security/sshguard: Moved man to share/man

Approved by:    portmgr (blanket)

security/sshguard: Fix build on FreeBSD 12

PR:		274985
Reported by:	Yani Karydis <yani@pi-greece.eu>

security/sshguard: fix logging of entries with hostnames

With work from martin@lispworks.com

PR:		272249
Reported by:	martin@lispworks.com
Approved by:	kevinz5000@gmail.com (maintainer)

Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)

Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

security: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  <ports@c0decafe.net>
  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Adam Weinberger <adamw@FreeBSD.org>
  *  Ade Lovett <ade@FreeBSD.org>
  *  Aldis Berjoza <aldis@bsdroot.lv>
  *  Alex Dupre <ale@FreeBSD.org>
  *  Alex Kapranoff <kappa@rambler-co.ru>
  *  Alex Samorukov <samm@freebsd.org>
  *  Alexander Botero-Lowry <alex@foxybanana.com>
  *  Alexander Kriventsov <avk@vl.ru>
  *  Alexander Leidinger <netchild@FreeBSD.org>

security/sshguard: disable blacklisting by default

  Blacklisting is now disabled by default to avoid overriding the setting in
  sshguard.conf. To enable blacklisting, uncomment the BLACKLIST_FILE line in
  sshguard.conf.

PR:		221602
Reported by:	bahlgren@beah.se
Submitted by:	kevinz5000@gmail.com

security/sshguard: Fix memset() off-by-one

This bug causes a stack overflow (and crash due to failed stack check)
when certain IPv6 addresses are whitelisted on i386.

PR:		258179
Reported by:	John Marshall <john@jmarshall.id.au>
MFH:	        2021Q4

security/sshguard: Upgrade to 2.4.2

Major changes:
    * Recognize rejections from Postfix's postscreen daemon
    * The parser can now be changed using the PARSER and POST_PARSER options
    * Remove some false positive attack signatures for SSH and Cyrus
    * Adjust log verbosity of some log messages
    * The firewalld backend now uses firewall-cmd instead of iptables to flush
block lists

Full changelog :
https://bitbucket.org/sshguard/sshguard/src/v2.4.2/CHANGELOG.rst

PR:			256575
Reported by:	<sirdice@gmail.com>
Approved by:	Kevin Zheng <kevinz5000@gmail.com> (maintainer)

all: Remove all other $FreeBSD keywords.

Remove # $FreeBSD$ from Makefiles.

security/sshguard: Update to 2.4.1

PR:		248404
Submitted by:	Kevin Zheng <kevinz5000@gmail.com>
Approved by:	maintainer timeout (dan.mcgregor@usask.ca, multiple timeouts)

Remove redundant pidfile check.

This fixes an issue that SSHguard won't start after an incompelete
shutdown.

PR:		ports/241751
Approved by:	portmgr (bugfix blanket)
MFH:		2019Q4

Convert to UCL & cleanup pkg-message (categories s)

sshguard: Fix rc(8) script, broken in update and then broken further in followup
commits

Also clean up some comments while here.

PR:		238458
Submitted by:	Kevin Zheng

sshguard: Update to 2.4.0 and fix rc(8) script

There is some strange new behaviour on the rc script in 2.4.0. It
would either hang on start, or hang on stop. A custom stop function
seemed the easiest way to achieve both.

PR:		238458

Back out r505456. sshguard 2.4.0 misbehaves

SSHGuard has always exited cleanly on FreeBSD. In 2.4.0, sshguard fixed that.
It is impossible to terminate sshguard without manually killing each process.

So, apologies to everyone who's already updated, but you'll have to manually
kill all the processes:
  pkill -f sshguard
  pkill -f sshg-
  pkill -f tail
  rm /var/run/sshguard.pid

So, back this out while awaiting upstream fix.

PR:		238458

Fix rc(8) script process detection

The pidfile points to a process named sh, not sshg-blocker

PR:		238458

security/sshguard: update to 2.4.0

PR:		238458
Submitted by:	Kevin Zheng <kevinz5000@gmail.com>
Approved by:	maintainer timeout (dan.mcgregor@usask.ca, >2 weeks)

security/sshguard: Update to 2.3.1

PR:		236496
Approved by:	maintainer timeout (> 2 weeks)
Sponsored by:	Rubicon Communications, LLC (Netgate)

Update security/sshguard to 2.2.0

While here, break some long lines, Use INSTALL_DATA to install sample config
file since it's not supposed to be changed and re-generate patches using
`make makepatch`

PR:		230861
Approved by:	maintainer timeout (> 1 month)
Obtained from:	pfSense
Sponsored by:	Rubicon Communications, LLC (Netgate)

Increase the default blacklist threshold from 30 to 120, which is the upstream
default. 30 makes it far too easy to get locked out of your own server. 120 is
simply a safer starting point.

PR:		227016
Submitted by:	Dan McGregor (maintainer)
MFH:		2018Q2

security/sshguard: Update to 2.1.0

Improve descriptions, pkg-message and update WWW.

Changes:	https://sourceforge.net/p/sshguard/mailman/message/36109171/

PR:		224153
Submitted by:	Kevin Zheng <kevinz5000@gmail.com>
Approved by:	maintainer timeout (dan.mcgregor@usask.ca, > 2 weeks)

security/sshguard: Fix rc script, add UPDATING entry

sshguard usually looks at sshguard.conf for a list of files to monitor,
but lets you override it via the command line using -l arguments.

This change fixes an issue with the previous rc script which was
*always* setting the '-l' arguments even if sshguard_watch_logs wasn't
set in rc.conf.

This change also sets the defaults in the config file to match the
former defaults in the rc script, and adds an UPDATING entry to warn
of the change from default configuration via rc.conf the config file.

PR:		220906
Submitted by:	Dan McGregor (maintainer)
Reported by:	chris@cretaforce.gr

security/sshguard: Update to 2.0.0

PR:		219409

security/sshguard: reset MAINTAINER

security/sshguard: Update to 1.7.1

security/sshguard: Unbreak build by making a metaport

security/sshguard no longer provides hosts/TCP Wrappers support by
default as this was removed upstream. It is now a metaport which will
allow you to select a backend. Further details can be found in the
UPDATING entry.

security/sshguard: Update to 1.7.0

Changelog:

Added
    Add sshg-logtail
    Add sshg-parser
    Control firewall using sshg-fw
    Match "no matching key exchange method" for SSH

Deprecated
    Hosts backend is deprecated
    Logsuck (-l option) is deprecated, use sshg-logtail instead
    Process validation (-f option) is deprecated

- Fix trailing whitespace in pkg-messages

Approved by:	portmgr blanket

security/sshguard: Update man page, fix sshguard_reset_interval default

Upstream responded to my submitted man page patch and indicated that
sshguard_reset_interval (-s) has been changed to 1800 (30 mins) as well.

security/sshguard: Update to 1.6.4

- Add PID file support back to rc script
- Rename some rc script parameters to better align with sshguard(8)

  sshguard_safety_thresh -> sshguard_danger_thresh
  sshguard_pardon_min_interval -> sshguard_release_interval
  sshguard_prescribe_interval -> sshguard_reset_interval

Release notes:

This release brings updated signatures, usability improvements, and bug
fixes. Highlights in this release include:

    - Match Postfix pre-authentication disconnects

security/sshguard: Add patch to prevent log flooding with error messages

PR:		208133

security/sshguard: Update to 1.6.3

Changelog:	https://sourceforge.net/p/sshguard/mailman/message/34733464/

PR:		207511
Submitted by:	<dcarmich@dcarmichael.net>

security/sshguard-pf Fix documentation URL in pkg-message

Submitted by:	Johan <johan jails se>

security/sshgaurd: Update to 1.6.2

* Remove recommendation of using syslog pipes
* IPFW support has been rewritten and entries now are added to table 22

PR:		203452

security/sshguard: update to 1.6.1

security/sshguard-null

portable do-nothing backend for applying detection but not prevention

PR:		201323

Add patch to support syslog in verbose mode

This was previously a patch in the FreeBSD ports tree and was sent
upstream but did not make it into 1.6.0

Submitted by:	gregp@n0qds.org

Update to 1.6.0

Restore lost changes to patch-src-parser-attack_scanner.l

PR:		197854

Enable matching of syslog entries with <facility.level>

PR:		197854

Patch parser to fix matching for Cyrus IMAP login attempts which are not
plaintext.

PR:		196943
Submitted by:	jakob.alvermark@bsdlabs.com

Add ability to pass additional custom arguments to sshguard daemon via
sshguard_flags in rc.conf

Declare LICENSE while here

Submitted by:	wjw@digiware.nl

Update "BSD" license in security category

Make it possible to run sshguard without blacklist database by setting
in rc.conf:

 sshguard_blacklist=""

This may fix reliability for some users.

PR:		174018

Do not hide stdout from users by sending it to syslog. Users need to be
able to readily view errors if they happen at startup.

PR:		193378

The default pardon and prescribe settings in the rc script were swapped
and did not match the documentation. Users should tune to their needs
instead of relying on the defaults, but if they are this will be an
improvement.

Submitted by:	John Vinopal

Adopting security/sshguard

rc script passes rclint

Removed clever built-in sysadmin countermeasure:

Previously sshguard would automatically add a line to your
/etc/syslog.conf file. You could activate sshguard by uncommenting this
line. However, every time you reinstall/update sshguard this line will
also be automatically removed rendering the program inactive and your
system unprotected.

Sponsored by:	SupraNet Communications, Inc

Fix rc script, which I made a bit of a mess of.  Really sorry :(

Submitted by:	se

While here, add error checking in pkg-install before replacing
syslog.conf with an unknown file!

Fix old sshguard bug; does not detect ssh invalid users logins

PR:		ports/174571
Submitted by:	Francois Charlier <fcharlier@ploup.net>

Reset maintainer after 16 month timeout

While here, stage, remove some insanity and fixup rc script

Add NO_STAGE all over the place in preparation for the staging support (cat:
security)

- Fix all cases of 'No newline at end of file' in ports tree

Approved by: portmgr (bapt)

Add a rc.d script to daemonize sshguard.

Submitted by:   delphij
PR:             ports/166471
Approved by:    maintainer timeout (~3 months)

Fix sshguared-ipfw -b option

PR:             157807
Submitted by:   Dmitry <smallcms@gmail.com>
Approved by:    maintainer timeout

- Update to 1.5

PR:             155607
Submitted by:   Matthias Fechner <idefix@fechner.net>

- update to 1.4

PR:             ports/142469
Approved by:    gabor, Maintainer

- Switch SourceForge ports to the new File Release System: categories starting
with P,R,S

- Update to 1.3, which also fixes build problem with autoconf

PR:             127599
Submitted by:   Jeremy Johnston <jeremy at smart-serv dot net>
Suggested by:   Mij <mij at bitchx dot it> (maintainer)

- Update to 1.2. Changes:
  - support for Cyrus IMAP
  - support for SSH "possible break-in attempt" messages
  - updated support for dovecot to include logging format of new versions
  - fix of IPF backend causing sshguard not to update /etc/ipf.rules (disallow
IPv6)
  - fix detection of password when sshd doesn't log anything more than PAM
- While here, use SF macro

PR:             127456
Submitted by:   Mij <mij at bitchx dot it> (maintainer)

- Install man page to ${MANPREFIX}/man .  Thanks to pav@ for notification
- Update description reflecting additions of version 1.1

PR:             ports/126001
Submitted by:   Mij <mij AT bitchx.it> (maintainer)

- Update to 1.1

PR:             ports/125973
Submitted by:   Mij <mij AT bitchx.it> (maintainer)

Prevent the port from running automake if it is installed

PR:             118065
Submitted by:   Mij <mij@bitchx.it>

- add patch for:
The regex used to recognize IPv6 addresses in security/sshguard{,-ipfw,-pf}
doesn't catch all IPv6 addresses. The author (and port maintainer) is aware of
this issue and supplied the patch, which fixes the issue. The patch will be
part of sshguard-1.1, which is due soonish.
- bump PORTREVISION

PR:             113800
Submitted by:   Henrik Brix Andersen
Approved by:    Mij (maintainer)

Shorten COMMENT

Submitted by:   sat@

Allow slave ports to overwrite the COMMENT.

Submitted by:   sat@

- upgrade to version 1.0
- the port is no longer interactive, it uses the default blocking backend
(hosts)
- for pf and ipfw see the new ports sshguard-[pf|ipfw]

PR:             ports/112749
Submitted by:   Mij (maintainer)
Reviewed by:    leeym@

- respect maintainer's insist on interactive part,
  even IS_INTERACTIVE is discouraged
- PORTREVISION is thus bumped.

Approved by:    maintainer (implicit)

Add sshguard 0.91, protect networked hosts from brute force attacks
against ssh.

PR:             ports/109439
Submitted by:   Mij <mij at bitchx.it>