_Quick install instructions for sshdfilter_

For the brave (as this is not so tested), run:
./install.pl
and read below, steps 5 onwards.

Or manually install with:
1.
run 
./regen.sh
to recreate distribution specific filters from sshdfilter.base

2.
copy etc/sshdfilterrc to /etc
and edit to suit you

3.
copy sshdfilter.<your distro> to /usr/sbin/sshdfilter, or maybe /usr/local/sbin/
sshdfilter
 rh7390 - RedHat 7.3 and RedHat 9.0
 rhFC30 - RedHat Fedora Core 3.0, or CentOS
  deb31 - Debian 3.1 (sarge)
su10rc1 - SuSe 10.0 RC 1

4.
Modify the startup script /etc/init.d/sshd to run sshdfilter instead of sshd, ex
amples are in etc/init.d/

5.
If your system uses LogWatch, you can find parsing scripts in etc/log.d/. Note t
hey are setup for a RedHat system that logs sshd (and so sshdfilter) output to /
var/log/secure, your distro probably sends the output to another file, such as /
var/log/auth.log for Debian. You need a recent (6.1.x) version of LogWatch to us
e these LogWatch scripts. sshd logging works as it used to, sshdfilter always lo
gs sshd output regardless of it triggering sshdfilter to do some action. The Log
Watch scripts consist of two files, you might also need to add 'sshdfilt' to /et
c/log.d/conf/services/secure.conf (or similar, try 'grep "sshd " /etc/log.d/conf
' to find mentions of sshd, sshdfilt should be there too), to tell the other scr
ipts about sshdfilter.

6.
Add the SSHD chain to your firewall setup, typically (/etc/sysconfig/iptables st
yle):
:SSHD - [0:0]
or bash:
iptables -N SSHD

Add a jump to SSHD rule with something like (/etc/sysconfig/iptables style):
-A INPUT -p tcp -m tcp --dport 22 -j SSHD
or bash:
iptables -A INPUT -p tcp -m tcp --dport 22 -j SSHD

This is only an example, I've no idea how you set up your iptables. Generally yo
u'll have a line that 
ACCEPTS ssh(port 22), and the above should go on the line before.

7.
Restart sshd via sshdfilter, normally with:
/etc/init.d/sshd restart
and check the process tree with:
pstree -pul | less -S
(use the cursor keys to move about, q quits)
This should show sshdfilter, with two children, sshdfilter and sshd. Now ssh log
ins will appear as children of this sshd - which is how sshd has always worked.

8.
Exceptions to the usual sshdfilter blocking rules can be made with iptables. If 
triggered, sshdfilter will say that a given IP is blocked, but an iptables rule 
before the SSHD jump rule will avoid any blocks. This will be useful if you have
 trusted IP addresses that will never attack your system.

9.
Post Install:
Inform the users of what happens if they try to many password guesses.

For yourself, you could install webmin and webmin-iptables, for non-ssh remote a
ccess. So if you lock yourself out of your machine, you have another route in. O
f course, this opens up another way into your system for others, so maybe you'd 
be better off running another sshd on an obscure port.


