Community Packages

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#34007 - [sshguard] 1.5-9 does not filter IPv6 addresses

Attached to Project: Community Packages
Opened by Vivenzio Pagliari (ViPa) - Sunday, 24 February 2013, 22:25 GMT
Last edited by Sergej Pupykin (sergej) - Monday, 25 February 2013, 11:39 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Sergej Pupykin (sergej)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description: Setup of sshguard with systemctl does not take care of IPv6 which results in IPv6 addresses not being blocked. Actually, sshguard does support IPv6 (with iptables), however setup is not done well to activate it.

Additional info:
Following steps are needed to fix handing of IPv6 addresses:
1. Setup of ip6tables needs to be done. I already added a sentence on this on the archlinux sshguard wikipage. Additionally, the message of post_install() function of sshguard.install script could be extended to mention this.
2. The systemctl should take care to also setup the IPv6 firewall. For this, sshguard.service should be extended
to be started after ip6tables.service and also to want this service.

A patch with proposed changes is attached.

Steps to reproduce:
With latest /etc/hosts, local host uses an IPv6 address (::1), so simply login from localhost incorrectly to trigger this malfunction.

After such a test, my log said:

Feb 24 22:07:13 XX sshguard[517]: Blocking ::1:6 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Feb 24 22:07:13 XX sshguard-journalctl[515]: ip6tables: No chain/target/match by that name.
Feb 24 22:07:13 XX sshguard[517]: Blocking command failed. Exited: -1

Also subsequent attempt to re-allow ::1 failed:

Feb 24 22:17:53 XX sshguard-journalctl[515]: ip6tables: Bad rule (does a matching rule exist in that chain?).
Feb 24 22:17:53 XX sshguard[517]: Release command failed. Exited: -1
This task depends upon

Closed by  Sergej Pupykin (sergej)
Monday, 25 February 2013, 11:39 GMT
Reason for closing:  Fixed
Additional comments about closing:  in svn only yet

Loading...