<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Oops - forgot to CC the list again.</div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""></div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Marius,<div class=""><br class=""></div><div class="">If I remember correctly I was using a development version for a while - it may have been when macOS moved to unified logging.</div><div class=""><br class=""></div><div class="">In /usr/local/<span style="background-color: rgb(255, 255, 255);" class="">sshguard.conf I </span>use:</div><div class=""><br class=""></div><div class="">LOGREADER="/usr/bin/log stream --style syslog --info --type log --predicate 'processImagePath == \"/usr/sbin/sshd\" or processImagePath contains \"dovecot\" or processImagePath contains \"postfix/smtpd\”'"</div><div class=""><br class=""></div><div class="">I know I can log to a file with postfix and dovecot but I like to have postfix, opendkim, opendmarc, pypolicyd-spf and amavis logs in a single file so use unified logging. I capture the log info every 10 minutes and write it to a mail.log file.</div><div class=""><br class=""></div><div class="">I also keep a sshguard blacklist and use a Murus table as the backend.</div><div class=""><br class=""></div><div class="">Murus is also the backend for fail2ban which I use to monitor http access.</div><div class=""><br class=""></div><div class="">The MacPorts version doesn’t offer the same flexibility.</div><div class=""><br class=""></div><div class="">Steve<br class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On 5 Mar 2022, at 01:40, Marius Schamschula <<a href="mailto:lists@schamschula.com" class="">lists@schamschula.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Steve,<div class=""><br class=""></div><div class="">I curious, why you are building sshguard from source, rather than using the MacPorts port.</div><div class=""><br class=""><div class="">
<div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Marius</div><div class="">--</div><div class="">Marius Schamschula</div><div class=""><br class=""></div></div></div></div></div></div></blockquote></div><br class=""></div></div></body></html>