Arch Linux

Running into the same issue.

Some sample config files can be found if you download the package source and look into the `examples` folder.

So I managed to get a working configuration that's equivalent to the old one of Sshguard 1.7

Sshguard 2.0 can now read journalctl on its own using the LOGREADER directive from the config.
The wrapper script found at `/usr/lib/systemd/scripts/sshguard-journalctl` is no longer needed since LOGREADER now does exactly that.

The BACKEND directive is also a must: BACKEND="/usr/libexec/sshg-fw-iptables"

And a new .service file is needed which will start sshguard without any other parameters.
The old blacklist.db is fine and is provided via: BLACKLIST_FILE=120:/var/db/sshguard/blacklist.db

Is it the case that sshguard now requires a config file? Didn't need one in the past.

The config file is mandatory from version 2.0.

Thanks. The config file clearly doesn't belong in /usr/etc, maybe /etc/sshguard/sshguard.conf or just /etc/sshguard.conf
Hopefully this will be fixed soon and we will have a working package as I rely on it for an added layer of protection.

please try sshguard-2.0.0-2

> please try sshguard-2.0.0-2

The `/usr/lib/systemd/scripts/sshguard-journalctl` script should be removed since it't not part of the original distribution anyway, and replaced with the LOGREADER directive in the config file:

BACKEND="/usr/libexec/sshg-fw-iptables"
LOGREADER="LANG=C /usr/bin/journalctl -afb -p info -n1 -t sshd -o cat"
BLACKLIST_FILE=120:/var/db/sshguard/blacklist.db

uploaded sshguard-2.0.0-3

That works well, though it would be preferable to have the comments as well https://gist.github.com/wooptoo/bdd5840ad7adfa0996a847ff14eeef31

I have this error after installing 20.0.3 with modified sshguard.service as suggested above:
Process: 653 ExecStartPre=/usr/sbin/iptables -N sshguard (code=exited, status=1/FAILURE)

> ExecStartPre=/usr/sbin/iptables -N sshguard (code=exited, status=1/FAILURE)

it is ok, it means chain already exists and should be ignored.

After start sshguard.service: Failed at step EXEC spawning /usr/lib/systemd/scripts/sshguard-journalctl: No such file or directory

in /etc/sshguard.conf LOGREADER="LANG=C /usr/bin/journalctl -afb -p info -n1 -t sshd -o cat"

Does sshguard read this config?

Maybe you still have an old sshguard.service around?

Ludovic, you're right. systemctl revert helped, thanks!

I think this issue can now be closed.
Thank you all.