1. sshguard Avatar sshguard
  2. sshguard
  3. sshguard
  4. Issues

SSHGuard Fails to Update Firewall (IPFW) With Blacklisted/Banned IP Addresses

Issue #76 invalid
John Lyon created an issue

I admit, this might be a downstream problem, but I suspect it is not.

Here is some of the pertinent details:

SSHGuard version = 1.7.1 OS = FreeBSD 10.3 SSHGuard Invocation = Service Started via RC script Firewall Backend = IPFW (FreeBSD default firewall)

Description of the Bug:

My log files regularly (at least 6 months, maybe longer) show Brute Force Attacks from IP addresses that SSHGuard says have already been blocked due to previous attacks. This raises the question, if the IP address has already been banned/blacklisted, then why is it showing up in my SSHGuard logs? The firewall should be blocking connection attempts, which in turn prevents the failed attempts from showing up in the SSH logs and being recognized by SSHGuard.

Below is a sample log file illustrating the issue:

System Events

May 9 00:00:00 zeus sshguard[899]: Reloading rotated file /var/log/maillog. May 9 00:00:00 zeus sshguard[899]: Reloading rotated file /var/log/maillog. May 9 06:55:02 zeus sshd[82182]: fatal: Unable to negotiate with 104.40.52.208 port 50964: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:02 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:02 zeus sshd[82182]: fatal: Unable to negotiate with 104.40.52.208 port 50964: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:02 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:03 zeus sshd[82184]: fatal: Unable to negotiate with 104.40.52.208 port 51042: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:03 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:03 zeus sshd[82184]: fatal: Unable to negotiate with 104.40.52.208 port 51042: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:03 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:04 zeus sshd[82186]: fatal: Unable to negotiate with 104.40.52.208 port 51113: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:04 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:04 zeus sshd[82186]: fatal: Unable to negotiate with 104.40.52.208 port 51113: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:04 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:11 zeus sshd[82188]: fatal: Unable to negotiate with 104.40.52.208 port 51583: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:11 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:11 zeus sshd[82188]: fatal: Unable to negotiate with 104.40.52.208 port 51583: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:11 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:12 zeus sshd[82190]: fatal: Unable to negotiate with 104.40.52.208 port 51655: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:12 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:12 zeus sshd[82190]: fatal: Unable to negotiate with 104.40.52.208 port 51655: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:12 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:13 zeus sshd[82194]: fatal: Unable to negotiate with 104.40.52.208 port 51727: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:13 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:13 zeus sshd[82194]: fatal: Unable to negotiate with 104.40.52.208 port 51727: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:13 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:14 zeus sshd[82196]: fatal: Unable to negotiate with 104.40.52.208 port 51800: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:14 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:14 zeus sshd[82196]: fatal: Unable to negotiate with 104.40.52.208 port 51800: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:14 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:15 zeus sshd[82198]: fatal: Unable to negotiate with 104.40.52.208 port 51866: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:15 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:15 zeus sshd[82198]: fatal: Unable to negotiate with 104.40.52.208 port 51866: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:15 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:16 zeus sshd[82200]: fatal: Unable to negotiate with 104.40.52.208 port 51948: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:16 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:16 zeus sshd[82200]: fatal: Unable to negotiate with 104.40.52.208 port 51948: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:16 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:17 zeus sshd[82202]: fatal: Unable to negotiate with 104.40.52.208 port 52019: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:17 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:17 zeus sshd[82202]: fatal: Unable to negotiate with 104.40.52.208 port 52019: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:17 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:18 zeus sshd[82204]: fatal: Unable to negotiate with 104.40.52.208 port 52088: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:18 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:18 zeus sshd[82204]: fatal: Unable to negotiate with 104.40.52.208 port 52088: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:18 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:19 zeus sshd[82206]: fatal: Unable to negotiate with 104.40.52.208 port 52165: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:19 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:19 zeus sshd[82206]: fatal: Unable to negotiate with 104.40.52.208 port 52165: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:19 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:21 zeus sshd[82208]: fatal: Unable to negotiate with 104.40.52.208 port 52236: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:21 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:21 zeus sshd[82208]: fatal: Unable to negotiate with 104.40.52.208 port 52236: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:21 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:22 zeus sshd[82210]: fatal: Unable to negotiate with 104.40.52.208 port 52314: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:22 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:22 zeus sshd[82210]: fatal: Unable to negotiate with 104.40.52.208 port 52314: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:22 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:23 zeus sshd[82212]: fatal: Unable to negotiate with 104.40.52.208 port 52390: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:23 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:23 zeus sshd[82212]: fatal: Unable to negotiate with 104.40.52.208 port 52390: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:23 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:24 zeus sshd[82214]: fatal: Unable to negotiate with 104.40.52.208 port 52463: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:24 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:24 zeus sshd[82214]: fatal: Unable to negotiate with 104.40.52.208 port 52463: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:24 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:25 zeus sshd[82216]: fatal: Unable to negotiate with 104.40.52.208 port 52528: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:25 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:25 zeus sshd[82216]: fatal: Unable to negotiate with 104.40.52.208 port 52528: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:25 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:26 zeus sshd[82218]: fatal: Unable to negotiate with 104.40.52.208 port 52608: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:26 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:26 zeus sshd[82218]: fatal: Unable to negotiate with 104.40.52.208 port 52608: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:26 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:27 zeus sshd[82220]: fatal: Unable to negotiate with 104.40.52.208 port 52676: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:27 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:27 zeus sshd[82220]: fatal: Unable to negotiate with 104.40.52.208 port 52676: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:27 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:28 zeus sshd[82222]: fatal: Unable to negotiate with 104.40.52.208 port 52760: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:28 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:28 zeus sshd[82222]: fatal: Unable to negotiate with 104.40.52.208 port 52760: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:28 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:29 zeus sshd[82224]: fatal: Unable to negotiate with 104.40.52.208 port 52823: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:29 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:29 zeus sshd[82224]: fatal: Unable to negotiate with 104.40.52.208 port 52823: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:29 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:30 zeus sshd[82226]: fatal: Unable to negotiate with 104.40.52.208 port 52894: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:30 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:30 zeus sshd[82226]: fatal: Unable to negotiate with 104.40.52.208 port 52894: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:30 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:31 zeus sshd[82228]: fatal: Unable to negotiate with 104.40.52.208 port 52964: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:31 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:31 zeus sshd[82228]: fatal: Unable to negotiate with 104.40.52.208 port 52964: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:31 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:32 zeus sshd[82231]: fatal: Unable to negotiate with 104.40.52.208 port 53034: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:32 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:32 zeus sshd[82231]: fatal: Unable to negotiate with 104.40.52.208 port 53034: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:32 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:33 zeus sshd[82233]: fatal: Unable to negotiate with 104.40.52.208 port 53102: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:33 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:33 zeus sshd[82233]: fatal: Unable to negotiate with 104.40.52.208 port 53102: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:33 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:34 zeus sshd[82236]: fatal: Unable to negotiate with 104.40.52.208 port 53179: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:34 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:34 zeus sshd[82236]: fatal: Unable to negotiate with 104.40.52.208 port 53179: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:34 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:35 zeus sshd[82238]: fatal: Unable to negotiate with 104.40.52.208 port 53248: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:35 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:35 zeus sshd[82238]: fatal: Unable to negotiate with 104.40.52.208 port 53248: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:35 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:37 zeus sshd[82240]: fatal: Unable to negotiate with 104.40.52.208 port 53312: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:37 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:37 zeus sshd[82240]: fatal: Unable to negotiate with 104.40.52.208 port 53312: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:37 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:38 zeus sshd[82242]: fatal: Unable to negotiate with 104.40.52.208 port 53383: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:38 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:38 zeus sshd[82242]: fatal: Unable to negotiate with 104.40.52.208 port 53383: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:38 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:39 zeus sshd[82244]: fatal: Unable to negotiate with 104.40.52.208 port 53455: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:39 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:39 zeus sshd[82244]: fatal: Unable to negotiate with 104.40.52.208 port 53455: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:39 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:40 zeus sshd[82246]: fatal: Unable to negotiate with 104.40.52.208 port 53518: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:40 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:40 zeus sshd[82246]: fatal: Unable to negotiate with 104.40.52.208 port 53518: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:40 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:41 zeus sshd[82248]: fatal: Unable to negotiate with 104.40.52.208 port 53591: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:41 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:41 zeus sshd[82248]: fatal: Unable to negotiate with 104.40.52.208 port 53591: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:41 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:42 zeus sshd[82250]: fatal: Unable to negotiate with 104.40.52.208 port 53658: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:42 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:42 zeus sshd[82250]: fatal: Unable to negotiate with 104.40.52.208 port 53658: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:42 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:43 zeus sshd[82252]: fatal: Unable to negotiate with 104.40.52.208 port 53736: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:43 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:43 zeus sshd[82252]: fatal: Unable to negotiate with 104.40.52.208 port 53736: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:43 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:44 zeus sshd[82254]: fatal: Unable to negotiate with 104.40.52.208 port 53803: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:44 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:44 zeus sshd[82254]: fatal: Unable to negotiate with 104.40.52.208 port 53803: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:44 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:45 zeus sshd[82256]: fatal: Unable to negotiate with 104.40.52.208 port 53868: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:45 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:45 zeus sshd[82256]: fatal: Unable to negotiate with 104.40.52.208 port 53868: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:45 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:46 zeus sshd[82258]: fatal: Unable to negotiate with 104.40.52.208 port 53935: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:46 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:46 zeus sshd[82258]: fatal: Unable to negotiate with 104.40.52.208 port 53935: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:46 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:47 zeus sshd[82260]: fatal: Unable to negotiate with 104.40.52.208 port 54006: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:47 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:47 zeus sshd[82260]: fatal: Unable to negotiate with 104.40.52.208 port 54006: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:47 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:48 zeus sshd[82262]: fatal: Unable to negotiate with 104.40.52.208 port 54075: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:48 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:48 zeus sshd[82262]: fatal: Unable to negotiate with 104.40.52.208 port 54075: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:48 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:49 zeus sshd[82264]: fatal: Unable to negotiate with 104.40.52.208 port 54138: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:49 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:49 zeus sshd[82264]: fatal: Unable to negotiate with 104.40.52.208 port 54138: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:49 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:50 zeus sshd[82267]: fatal: Unable to negotiate with 104.40.52.208 port 54217: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:50 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:50 zeus sshd[82267]: fatal: Unable to negotiate with 104.40.52.208 port 54217: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:50 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:52 zeus sshd[82269]: fatal: Unable to negotiate with 104.40.52.208 port 54278: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:52 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:52 zeus sshd[82269]: fatal: Unable to negotiate with 104.40.52.208 port 54278: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:52 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:53 zeus sshd[82272]: fatal: Unable to negotiate with 104.40.52.208 port 54346: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:53 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:53 zeus sshd[82272]: fatal: Unable to negotiate with 104.40.52.208 port 54346: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:53 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:54 zeus sshd[82274]: fatal: Unable to negotiate with 104.40.52.208 port 54424: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:54 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:54 zeus sshd[82274]: fatal: Unable to negotiate with 104.40.52.208 port 54424: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:54 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:55 zeus sshd[82276]: fatal: Unable to negotiate with 104.40.52.208 port 54487: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:55 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:55 zeus sshd[82276]: fatal: Unable to negotiate with 104.40.52.208 port 54487: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:55 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:56 zeus sshd[82278]: fatal: Unable to negotiate with 104.40.52.208 port 54555: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:56 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:56 zeus sshd[82278]: fatal: Unable to negotiate with 104.40.52.208 port 54555: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:56 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:57 zeus sshd[82280]: fatal: Unable to negotiate with 104.40.52.208 port 54635: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:57 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:57 zeus sshd[82280]: fatal: Unable to negotiate with 104.40.52.208 port 54635: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:57 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:58 zeus sshd[82282]: fatal: Unable to negotiate with 104.40.52.208 port 54699: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:58 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:55:58 zeus sshd[82282]: fatal: Unable to negotiate with 104.40.52.208 port 54699: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:55:58 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:00 zeus sshd[82284]: fatal: Unable to negotiate with 104.40.52.208 port 54764: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:00 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:00 zeus sshd[82284]: fatal: Unable to negotiate with 104.40.52.208 port 54764: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:00 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:01 zeus sshd[82286]: fatal: Unable to negotiate with 104.40.52.208 port 54888: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:01 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:01 zeus sshd[82286]: fatal: Unable to negotiate with 104.40.52.208 port 54888: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:01 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:02 zeus sshd[82288]: fatal: Unable to negotiate with 104.40.52.208 port 54956: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:02 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:02 zeus sshd[82288]: fatal: Unable to negotiate with 104.40.52.208 port 54956: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:02 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:03 zeus sshd[82290]: fatal: Unable to negotiate with 104.40.52.208 port 55021: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:03 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:03 zeus sshd[82290]: fatal: Unable to negotiate with 104.40.52.208 port 55021: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:03 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:04 zeus sshd[82292]: fatal: Unable to negotiate with 104.40.52.208 port 55092: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:04 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:04 zeus sshd[82292]: fatal: Unable to negotiate with 104.40.52.208 port 55092: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:04 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:05 zeus sshd[82294]: fatal: Unable to negotiate with 104.40.52.208 port 55158: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:05 zeus sshguard[899]: 104.40.52.208 has already been blocked May 9 06:56:05 zeus sshd[82294]: fatal: Unable to negotiate with 104.40.52.208 port 55158: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] May 9 06:56:05 zeus sshguard[899]: 104.40.52.208 has already been blocked

Comments (8)

  1. Kevin Zheng

    How do you have ipfw set up? Starting in 1.7.0, you need to create the block table in ipfw.rules and add your own rule to block connections from the table yourself.

  2. John Lyon reporter

    I am not a firewalling expert. It is quite possible that I have set something up incorrectly. If you could please bear with me, I would appreciate it.

    Based on the sparse documentation provided on the website, I assumed that I had ipfw setup correctly. When I type "ipfw table 22 list" (command provided from sshguard.net) on the command prompt, I am provided with a list of IP addresses that, according to the documentation have been blocked. I setup IPFW by specifying the following variables and values in /etc/rc.conf:

    firewall_enable="YES" firewall_quiet="YES" firewall_type="workstation" firewall_myservices="22/tcp 80/tcp 443/tcp 137/tcp 137/udp 138/tcp 138/udp 139/tcp 139/udp 445/tcp 445/udp 5432/tcp" firewall_allowservices="any" firewall_logdeny="YES"

    I assumed that the port would modify the rules/tables for IPFW automatically like the older versions of ports for SSHGuard that used TCP-Wrappers would do with the hosts file. The port did not include an installation message stating that any changes to the ipfw.rules needed to be made manually.

    Is there another/additional command I need to run or configuration variable I need to set? Or have I done everything right and stumbled on a bug?

    Thanks.

  3. Kevin Zheng

    Sounds like you've set up the table correctly, but you'll need to add a rule to block accesses from addresses inside the table in ipfw itself.

    Does 1.7.1 have the sshguard-setup(7) manpage? This is excerpted from that:

    # ipfw add 5000 reset ip from table\(22\) to me

    Refer to the FreeBSD Handbook on how to make this permanent.

  5. John Lyon reporter

    I am guessing we have a documentation issue. That man page does not appear to be included in the FreeBSD port. I tried both "man sshguard-setup" and "man -S 7 sshguard-setup" and got an error that the man page did not exist. The port and FreeBSD man pages both fail to mention that the user needs to manually enter this command or modify his or her firewall rules to include this command.

    Thanks for your help. I'll file PR reports downstream to update the documentation for FreeBSD.

  6. Kevin Zheng

    The man page might not have made it for 1.7.1 but is in 2.0.0.

    As for FreeBSD, this is documented in /usr/ports/UPDATING in the 20151013 entry.

  9. Log in to comment
Assignee
–
Type
bug
Priority
major
Status
invalid
Component
–
Votes
0
Watchers
3
Jira: the preferred issue tracker for Bitbucket. Join the team!