Member Avatar for FelineHazard

Hi all,

I am attempting to install sshdfilter on my ubuntu 10.4 LTS machine. This package is supposed to block ssh-bruteforce attacks. It does that by adding blocking rules to iptables when multiple bad ssh logins are detected, and blocks the ip that initiated them.

This package usually relies on /var/log/sshd.fifo, but in ubuntu the file is called /var/log/auth.log, so I created a symlink

sudo ln -s /var/log/auth.log /var/log/sshd.fifo

After doing that I continued the installation by the excellent instructions .
Unfortunately, I have no idea how to test if it is really working! :-(
Any ideas hot to test it?

Thanks a log,
-R

  • 2 Contributors
  • 3 Replies
  • 270 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by FelineHazard

Dani AI

Generated

A short, practical note tying the thread together and giving a reliable test workflow.

The symlink created by (pointing /var/log/sshd.fifo at /var/log/auth.log) commonly causes problems because it does not give sshdfilter the named‑pipe semantics it expects. sshdfilter is written to read a FIFO supplied by syslog; a plain symlink to the rotating auth.log won’t behave the same and is a frequent reason the filter appears inactive.

Create a proper FIFO and make rsyslog feed it (example steps):

sudo rm -f /var/log/sshd.fifo
sudo mkfifo /var/log/sshd.fifo
sudo chown syslog:adm /var/log/sshd.fifo

# add a short rsyslog drop-in (e.g. /etc/rsyslog.d/10-sshd.conf):
# auth,authpriv.*    /var/log/sshd.fifo

sudo service rsyslog restart

Simple, safe tests and checks (avoid locking out the admin IP — run tests from a separate machine or whitelist the admin IP first). Generate failed SSH logins from another host until the sshdfilter threshold is reached, then confirm a block by listing iptables rules:

sudo iptables -L INPUT -n --line-numbers | grep <test-IP>
sudo iptables-save | grep <test-IP>

If setting up another host is inconvenient, inject a realistic sshd failure line into syslog to exercise the parser:

logger -p authpriv.warn "sshd[12345]: Failed password for invalid user test from 203.0.113.45 port 54321 ssh2"

If no blocking appears, check that sshdfilter is running and actually reading the FIFO (start it in a terminal for visible output), ensure FIFO ownership/permissions are correct, and confirm rsyslog and sshdfilter start in an order that prevents rsyslog from blocking on an unread pipe. As noted, denyhosts is simpler; as found, fail2ban tends to be the easiest choice on Ubuntu because it reads /var/log/auth.log directly and avoids FIFO fiddling.

Recommended Answers

All 3 Replies

Member Avatar for rch1231

Hello,

I tried that sshdfilter and found denyhosts to be a much easier application to install and configure. And it works.

Member Avatar for FelineHazard

Thanks, I'll try it and report back. I'm starting to think that sshdfilter is just too much trouble for debian-based distros.

Member Avatar for FelineHazard

Ok thanks. I actually found fail2ban a bit more ubuntu-friendly.
-R

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.