5045 FreshPorts -- security/sshit
FreshPorts -- The Place For Ports If you buy from Amazon USA, please support us by using this link.
Follow us
Blog
Twitter

Port details
sshit 0.6_4 security on this many watch lists=7 search for ports that depend on this port
Checks for SSH/FTP bruteforce and blocks given IPs
Maintained by: rafan@FreeBSD.org search for ports maintained by this maintainer
Port Added: 18 Dec 2005 16:05:26
License: not specified in port


sshit is a perl script, which works along with ipfw, ipfw2, and pf.
It parses the output of syslogd, find out SSH/FTP bruteforce attacks.
If the number of failed login is more than a threshold that administarator
set, sshit will block the source IP via firewall for a while 
(administrators can set the period of blocking). 

WWW: http://anp.ath.cx/sshit/
SVNWeb : Main Web Site : Distfiles Availability : PortsMon

NOTE: FreshPorts displays only required dependencies information. Optional dependencies are not covered.

Required To Run:
  1. sysutils/p5-Unix-Syslog
  2. devel/p5-IPC-Shareable
  3. devel/p5-Proc-PID-File
  4. lang/perl5.8
There are no ports dependent upon this port

To install the port: cd /usr/ports/security/sshit/ && make install clean
To add the package: pkg_add -r sshit


Configuration Options
     No options to configure

Master Sites:
  1. ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/
  2. ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/
  3. ftp://ftp.cn.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/
  4. ftp://ftp.jp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/
  5. ftp://ftp.ru.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/
  6. ftp://ftp.se.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/
  7. ftp://ftp.tw.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/
  8. ftp://ftp.uk.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/
  9. http://anp.ath.cx/sshit/

Number of commits found: 10

Commit History - (may be incomplete: see SVNWeb link above for full details)
DateByDescription
29 Jun 2012 18:26:52
Original commit files touched by this commit  0.6_4
az search for other commits by this committer
- Remove SITE_PERL from *_DEPENDS

Approved by: portmgr@ (bapt@)
03 Jul 2011 14:03:52
Original commit files touched by this commit  0.6_4
ohauer search for other commits by this committer
-remove MD5
10 May 2008 05:51:26
Original commit files touched by this commit  0.6_4
rafan search for other commits by this committer
- Always refer to perl by ${PERL}
- Bump PORTREVISION
07 Nov 2007 07:27:11
Original commit files touched by this commit  0.6_3
rafan search for other commits by this committer
- After last update, sshit keeps exiting with signal 15 due to wrong
  hostname regexp. Fix the regexp for hostname matching.
- While fixing that, fix IPv6 regexp, too.
- Reduce syslog level from ERROR to INFO for most informational messages.

These changes are submitted to author for inclusion in next version.

- Grab maintainership as current maintainer does not use it anymore.
- Bump PORTREVISION.

Approved by:    portmgr (linimon), maintainer via irc
18 Sep 2007 13:16:12
Original commit files touched by this commit  0.6_2
tabthorpe search for other commits by this committer
- make work with fqdn
- bump PORTREVISION

PR:             ports/115210
Submitted by:   Alex Keda <admin_AT_lissyara.su>
Approved by:    Jui-Nan Lin (maintainer), clsung (mentor)
08 Sep 2007 01:04:03
Original commit files touched by this commit  0.6_1
linimon search for other commits by this committer
Welcome bsd.perl.mk.  Add support for constructs such as USE_PERL5=5.8.0+.
Drop support for antique perl.

Work done by:   gabor
Sponsored by:   Google Summer of Code 2007
Hat:            portmgr
02 Jul 2007 08:36:13
Original commit files touched by this commit  0.6_1
rafan search for other commits by this committer
- Make sshit catch this type of error login:

PAM: authentication error for lissyara from 192.168.254.193

PR:             ports/114194
Submitted by:   Alex Keda <admin at lissyara.su>
Approved by:    maintainer via irc
03 Nov 2006 16:01:32
Original commit files touched by this commit  0.6
clsung search for other commits by this committer
- Update to 0.6

PR:             ports/104770
Submitted by:   Joe Horn <joehorn_AT_leobbs dot net>
Approved by:    maintainer (Jui-Nan Lin)
27 Jul 2006 10:32:56
Original commit files touched by this commit  0.5_1
rafan search for other commits by this committer
(c) Rong-En Fan's, http://rafan.infor.org/patch/sshit.diff

In the code, the author uses two level hash, and IPC::Shareable
will create a share memory for those anonymouse object (the second
level hash). Those share memory will not be removed when sshit exists
or when the rule is removed. Running sshit for a period of time,
the number of share memory and semaphore will reach the limit for
one process, then sshit.pl can not get more share memory, thus it
quits. The only solution is to manually remove all share memory and
semaphore.

This is somehow the limitation of using IPC::Shareable. To workaround
this problem. The patch will removes associated firewall rules when
syslogd closes the fd [1], and use IPC::Shareable->clean_up
to remove all shm/sem created by this process. I also set 'destroy'
(Only the first 15 lines of the commit message are shown above View all of this commit message)
18 Dec 2005 16:03:28
Original commit files touched by this commit  0.5
vanilla search for other commits by this committer
Add sshit 0.5, checks for SSH/FTP bruteforce and blocks given IPs.

PR:             ports/90603
Submitted by:   Jui-Nan Lin <jnlin@csie.nctu.edu.tw>

Number of commits found: 10

2831
Login
User Login
Create account

Servers and bandwidth provided by
New York Internet, SuperNews, and RootBSD

Search
Enter Keywords:
 
more...

Latest Vulnerabilities
plibMay 19
plibMay 19
linux-f10-flashplugin10May 16
linux-f10-flashplugin11May 16
nginx*May 16
nginx-devel*May 16
firefoxMay 15
firefox-develMay 15
firefox-esrMay 15
firefox10May 15
firefox15May 15
firefox3May 15
firefox3-develMay 15
firefox35May 15
firefox36May 15

5 vulnerabilities affecting 20 ports have been reported in the past 14 days

* - modified, not new

All vulnerabilities


Ports
Home
Categories
Deleted ports
Sanity Test Failures
Newsfeeds


Statistics
Graphs
NEW Graphs (Javascript)
Traffic

Calculated hourly:
Port count 24528
Broken 216
Deprecated 473
Ignore 635
Forbidden 3
Restricted 292
No CDROM 109
Vulnerable 27
Expired 132
Set to expire 511
Interactive 33
new 24 hours 4
new 48 hours7
new 7 days29
new fortnight58
new month215

This site
What is FreshPorts?
About the Authors
FAQ
How big is it?
The latest upgrade!
Privacy
Forums
Blog
Contact
8e7

Servers and bandwidth provided by
New York Internet, SuperNews, and RootBSD
Valid HTML, CSS, and RSS.
Copyright © 2000-2013 DVL Software Limited. All rights reserved.
0