Actions
Regression #16528
closed
``sshguard`` does not trigger for GUI auth failures due to log format changes
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.03
Release Notes:
Force Exclusion
Affected Version:
2.9.0
Affected Architecture:
Description
The log format on the devel branches of CE and Plus has changed and this has broken sshguard. Plus 25.11 is unaffected as these changes are not present in that branch.
The current log format on dev branches is:
pfsense php-fpm[7534]: EMERGENCY webConfigurator authentication error for user 'blah' from: 172.21.32.69
The expected (previous) log format is:
Nov 11 17:01:01 pfsense php-fpm[7534]: /index.php: webConfigurator authentication error for user 'blah' from: 172.21.32.69
The new format is missing the page name and the sshguard pattern also does not include the (redundant) priority prefix.
Due to these differences, sshguard will not recognize failed logins as attacks.
Marcos is aware and already working on a fix.
Updated by Marcos M about 1 month ago
- Status changed from In Progress to Feedback
- % Done changed from 0 to 100
- Release Notes changed from Default to Force Exclusion
- Affected Version set to 2.9.0
Updated by Jim Pingle about 1 month ago
- Tracker changed from Bug to Regression
- Status changed from Feedback to Resolved
Working fine on the current build, logs are as expected and sshguard triggers properly.
Actions