#975555 sshguard on buster does not work.

Package:
sshguard
Source:
sshguard
Description:
Protects from brute force attacks against ssh
Submitter:
Pat Suwalski
Date:
2021-05-10 13:09:05 UTC
Severity:
normal
#975555#5
Date:
2020-11-23 15:29:05 UTC
From:
To:
Upon upgrading to buster, sshguard in all of my deployments has stopped
working.

I suspect this line in the Debian changelog:

   * debian/sshguard.service, Use nft instead iptables.

There doesn't seem to be any obvious way to change this back to iptables.

It is unclear why a change that clearly breaks existing installs was put
into the package.

Is there a straightforward way to change it back? I have no plans to use
nft across my large deployment.

Thanks,
--Pat
#975555#10
Date:
2021-05-06 00:56:51 UTC
From:
To:
Pat Suwalski wrote:

Debian 10 defaults to nftables, and iptables(8) is a backcompat wrapper:

    bash5$ mmdebstrap --quiet buster /dev/null --include=iptables --customize-hook='chroot $1 readlink -f /usr/sbin/iptables'
    /usr/sbin/xtables-nft-multi

sshguard should Just Work even if your main firewall is still using xtables directly.
Linux will happily operate with some firewall rules in xtables, and some firewall rules in nft --- but it can be VERY hard to debug!

If you want iptables(8) to use xtables instead of nft,
configure it via update-alternatives.

If you want sshguard to use ipset(8) or iptables(8) instead of nft(8),
change this line in /etc/sshguard/sshguard.conf:

    BACKEND="/usr/lib/x86_64-linux-gnu/sshg-fw-nft-sets"
#975555#15
Date:
2021-05-10 12:57:42 UTC
From:
To:
I guess the problem is that upon upgrade to buster, that default doesn't
change, but the backend in sshguard's config file does.

So, you upgrade, reboot. You watch the log, see IPs getting added, but
nothing is actually being blocked.