pfSense

Since 2.4.5 is still using clog, at least there the only option appears to be patching out the error/exit.

I took another run at this and found a potential fix without patching too much in sshguard. We can set LOGREADER to /bin/cat and pass it a PID file to make it a little happier, but that alone isn't enough. We have to change the last couple lines back to the old version.

system.inc diff:

diff --git a/src/etc/inc/system.inc b/src/etc/inc/system.inc
index e945d37637..b5e61321cd 100644
--- a/src/etc/inc/system.inc
+++ b/src/etc/inc/system.inc
@@ -1050,7 +1050,7 @@ local4.*                            {$log_directive}{$g['varlog_path']}/portalauth.log
 local5.*                            {$log_directive}{$g['varlog_path']}/nginx.log
 local7.*                            {$log_directive}{$g['varlog_path']}/dhcpd.log
 *.notice;kern.debug;lpr.info;mail.crit;daemon.none;news.err;local0.none;local3.none;local4.none;local7.none;security.*;auth.info;authpriv.info;daemon.info    {$log_directive}{$g['varlog_path']}/system.log
-auth.info;authpriv.info                     |exec /usr/local/sbin/sshguard
+auth.info;authpriv.info                     |exec /usr/local/sbin/sshguard -i /var/run/sshguard.pid
 *.emerg                                *

 EOD;
@@ -1139,6 +1139,7 @@ EOD;
     }

     $sshguard_config = array();
+    $sshguard_config[] = 'LOGREADER="/bin/cat"' . "\n";
     $sshguard_config[] = 'BACKEND="/usr/local/libexec/sshg-fw-pf"' . "\n";
     if (!empty($config['system']['sshguard_threshold'])) {
         $sshguard_config[] = 'THRESHOLD=' .

sshguard diff:

--- /usr/local/sbin/sshguard.orig    2020-01-03 11:12:02.896999111 -0500
+++ /usr/local/sbin/sshguard    2020-01-03 11:12:14.393207610 -0500
@@ -105,5 +105,4 @@
 trap "kill 0" EXIT

 eval $tailcmd | $libexec/sshg-parser | \
-    $libexec/sshg-blocker $flags | $BACKEND &
-wait
+    $libexec/sshg-blocker $flags | ($BACKEND ; pkill -PIPE -P $$)

With those changes on 2.4.5, sshguard properly detected and blocked attacks as expected.

Verified old behavior before upgrade.

Verified erroneous log messages are gone and sshguard properly blocks both webgui and ssh connections based on invalid attempts on either service.

Block was removed after the appropriate interval.

Looks good on 2.4.5-DEV.

Verified old behavior before upgrade.

Verified erroneous log messages are gone and sshguard properly blocks both webgui and ssh connections based on invalid attempts on either service.

Block was removed after the appropriate interval.

Looks good on 2.5.0-DEV.