Index: head/security/sshguard/Makefile =================================================================== --- head/security/sshguard/Makefile (revision 506903) +++ head/security/sshguard/Makefile (revision 506904) @@ -1,31 +1,32 @@ # Created by: Mij # $FreeBSD$ PORTNAME= sshguard PORTVERSION= 2.4.0 +PORTREVISION= 1 PORTEPOCH= 1 CATEGORIES= security MASTER_SITES= SF/sshguard/sshguard/${PORTVERSION} MAINTAINER= dan.mcgregor@usask.ca COMMENT= Protect hosts from brute-force attacks against SSH and other services LICENSE= BSD2CLAUSE USE_RC_SUBR= sshguard GNU_CONFIGURE= yes SUB_FILES= pkg-message post-patch: @${REINPLACE_CMD} -e 's|%PREFIX%|${PREFIX}|' \ ${WRKSRC}/doc/sshguard.8.rst @${REINPLACE_CMD} -e 's|/usr/local|${PREFIX}|' \ ${WRKSRC}/examples/sshguard.conf.sample post-install: ${MKDIR} ${STAGEDIR}${PREFIX}/etc ${INSTALL_DATA} ${WRKSRC}/examples/sshguard.conf.sample \ ${STAGEDIR}${PREFIX}/etc .include Index: head/security/sshguard/files/patch-src-sshguard.in =================================================================== --- head/security/sshguard/files/patch-src-sshguard.in (revision 506903) +++ head/security/sshguard/files/patch-src-sshguard.in (nonexistent) @@ -1,8 +0,0 @@ ---- src/sshguard.in.orig 2018-07-08 18:07:01 UTC -+++ src/sshguard.in -@@ -96,4 +96,4 @@ elif [ -z "$tailcmd" ]; then - fi - - eval $tailcmd | $libexec/sshg-parser | \ -- $libexec/sshg-blocker $flags | ($BACKEND; kill -PIPE $$) -+ $libexec/sshg-blocker $flags | ($BACKEND ; pkill -PIPE -P $$) Property changes on: head/security/sshguard/files/patch-src-sshguard.in ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/security/sshguard/files/sshguard.in =================================================================== --- head/security/sshguard/files/sshguard.in (revision 506903) +++ head/security/sshguard/files/sshguard.in (revision 506904) @@ -1,126 +1,117 @@ #!/bin/sh #- # Copyright (c) 2012 iXsystems, Inc. # All rights reserved. # # Written by: Xin Li # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # $FreeBSD$ # # PROVIDE: sshguard # REQUIRE: LOGIN cleanvar # KEYWORD: shutdown # # Add the following lines to /etc/rc.conf to enable sshguard: # sshguard_enable (bool): Set to "NO" by default. # Set it to "YES" to enable sshguard # sshguard_pidfile (str): Path to PID file. # Set to "/var/run/sshguard.pid" by default -# sshguard_watch_logs (str): Colon splitted list of logs to watch. +# sshguard_watch_logs (str): Colon-splitted list of logs to watch. # Unset by default. Overrides the configuration file. -# The following options directly maps to their command line options, +# The following options directly map to their command line options, # and override the configuration file, so most are unset by default. -# Please read manual page sshguard(8) for detailed information: -# sshguard_blacklist (str): [thr:]/path/to/blacklist. +# Please read the sshguard(8) manual page for detailed information: +# sshguard_blacklist (str): [threshold:]/path/to/blacklist. # Set to "30:/var/db/sshguard/blacklist.db" # by default. # sshguard_danger_thresh (int): Danger threshold. # sshguard_release_interval (int): -# Minimum interval an address remains +# Minimum interval (in sec) an address remains # blocked. # sshguard_reset_interval (int): # Interval before a suspected attack is # forgotten and danger is reset to 0. # sshguard_whitelistfile (str): Path to the whitelist. # sshguard_flags (str): Set additional command line arguments. # - . /etc/rc.subr name=sshguard rcvar=sshguard_enable +set_rcvar sshguard_blacklist "120:/var/db/sshguard/blacklist.db" "Blacklisting threshold and path to blacklist file (colon-separated)" +set_rcvar sshguard_danger_thresh "" "Attack threshold" +set_rcvar sshguard_pidfile "/var/run/sshguard.pid" "Path to PID file" +set_rcvar sshguard_release_interval "" "Time before releasing first-time attackers (s)" +set_rcvar sshguard_reset_interval "" "Time before forgetting attackers (s)" +set_rcvar sshguard_watch_logs "" "Log files to monitor, overriding sshguard.conf (space-separated)" +set_rcvar sshguard_whitelistfile "" "Path to whitelist" + load_rc_config sshguard -: ${sshguard_enable:=NO} -: ${sshguard_blacklist=120:/var/db/sshguard/blacklist.db} -: ${sshguard_danger_thresh=} -: ${sshguard_release_interval=} -: ${sshguard_reset_interval=} -: ${sshguard_whitelistfile=} -: ${sshguard_watch_logs=} +pidfile=${sshguard_pidfile} -pidfile=${sshguard_pidfile:="/var/run/sshguard.pid"} - command=/usr/sbin/daemon actual_command="%%PREFIX%%/sbin/sshguard" procname="/bin/sh" start_precmd=sshguard_prestart -stop_cmd=sshguard_stop -command_args="-c ${actual_command} \${sshguard_flags} \${sshguard_blacklist_params} \${sshguard_watch_params} \${sshguard_danger_params} \${sshguard_release_params} \${sshguard_reset_params} \${sshguard_whitelist_params} -i ${pidfile}" +command_args="-c -f ${actual_command} \${sshguard_flags} \${sshguard_blacklist_params} \${sshguard_watch_params} \${sshguard_danger_params} \${sshguard_release_params} \${sshguard_reset_params} \${sshguard_whitelist_params} -i ${pidfile}" sshguard_prestart() { # Clear rc_flags so sshguard_flags can be passed to sshguard - # instaed of daemon(8) + # instead of daemon(8) rc_flags="" if [ ! -z ${sshguard_blacklist} ]; then mkdir -p $(dirname ${sshguard_blacklist##*:}) sshguard_blacklist_params="-b ${sshguard_blacklist}" fi if [ ! -z ${sshguard_whitelistfile} ]; then [ -e "${sshguard_whitelistfile}" ] || touch ${sshguard_whitelistfile} sshguard_whitelist_params="-w ${sshguard_whitelistfile}" fi if [ ! -z ${sshguard_danger_thresh} ]; then sshguard_danger_params="-a ${sshguard_danger_thresh}" fi if [ ! -z ${sshguard_release_interval} ]; then sshguard_release_params="-p ${sshguard_release_interval}" fi if [ ! -z ${sshguard_reset_interval} ]; then sshguard_reset_params="-s ${sshguard_reset_interval}" fi if [ ! -z "${sshguard_watch_logs}" ]; then sshguard_watch_params=$(echo ${sshguard_watch_logs} | tr : \\\n | sed -e s/^/-l\ /g | tr \\\n \ ) fi -} - -sshguard_stop() -{ - sshg_blocker="%%PREFIX%%/libexec/sshg-blocker" - rc_pid="$(check_process ${sshg_blocker})" - kill $sig_stop "$rc_pid" } run_rc_command "$1"