drmurx/docker-systemd-sshguard repository overview

⁠docker-systemd-sshguard

An SSHGuard⁠ container suitable for systemd-based environment such as CoreOS⁠.

It is supposed to run in a privileged container with the host's systemd journal directory being mounted, and pipes the journal directly into sshguard.

⁠Usage

There are a couple of environment variables you can pass to the container:

• IPTABLES_SETUP, IPTABLES_SETUP_IPV4 and IPTABLES_SETUP_IPV6: Set to "no" if you don't want the container to setup the required iptables rules in general, for IPv4 or IPv6, respectively (all default to "yes").
• IPTABLES_TEARDOWN: Set to "no" if you want to keep the sshguard iptables after shutting down the container (defaults to "yes").
• IPTABLES_HOOKS: A comma separated list of iptables filter chains in the jump to the sshguard table will be appended (default) or inserted. Add an optional :n to each chain name to insert at the nth position. (defaults to "INPUT:1").
• JOURNALD_START_AT: Starting point in the journal, can be any absolute or relative timestamp strtotime is able to parse (defaults to "2 hours ago").
• SSHGUARD_FORGET_CRACKER: Specify after how many seconds sshguard will forget an attack (defaults to 1200).
• SSHGUARD_UNBLOCK_AFTER: Specify the baseline number of seconds an attacker will be blocked (defaults to 420).

Edit these variables into the unit file which fits best for your setup:

⁠CoreOS Cluster

fleetctl start sshguard-rkt.service

⁠CoreOS Single Instance

cp sshguard-rkt.service /etc/systemd/system/sshguard.service
systemctl daemon-reload
systemctl start sshguard.service
systemctl enable sshguard.service

⁠Generic Linux host using Docker

cp sshguard-docker.service /etc/systemd/system/sshguard.service
systemctl daemon-reload
systemctl start sshguard.service
systemctl enable sshguard.service

⁠Docker Compose

A proper docker-compose.yml is also provided.

⁠TODO

• Get rid of the bloated ubuntu base image. Compiling journalctl/systemd on alpine is a challenge.
• Upcoming sshguard version supports ipset backend to avoid cluttering the iptables.

⁠Credits

Copyright (c) 2016 Jan Kunzmann [email protected]⁠, see LICENSE.md⁠.

Heavily inspired by Nick Owens' coreos-sshguard⁠