From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthias Fischer To: development@lists.ipfire.org Subject: Re: Betatest Guardian 2.0 Date: Thu, 21 Jul 2016 17:57:44 +0200 Message-ID: <8eca5224-cc19-182d-59b6-586a0ee86229@ipfire.org> In-Reply-To: <1469100487.2710.251.camel@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4383818405263020112==" List-Id: --===============4383818405263020112== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, some additional information: After running for about two days, I got four 'guardians' running in 'htop', claiming to use ~84176 KB memory. Perhaps this corresponds with the GUI: it says 73087 KB. 'pstree' says: root(a)ipfire: /var/log/guardian # pstree init-+-acpid |-6*[agetty] |-clamd---{clamd} |-collectd---3*[{collectd}] |-dhcpd |-dnsmasq |-fcron |-freshclam |-guardian-+-iptables | `-4*[{guardian}] |-httpd---10*[httpd] |-klogd |-privoxy---12*[{privoxy}] |-saslauthd---saslauthd |-snort---{snort} |-squid---squid-+-18*[redirect_wrappe-+-squidGuard] | | `-squidclamav] | `-16*[{squid}] |-sshd---bash---pstree |-syslogd `-udevd After shutting down, 'guardian' is gone, but after restart there are four 'guardians' again - using 14334 KB, blocking was tested and is OK - *without* 'iptables': root(a)ipfire: /var/log/guardian # pstree init-+-acpid |-6*[agetty] |-clamd---{clamd} |-collectd---3*[{collectd}] |-dhcpd |-dnsmasq |-fcron |-freshclam |-guardian---4*[{guardian}] |-httpd---10*[httpd] |-klogd |-privoxy |-saslauthd---saslauthd |-snort---{snort} |-squid---squid-+-18*[redirect_wrappe-+-squidGuard] | | `-squidclamav] | `-16*[{squid}] |-sshd---bash---pstree |-syslogd `-udevd Perhaps this helps somehow... Best, Matthias On 21.07.2016 13:28, Michael Tremer wrote: > On Thu, 2016-07-21 at 13:25 +0200, Matthias Fischer wrote: >> Hi, >>=20 >> I mentioned this earlier, but it seems that 'guardian' has some kind of >> memory leak? >=20 > Probably not a leak, but it seems that some used data is not freed. Maybe t= he > log files that guardian reads? >=20 >> It started about two days ago with ~14 MB RAM. Then it jumped to ~34 MB, >> then to ~48 MB - today it suddenly uses 71 MB. >=20 > Is this RSS or VIRT? >=20 >> And if I start it on my testmachine (offline!) it uses ~90 MB. >>=20 >> Can someone confirm? >>=20 >> Besides this, its working without seen problems. >>=20 >> Best, >> Matthias >>=20 >> On 20.07.2016 15:33, Stefan Schantl wrote: >> > Hello testers, >> >=20 >> > I've uploaded a new test version (003). >> >=20 >> > Update or fresh install works like described in the announcement mail. >> >=20 >> > The Changelog can be found here: >> >=20 >> > http://people.ipfire.org/~stevee/guardian-2.0/Changelog.txt >> >=20 >> > At the moment I'm missing feedback for the following functions: >> >=20 >> > * Manually blocking / unblocking addresses. >> > * Dealing with the ignore list. >> > * Owncloud message parser. >> > * Logrotate, there should be an corresponding log entry in the guardian >> > logfile after rotation of the logfiles have been done. >> > * Reload of the ignore list after "Red" has been reconnected. There >> > also a corresponding log entry should be logged to the logfile and the >> > new "Red-address" should also be logged as part of the ignore list (If >> > you own an dynamic assigned one). >> >=20 >> > As always please report your bugs or experience with the new version to >> > this list. >> >=20 >> > Best regards, >> >=20 >> > -Stefan >> >=20 >> > > Hello mailing list followers, >> > >=20 >> > > this is the official release announcement for the first beta release >> > > of >> > > the new Guardian 2.0 approach. >> > >=20 >> > >=20 >> > > - What are the differences to the current version of guardian >> > > (legacy) >> > > and the first approach of guardian 2.0? >> > >=20 >> > > The most important difference is, that the new version of Guardian >> > > 2.0 >> > > completely has been re-written from scratch and released under the >> > > terms of the GPLv3. The legacy version of guardian is not maintained >> > > anymore by it's developer and the software has been released without >> > > any license details at all. >> > >=20 >> > > Guardian 2.0 has a very modular code base and has been designed as a >> > > multi-threaded application. This allows a parallel parsing of all >> > > monitored logfiles and faster actions, if one of the used modules >> > > detects an attack. >> > >=20 >> > > A very important difference to the legacy version is the support of >> > > configuring and managing the entire service through the IPFire >> > > webinterface. The entire configuration, managing of current blocked >> > > hosts, unblocking them or editing the ignored hosts list now can be >> > > done in a graphical way.=20 >> > >=20 >> > > The legacy version of guardian only supported parsing snort alerts. >> > > HTTPD and SSH support has been patched by the IPFire development team >> > > some time ago. Guardian 2.0 supports all of them out of the box and >> > > includes a filter to detect owncloud login brute-force attempts. As a >> > > benefit of the new modular design, additional filters easily can be >> > > added. >> > >=20 >> > > Guardian 2.0 is able to reload it's configuration, reloading >> > > the ignore list during runtime and handle, if the logfiles will get >> > > rotated by logrotate. This actions can be called by using the >> > > webinterface or from the command line interface by using >> > > "guardianctrl". >> > >=20 >> > > These are just a handful of the changes and benefits which comes with >> > > Guardian 2.0, a complete list would be to long for this mailing list. >> > >=20 >> > >=20 >> > > - How to join testing? >> > >=20 >> > > To get part of the testing team, simple navigate to http://people.ipf >> > > ir >> > > e.org/~stevee/guardian-2.0/ and download the latest tarball >> > > (currently >> > > 002). Please take care to download the correct one, based on your >> > > used >> > > architecture. The i585 packages are for 32Bit installations of >> > > IPFire, >> > > the x86_64 packages only can be used on 64Bit installations. >> > >=20 >> > > Put the downloaded file on your IPFire test system and extract the >> > > package by using "tar -xvf guardian-2.0-002..tar.gz -C /". >> > >=20 >> > > The final installation step would be to regenerate the language cache >> > > by executing "update-lang-cache" on the console. >> > >=20 >> > > From now you can find a new menu item called "Guardian" in your >> > > "Service" menu after you have logged-in into your IPFire's >> > > webinterface. >> > >=20 >> > > Documentation can be found on the IPFire wiki: http://wiki.ipfire.org >> > > /e >> > > n/addons/guardian/start#the_guardian_20_addon >> > >=20 >> > >=20 >> > > - Where to post bugs reports or provide feedback? >> > >=20 >> > > If you find any bugs, please report them as usual on the IPFire >> > > bugtracker, which can be found at https://bugzilla.ipfire.org. >> > >=20 >> > > To provide feedback or to join a discussion, please send your mails >> > > to >> > > "development(a)lists.ipfire.org" (Please register first at http://lists >> > > .i >> > > pfire.org if not yet done). >> > >=20 >> > > The source code can be found at http://git.ipfire.org/?p=3Dpeople/steve >> > > e/ >> > > guardian.git;a=3Dsummary >> > >=20 >> > >=20 >> > > Happy testing, >> > >=20 >> > > -Stefan >> > >=20 >> >=20 >>=20 >=20 --===============4383818405263020112==--