Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
FS#34007 - [sshguard] 1.5-9 does not filter IPv6 addresses
Attached to Project:
Community Packages
Opened by Vivenzio Pagliari (ViPa) - Sunday, 24 February 2013, 22:25 GMT
Last edited by Sergej Pupykin (sergej) - Monday, 25 February 2013, 11:39 GMT
Opened by Vivenzio Pagliari (ViPa) - Sunday, 24 February 2013, 22:25 GMT
Last edited by Sergej Pupykin (sergej) - Monday, 25 February 2013, 11:39 GMT
|
DetailsDescription: Setup of sshguard with systemctl does not take care of IPv6 which results in IPv6 addresses not being blocked. Actually, sshguard does support IPv6 (with iptables), however setup is not done well to activate it.
Additional info: Following steps are needed to fix handing of IPv6 addresses: 1. Setup of ip6tables needs to be done. I already added a sentence on this on the archlinux sshguard wikipage. Additionally, the message of post_install() function of sshguard.install script could be extended to mention this. 2. The systemctl should take care to also setup the IPv6 firewall. For this, sshguard.service should be extended to be started after ip6tables.service and also to want this service. A patch with proposed changes is attached. Steps to reproduce: With latest /etc/hosts, local host uses an IPv6 address (::1), so simply login from localhost incorrectly to trigger this malfunction. After such a test, my log said: Feb 24 22:07:13 XX sshguard[517]: Blocking ::1:6 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s). Feb 24 22:07:13 XX sshguard-journalctl[515]: ip6tables: No chain/target/match by that name. Feb 24 22:07:13 XX sshguard[517]: Blocking command failed. Exited: -1 Also subsequent attempt to re-allow ::1 failed: Feb 24 22:17:53 XX sshguard-journalctl[515]: ip6tables: Bad rule (does a matching rule exist in that chain?). Feb 24 22:17:53 XX sshguard[517]: Release command failed. Exited: -1 |
This task depends upon
Closed by Sergej Pupykin (sergej)
Monday, 25 February 2013, 11:39 GMT
Reason for closing: Fixed
Additional comments about closing: in svn only yet
Monday, 25 February 2013, 11:39 GMT
Reason for closing: Fixed
Additional comments about closing: in svn only yet
sshguard-ipv6.patch