= -Wall -I${.CURDIR}
13+
CFLAGS+= -Wstrict-prototypes -Wmissing-prototypes
14+
CFLAGS+= -Wmissing-declarations
15+
CFLAGS+= -Wshadow -Wpointer-arith -Wcast-qual
16+
CFLAGS+= -Wsign-compare
17+
CFLAGS+= ${CRYPT_CFLAGS}
18+
CFLAGS+= -I${CURDIR}
19+
20+
LDFLAGS+= -L${LOCALBASE}/lib
21+
LDFLAGS+= ${CRYPT_LDFLAGS}
22+
LDADD+= ${CRYPT_LDADD} -lopensmtpd
23+
24+
INSTALL?= install
25+
26+
MANFORMAT?= mangz
27+
28+
BINOWN?= root
29+
BINGRP?= root
30+
BINPERM?= 755
31+
MANOWN?= root
32+
MANGRP?= root
33+
MANPERM?= 644
34+
35+
ifeq (${MANFORMAT}, mangz)
36+
TARGET_MAN= ${MAN}.gz
37+
CLEANFILES+= ${TARGET_MAN}
38+
${TARGET_MAN}: ${MAN}
39+
mandoc -Tman ${MAN} | gzip > $@
40+
else
41+
TARGET_MAN= ${MAN}
42+
endif
43+
44+
${SRCS:.c=.d}:%.d:%.c
45+
${CC} ${CFLAGS} -MM $< >$@
46+
CLEANFILES+= ${SRCS:.c=.d}
47+
48+
OBJS= ${notdir ${SRCS:.c=.o}}
49+
CLEANFILES+= ${OBJS}
50+
51+
${PROG}: ${OBJS}
52+
${CC} ${LDFLAGS} -o $@ ${OBJS} ${LDADD}
53+
54+
.DEFAULT_GOAL= all
55+
.PHONY: all
56+
all: ${PROG} ${TARGET_MAN}
57+
CLEANFILES+= ${PROG}
58+
59+
.PHONY: clean
60+
clean:
61+
rm -f ${CLEANFILES}
62+
63+
.PHONY: install
64+
install: ${PROG}
65+
${INSTALL} -D -o ${BINOWN} -g ${BINGRP} -m ${BINPERM} ${PROG} ${DESTDIR}${BINDIR}/${PROG}
66+
${INSTALL} -D -o ${MANOWN} -g ${MANGRP} -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}

‎README.md

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# filter-sshglogger
2+
3+
One day I noticed something brute forcing authentication attempts on
4+
my `opensmtpd` server which already runs `sshguard` protecting sshd, so
5+
I wondered if I could protect `opensmtpd` the same way ...
6+
7+
## Description
8+
This filter listens on `opensmtpd` authentication attempts and checks
9+
if they fail because of incorrect username or password combination. If
10+
so, it logs the attempt to `syslog` in a format `sshguard` parses
11+
correctly, and let it and `pf` decide what to do.
12+
13+
## Dependencies
14+
It requires OpenSMTPD 6.6.0 or higher and needs an extended version of
15+
`libopensmtpd` not yet merged. See changes here
16+
[libopensmtpd](<https://github.com/shaohme/libopensmtpd>)
17+
18+
## How to install
19+
Install the modified `libopensmtpd` library metioned in dependencies by
20+
cloning it at running:
21+
22+
```
23+
$ doas make install
24+
```
25+
26+
This should install or overwrite existing `libopensmtpd` library with a
27+
modified version allowing filters to subscribe to authentication
28+
events.
29+
30+
Afterwards close this repository and run the usual install command:
31+
32+
```
33+
$ doas make install
34+
```
35+
36+
The filter should now be installed in default `opensmtpd` filters
37+
directory `/usr/local/libexec/smtpd`
38+
39+
## How to configure
40+
The filter itself requires no configuration.
41+
42+
It must be declared in smtpd.conf and attached to a listener for sessions to go through filter-sshglogger:
43+
```
44+
# smtpd.conf
45+
...
46+
filter sshguard proc-exec "filter-sshglogger"
47+
48+
...
49+
listen on all port smtp tls pki "default" filter { "rdns", "sshguard" }
50+
```
51+
52+
`filter-sshglogger` will open a syslog interface and log failed
53+
authentication attempts using its own application name. This should
54+
probably be written to its own logfile, like so:
55+
56+
```
57+
# /etc/syslog.conf
58+
...
59+
!!filter-sshglogger
60+
*.* /var/log/smtpd-sshg
61+
```
62+
63+
`sshguard` should be configured to pickup these events and act
64+
accordingly, like so:
65+
66+
```
67+
# /etc/sshguard.conf
68+
69+
BACKEND="/usr/local/libexec/sshg-fw-pf"
70+
...
71+
FILES="/var/log/authlog /var/log/maillog /var/log/smtpd-sshg"
72+
```
73+
74+
`syslog` omits repeated entries in logs. `sshguard` might need these
75+
repeated entires to form a judgement. To make `syslog` stop omitting
76+
these entries, simply add:
77+
78+
```
79+
# /etc/rc.conf.local
80+
...
81+
syslogd_flags=-rr
82+
```
83+
84+
From now on `sshguard` should recognize failed authentication attempts
85+
and block the peer temporarily using the same rules as with SSH, etc.

‎filter-sshglogger.8

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
.\" $OpenBSD$
2+
.\"
3+
.\" Copyright (c) 2022 Martin Kjær Jørgensen <[email protected]>
4+
.\"
5+
.\" Permission to use, copy, modify, and distribute this software for any
6+
.\" purpose with or without fee is hereby granted, provided that the above
7+
.\" copyright notice and this permission notice appear in all copies.
8+
.\"
9+
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10+
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11+
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12+
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13+
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14+
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15+
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16+
.\"
17+
.Dd $Mdocdate$
18+
.Dt FILTER-SSHGLOGGER 8
19+
.Os
20+
.Sh NAME
21+
.Nm filter-sshglogger
22+
.Nd writes failed auth attempts to syslog
23+
.Sh DESCRIPTION
24+
.Nm
25+
Checks if authentication attempt was failed. If so, write the incident
26+
to syslog in a format sshguard can parse and act accordingly to its
27+
configuration.
28+
.Sh SEE ALSO
29+
.Xr smtpd 8
30+
.Xr sshguard 8

0 commit comments

Comments
 (0)