118 lines
4.4 KiB
Bash
118 lines
4.4 KiB
Bash
#!/bin/sh
|
|
#-
|
|
# Copyright (c) 2012 iXsystems, Inc.
|
|
# All rights reserved.
|
|
#
|
|
# Written by: Xin Li <delphij@FreeBSD.org>
|
|
#
|
|
# Redistribution and use in source and binary forms, with or without
|
|
# modification, are permitted provided that the following conditions
|
|
# are met:
|
|
# 1. Redistributions of source code must retain the above copyright
|
|
# notice, this list of conditions and the following disclaimer.
|
|
# 2. Redistributions in binary form must reproduce the above copyright
|
|
# notice, this list of conditions and the following disclaimer in the
|
|
# documentation and/or other materials provided with the distribution.
|
|
#
|
|
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
# SUCH DAMAGE.
|
|
#
|
|
# $FreeBSD$
|
|
#
|
|
|
|
# PROVIDE: sshguard
|
|
# REQUIRE: LOGIN cleanvar
|
|
# KEYWORD: shutdown
|
|
|
|
#
|
|
# Add the following lines to /etc/rc.conf to enable sshguard:
|
|
# sshguard_enable (bool): Set to "NO" by default.
|
|
# Set it to "YES" to enable sshguard
|
|
# sshguard_pidfile (str): Path to PID file.
|
|
# Set to "/var/run/sshguard.pid" by default
|
|
# sshguard_watch_logs (str): Colon-splitted list of logs to watch.
|
|
# Unset by default. Overrides the configuration file.
|
|
# The following options directly map to their command line options,
|
|
# and override the configuration file, so most are unset by default.
|
|
# Please read the sshguard(8) manual page for detailed information:
|
|
# sshguard_blacklist (str): [threshold:]/path/to/blacklist.
|
|
# Set to "30:/var/db/sshguard/blacklist.db"
|
|
# by default.
|
|
# sshguard_danger_thresh (int): Danger threshold.
|
|
# sshguard_release_interval (int):
|
|
# Minimum interval (in sec) an address remains
|
|
# blocked.
|
|
# sshguard_reset_interval (int):
|
|
# Interval before a suspected attack is
|
|
# forgotten and danger is reset to 0.
|
|
# sshguard_whitelistfile (str): Path to the whitelist.
|
|
# sshguard_flags (str): Set additional command line arguments.
|
|
#
|
|
|
|
. /etc/rc.subr
|
|
|
|
name=sshguard
|
|
rcvar=sshguard_enable
|
|
|
|
set_rcvar sshguard_blacklist "120:/var/db/sshguard/blacklist.db" "Blacklisting threshold and path to blacklist file (colon-separated)"
|
|
set_rcvar sshguard_danger_thresh "" "Attack threshold"
|
|
set_rcvar sshguard_pidfile "/var/run/sshguard.pid" "Path to PID file"
|
|
set_rcvar sshguard_release_interval "" "Time before releasing first-time attackers (s)"
|
|
set_rcvar sshguard_reset_interval "" "Time before forgetting attackers (s)"
|
|
set_rcvar sshguard_watch_logs "" "Log files to monitor, overriding sshguard.conf (space-separated)"
|
|
set_rcvar sshguard_whitelistfile "" "Path to whitelist"
|
|
|
|
load_rc_config sshguard
|
|
|
|
pidfile=${sshguard_pidfile}
|
|
|
|
command=/usr/sbin/daemon
|
|
actual_command="%%PREFIX%%/sbin/sshguard"
|
|
procname="/bin/sh"
|
|
start_precmd=sshguard_prestart
|
|
command_args="-c -f ${actual_command} \${sshguard_flags} \${sshguard_blacklist_params} \${sshguard_watch_params} \${sshguard_danger_params} \${sshguard_release_params} \${sshguard_reset_params} \${sshguard_whitelist_params} -i ${pidfile}"
|
|
|
|
sshguard_prestart()
|
|
{
|
|
# Clear rc_flags so sshguard_flags can be passed to sshguard
|
|
# instead of daemon(8)
|
|
rc_flags=""
|
|
|
|
if [ ! -z ${sshguard_blacklist} ]; then
|
|
mkdir -p $(dirname ${sshguard_blacklist##*:})
|
|
sshguard_blacklist_params="-b ${sshguard_blacklist}"
|
|
fi
|
|
|
|
if [ ! -z ${sshguard_whitelistfile} ]; then
|
|
[ -e "${sshguard_whitelistfile}" ] || touch ${sshguard_whitelistfile}
|
|
sshguard_whitelist_params="-w ${sshguard_whitelistfile}"
|
|
fi
|
|
|
|
if [ ! -z ${sshguard_danger_thresh} ]; then
|
|
sshguard_danger_params="-a ${sshguard_danger_thresh}"
|
|
fi
|
|
|
|
if [ ! -z ${sshguard_release_interval} ]; then
|
|
sshguard_release_params="-p ${sshguard_release_interval}"
|
|
fi
|
|
|
|
if [ ! -z ${sshguard_reset_interval} ]; then
|
|
sshguard_reset_params="-s ${sshguard_reset_interval}"
|
|
fi
|
|
|
|
if [ ! -z "${sshguard_watch_logs}" ]; then
|
|
sshguard_watch_params=$(echo ${sshguard_watch_logs} | tr : \\\n | sed -e s/^/-l\ /g | tr \\\n \ )
|
|
fi
|
|
}
|
|
|
|
run_rc_command "$1"
|