SSHGuard protects hosts from brute-force attacks against SSH and other
services. It aggregates system logs and blocks repeat offenders using one of
several firewall backends.
Reason:
Blacklisting is now disabled by default to avoid overriding the setting in
sshguard.conf. To enable blacklisting, uncomment the BLACKLIST_FILE line in
sshguard.conf.
security/sshguard: Backport upstream patch
To fix HOSTNAME field in syslog header handling.
PR: 298836
Approved by: Kevin Zheng <kevinz5000@gmail.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q3
security/sshguard: Add default "NO" to rcvar
Without a default rcvar set to NO, there are warnings like this:
/etc/rc: WARNING: $sshguard_enable is not set properly - see rc.conf(5)?
PR: 298781
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q3
security/sshguard: Update to 2.5.1
- Fix a denial of service issue in the quoted string parser
- Fix build on systems without setresgid() or setresuid()
PR: 286460
MFH: 2025Q2
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/sshguard: disable blacklisting by default
Blacklisting is now disabled by default to avoid overriding the setting in
sshguard.conf. To enable blacklisting, uncomment the BLACKLIST_FILE line in
sshguard.conf.
PR: 221602
Reported by: bahlgren@beah.se
Submitted by: kevinz5000@gmail.com
security/sshguard: Fix memset() off-by-one
This bug causes a stack overflow (and crash due to failed stack check)
when certain IPv6 addresses are whitelisted on i386.
PR: 258179
Reported by: John Marshall <john@jmarshall.id.au>
MFH: 2021Q4
security/sshguard: Upgrade to 2.4.2
Major changes:
* Recognize rejections from Postfix's postscreen daemon
* The parser can now be changed using the PARSER and POST_PARSER options
* Remove some false positive attack signatures for SSH and Cyrus
* Adjust log verbosity of some log messages
* The firewalld backend now uses firewall-cmd instead of iptables to flush
block lists
Full changelog :
https://bitbucket.org/sshguard/sshguard/src/v2.4.2/CHANGELOG.rst
PR: 256575
Reported by: <sirdice@gmail.com>
Approved by: Kevin Zheng <kevinz5000@gmail.com> (maintainer)
Remove redundant pidfile check.
This fixes an issue that SSHguard won't start after an incompelete
shutdown.
PR: ports/241751
Approved by: portmgr (bugfix blanket)
MFH: 2019Q4
sshguard: Fix rc(8) script, broken in update and then broken further in followup
commits
Also clean up some comments while here.
PR: 238458
Submitted by: Kevin Zheng
sshguard: Update to 2.4.0 and fix rc(8) script
There is some strange new behaviour on the rc script in 2.4.0. It
would either hang on start, or hang on stop. A custom stop function
seemed the easiest way to achieve both.
PR: 238458
Back out r505456. sshguard 2.4.0 misbehaves
SSHGuard has always exited cleanly on FreeBSD. In 2.4.0, sshguard fixed that.
It is impossible to terminate sshguard without manually killing each process.
So, apologies to everyone who's already updated, but you'll have to manually
kill all the processes:
pkill -f sshguard
pkill -f sshg-
pkill -f tail
rm /var/run/sshguard.pid
So, back this out while awaiting upstream fix.
PR: 238458
Update security/sshguard to 2.2.0
While here, break some long lines, Use INSTALL_DATA to install sample config
file since it's not supposed to be changed and re-generate patches using
`make makepatch`
PR: 230861
Approved by: maintainer timeout (> 1 month)
Obtained from: pfSense
Sponsored by: Rubicon Communications, LLC (Netgate)
Increase the default blacklist threshold from 30 to 120, which is the upstream
default. 30 makes it far too easy to get locked out of your own server. 120 is
simply a safer starting point.
PR: 227016
Submitted by: Dan McGregor (maintainer)
MFH: 2018Q2
security/sshguard: Fix rc script, add UPDATING entry
sshguard usually looks at sshguard.conf for a list of files to monitor,
but lets you override it via the command line using -l arguments.
This change fixes an issue with the previous rc script which was
*always* setting the '-l' arguments even if sshguard_watch_logs wasn't
set in rc.conf.
This change also sets the defaults in the config file to match the
former defaults in the rc script, and adds an UPDATING entry to warn
of the change from default configuration via rc.conf the config file.
PR: 220906
Submitted by: Dan McGregor (maintainer)
Reported by: chris@cretaforce.gr
security/sshguard: Unbreak build by making a metaport
security/sshguard no longer provides hosts/TCP Wrappers support by
default as this was removed upstream. It is now a metaport which will
allow you to select a backend. Further details can be found in the
UPDATING entry.
security/sshguard: Update to 1.7.0
Changelog:
Added
Add sshg-logtail
Add sshg-parser
Control firewall using sshg-fw
Match "no matching key exchange method" for SSH
Deprecated
Hosts backend is deprecated
Logsuck (-l option) is deprecated, use sshg-logtail instead
Process validation (-f option) is deprecated
(Only the first 15 lines of the commit message are shown above )
security/sshguard: Update man page, fix sshguard_reset_interval default
Upstream responded to my submitted man page patch and indicated that
sshguard_reset_interval (-s) has been changed to 1800 (30 mins) as well.
security/sshguard: Update to 1.6.4
- Add PID file support back to rc script
- Rename some rc script parameters to better align with sshguard(8)
sshguard_safety_thresh -> sshguard_danger_thresh
sshguard_pardon_min_interval -> sshguard_release_interval
sshguard_prescribe_interval -> sshguard_reset_interval
Release notes:
This release brings updated signatures, usability improvements, and bug
fixes. Highlights in this release include:
- Match Postfix pre-authentication disconnects
(Only the first 15 lines of the commit message are shown above )
security/sshgaurd: Update to 1.6.2
* Remove recommendation of using syslog pipes
* IPFW support has been rewritten and entries now are added to table 22
PR: 203452
Add patch to support syslog in verbose mode
This was previously a patch in the FreeBSD ports tree and was sent
upstream but did not make it into 1.6.0
Submitted by: gregp@n0qds.org
Add ability to pass additional custom arguments to sshguard daemon via
sshguard_flags in rc.conf
Declare LICENSE while here
Submitted by: wjw@digiware.nl
Make it possible to run sshguard without blacklist database by setting
in rc.conf:
sshguard_blacklist=""
This may fix reliability for some users.
PR: 174018
The default pardon and prescribe settings in the rc script were swapped
and did not match the documentation. Users should tune to their needs
instead of relying on the defaults, but if they are this will be an
improvement.
Submitted by: John Vinopal
Adopting security/sshguard
rc script passes rclint
Removed clever built-in sysadmin countermeasure:
Previously sshguard would automatically add a line to your
/etc/syslog.conf file. You could activate sshguard by uncommenting this
line. However, every time you reinstall/update sshguard this line will
also be automatically removed rendering the program inactive and your
system unprotected.
Sponsored by: SupraNet Communications, Inc
Fix rc script, which I made a bit of a mess of. Really sorry :(
Submitted by: se
While here, add error checking in pkg-install before replacing
syslog.conf with an unknown file!
Fix old sshguard bug; does not detect ssh invalid users logins
PR: ports/174571
Submitted by: Francois Charlier <fcharlier@ploup.net>
Reset maintainer after 16 month timeout
While here, stage, remove some insanity and fixup rc script
- Update to 1.3, which also fixes build problem with autoconf
PR: 127599
Submitted by: Jeremy Johnston <jeremy at smart-serv dot net>
Suggested by: Mij <mij at bitchx dot it> (maintainer)
- Update to 1.2. Changes:
- support for Cyrus IMAP
- support for SSH "possible break-in attempt" messages
- updated support for dovecot to include logging format of new versions
- fix of IPF backend causing sshguard not to update /etc/ipf.rules (disallow
IPv6)
- fix detection of password when sshd doesn't log anything more than PAM
- While here, use SF macro
PR: 127456
Submitted by: Mij <mij at bitchx dot it> (maintainer)
- Install man page to ${MANPREFIX}/man . Thanks to pav@ for notification
- Update description reflecting additions of version 1.1
PR: ports/126001
Submitted by: Mij <mij AT bitchx.it> (maintainer)
- add patch for:
The regex used to recognize IPv6 addresses in security/sshguard{,-ipfw,-pf}
doesn't catch all IPv6 addresses. The author (and port maintainer) is aware of
this issue and supplied the patch, which fixes the issue. The patch will be
part of sshguard-1.1, which is due soonish.
- bump PORTREVISION
PR: 113800
Submitted by: Henrik Brix Andersen
Approved by: Mij (maintainer)
- upgrade to version 1.0
- the port is no longer interactive, it uses the default blocking backend
(hosts)
- for pf and ipfw see the new ports sshguard-[pf|ipfw]
PR: ports/112749
Submitted by: Mij (maintainer)
Reviewed by: leeym@
- respect maintainer's insist on interactive part,
even IS_INTERACTIVE is discouraged
- PORTREVISION is thus bumped.
Approved by: maintainer (implicit)
