From de98e3dabd2b9a1b728955fe4e7727aac2c8407b Mon Sep 17 00:00:00 2001 From: jamesstout Date: Sun, 21 Apr 2013 07:29:48 +0800 Subject: [PATCH 01/11] change sed to perl for Solaris --- config/action.d/hostsdeny.conf | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf index b04f2adb..db36aa29 100644 --- a/config/action.d/hostsdeny.conf +++ b/config/action.d/hostsdeny.conf @@ -40,7 +40,11 @@ actionban = IP= && # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = IP= && sed -i.old /ALL:\ $IP/d +# Original: +#actionunban = IP= && sed -i.old /ALL:\ $IP/d + +# -i is not supported under Solaris 10/OpenSolaris +actionunban = IP= && perl -ne "print unless (/^ALL:\s$IP/)" -i [Init] From 10fcfb925dde8da606a7e2f841159675528cedb9 Mon Sep 17 00:00:00 2001 From: jamesstout Date: Sun, 21 Apr 2013 07:30:21 +0800 Subject: [PATCH 02/11] Extra patterns for Solaris --- config/filter.d/sshd.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index e4339c78..2c104073 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -27,11 +27,13 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* fro ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ ^%(__prefix_line)sFailed (?:password|publickey) for .* from (?: port \d*)?(?: ssh\d*)?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ + ^%(__prefix_line)s\[.*\] Failed keyboard-interactive for .* from (?: port \d*)?(?: ssh\d*)?$ ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from \s*$ ^%(__prefix_line)sUser .+ from not allowed because not listed in AllowUsers\s*$ ^%(__prefix_line)sUser .+ from not allowed because listed in DenyUsers\s*$ ^%(__prefix_line)srefused connect from \S+ \(\)\s*$ ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ + ^%(__prefix_line)s\[.*\] Received disconnect from .* Bye\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 578a8998c63f8133421668d2648a623e9ac8fd6a Mon Sep 17 00:00:00 2001 From: jamesstout Date: Sun, 21 Apr 2013 07:30:52 +0800 Subject: [PATCH 03/11] create socket/pid dir if needed Also remove any lingering sockets --- files/solaris-svc-fail2ban | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) mode change 100644 => 100755 files/solaris-svc-fail2ban diff --git a/files/solaris-svc-fail2ban b/files/solaris-svc-fail2ban old mode 100644 new mode 100755 index 9f75f9f6..e397474b --- a/files/solaris-svc-fail2ban +++ b/files/solaris-svc-fail2ban @@ -17,8 +17,26 @@ fi ENV="/usr/bin/env -i LANG=C PATH=/usr/local/bin:/usr/bin:/bin:/opt/sfw/bin:/usr/sfw/bin" +# get socket/pid conf and check dir exists +# sock and pid default dirs are currently the same +# mkdir if it doesn't exist +SOCK_FILE=$(sed "/^\#/d" "$F2B_CONF" | grep "socket" | tail -1 | cut -d "=" -f2-) +SOCK_DIR=$(dirname $SOCK_FILE) +if [ -n "$SOCK_DIR" ]; then + if [ ! -d "$SOCK_DIR" ]; then + mkdir "$SOCK_DIR" || exit 1 + fi +fi + case $1 in start) + # remove any lingering sockets + # don't quote the var for the -e test + if [ -n "$SOCK_FILE" ]; then + if [ -e $SOCK_FILE ]; then + rm -f $SOCK_FILE || exit 1 + fi + fi [ -f /etc/fail2ban.conf ] || touch /etc/fail2ban.conf echo "Starting fail2ban-server with $F2B_CONF" eval $ENV /usr/local/bin/fail2ban-client start & From 686f43caacf080eccbb5e1f7272975babd3fcd52 Mon Sep 17 00:00:00 2001 From: jamesstout Date: Sun, 21 Apr 2013 07:31:27 +0800 Subject: [PATCH 04/11] Readme for config on Solaris --- README.Solaris | 106 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 106 insertions(+) create mode 100644 README.Solaris diff --git a/README.Solaris b/README.Solaris new file mode 100644 index 00000000..b8883e7f --- /dev/null +++ b/README.Solaris @@ -0,0 +1,106 @@ +# vim:tw=80:ft=txt + +README FOR SOLARIS INSTALLATIONS + +By Roy Sigurd Karlsbakk + +ABOUT + +This readme is meant for those wanting to install fail2ban on Solaris 10, +OpenSolaris, OpenIndiana etc. To some degree it may as well be useful for +users of older Solaris versions and Nexenta, but don't rely on it. + +READ ME FIRST + +If I use the term Solaris, I am talking about any Solaris dialect, that is, the +official Sun/Oracle ones or derivates. If I describe an OS as +"OpenSolaris-based", it means it's either OpenSolaris, OpenIndiana or one of the +other, but /not/ the Nexenta family, since this only uses the OpenSolaris/ +IllumOS kernel and not the userland. If I say Solaris 10, I mean Solaris 10 and +perhaps, if you're lucky and have some good gods on your side, it may also apply +to Solaris 9 or even 8 and hopefully in the new Solaris 11 whenever that may be +released. Quoted lines of code, settings et cetera are indented with two spaces. +This does _not_ mean you should use that indentation, especially in config files +where they can be harmful. Optional settings are prefixed with OPT: while +required settings are prefixed with REQ:. If no prefix is found, regard it as a +required setting. + +INSTALLATION ON SOLARIS + +The installation is straight forward on Solaris as well as on linux/bsd/etc. +./setup.py install installs the general packages in /usr/bin on OpenSolaris- +based distros or (at least on this box) under /usr/sfw/bin on Solaris 10. In +the files/ directory you will find the file solaris-fail2ban.xml containing the +Solaris service. To install this, run the following command as root (or with +sudo): + + svccfg import files/solaris-fail2ban.xml + +This should normally without giving an error. If you get an error, deal with it, +and please post any relevant info (or fixes?) to the fail2ban mailing list. +Next install the service handler - copy the script in and allow it to be executed: + + cp files/solaris-svc-fail2ban /lib/svc/method/svc-fail2ban + chmod +x /lib/svc/method/svc-fail2ban + +CONFIGURE SYSLOG + +For some reason, a default Solaris installation does not log ssh login attempts, +and since fail2ban works by monitoring logs, enabling this logging is rather +important for it to work. To enable this, edit /etc/syslog.conf and add a line +at the end: + + auth.info /var/adm/auth.log + +Save the file and exit, and run + + touch /var/adm/auth.log + +The Solaris system logger will _not_ create a non-existing file. Now, restart +the system logger. + + svcadm restart system-log + +Try to ssh into localhost with ssh asdf@localhost and enter an invalid password. +Make sure this is logged in the above file. When done, you may configure +fail2ban. + +FAIL2BAN CONFIGURATION + +OPT: Edit /etc/fail2ban/fail2ban.conf and change logtarget to /var/adm/fail2ban.log +REQ: Edit /etc/fail2ban/jail.conf and move down to the [ssh-tcpwrapper] section. + Here, set enabled = true and logpath = /var/adm/auth.log. Set the sendmail + dest address to something useful or drop the line to stop it spamming you. + +START (OR RESTART) FAIL2BAN + +Enable the fail2ban service with + + svcadm enable fail2ban + +When done, check that all services are running well + + svcs -xv + +GOTCHAS AND FIXMES + +* It seems the installation may be starting fail2ban automatically. If this is + done, fail2ban will not start, but no errors will be returned from svcs + (above). Check if it's running with 'ps -ef | grep fail2ban' and manually kill + the PID if it is. Re-enable fail2ban and try again + + svcadm disable fail2ban + svcadm enable fail2ban + +* If svcs -xv says that fail2ban failed to start or svcs says it's in maintenance mode + chcek /var/svc/log/network-fail2ban:default.log for clues. + Check permissions on /var/adm, /var/adm/auth.log /var/adm/fail2ban.log and /var/run/fail2ban + You may need to: + + sudo mkdir /var/run/fail2ban + +* Fail2ban adds lines like these to /etc/hosts.deny: + + ALL: 1.2.3.4 + + wouldn't it be better to just block sshd? From b7795addd0958919fed3ee6b4c0f2a993e31cbd4 Mon Sep 17 00:00:00 2001 From: jamesstout Date: Tue, 30 Apr 2013 04:10:32 +0800 Subject: [PATCH 05/11] ENH: actionunban back to a sed command per https://github.com/fail2ban/fail2ban/pull/182#discussion_r3999128 --- config/action.d/hostsdeny.conf | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf index db36aa29..6f324e1e 100644 --- a/config/action.d/hostsdeny.conf +++ b/config/action.d/hostsdeny.conf @@ -40,11 +40,7 @@ actionban = IP= && # Tags: See jail.conf(5) man page # Values: CMD # -# Original: -#actionunban = IP= && sed -i.old /ALL:\ $IP/d - -# -i is not supported under Solaris 10/OpenSolaris -actionunban = IP= && perl -ne "print unless (/^ALL:\s$IP/)" -i +actionunban = IP= && sed /ALL:\ $IP/d > .new && mv .new [Init] From d2a953756802bd7cf63f5f5f792371f52f5cba8c Mon Sep 17 00:00:00 2001 From: jamesstout Date: Tue, 30 Apr 2013 04:14:36 +0800 Subject: [PATCH 06/11] ENH: extra daemon info regex for matching log lines like: Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2 this matches [ID 800047 auth.info] --- config/filter.d/common.conf | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf index 18bf41c5..d13b6adb 100644 --- a/config/filter.d/common.conf +++ b/config/filter.d/common.conf @@ -28,6 +28,10 @@ __pid_re = (?:\[\d+\]) # EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix) __daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:? +# extra daemon info +# EXAMPLE: [ID 800047 auth.info] +__daemon_extra_re = (?:\[ID \d+ \S+\]) + # Combinations of daemon name and PID # EXAMPLES: sshd[31607], pop(pam_unix)[4920] __daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:) @@ -43,5 +47,5 @@ __hostname = \S+ # # [hostname] [vserver tag] daemon_id spaces # this can be optional (for instance if we match named native log files) -__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s* +__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s%(__daemon_extra_re)s?\s* From 3367dbd987dada35438e0583bf0836133368bbf9 Mon Sep 17 00:00:00 2001 From: jamesstout Date: Tue, 30 Apr 2013 04:23:13 +0800 Subject: [PATCH 07/11] ENH: fail message matching for OpenSolaris and OS X - OpenSolaris keyboard message matched by new regex 3 - Removed Bye Bye regex per https://github.com/fail2ban/fail2ban/issues/175#issuecomment-16538036 - PAM auth failure or error and first char case-insensitive, can also have chars after the hostname. e.g. Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201 --- config/filter.d/sshd.conf | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 2c104073..8d98c675 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -23,17 +23,15 @@ _daemon = sshd # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from \s*$ +failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA](?:uthentication) (?:failure|error) for .* from .*$ ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ - ^%(__prefix_line)sFailed (?:password|publickey) for .* from (?: port \d*)?(?: ssh\d*)?\s*$ + ^%(__prefix_line)sFailed \S+ for .* from (?: port \d*)?(?: ssh\d*)?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ - ^%(__prefix_line)s\[.*\] Failed keyboard-interactive for .* from (?: port \d*)?(?: ssh\d*)?$ ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from \s*$ ^%(__prefix_line)sUser .+ from not allowed because not listed in AllowUsers\s*$ ^%(__prefix_line)sUser .+ from not allowed because listed in DenyUsers\s*$ ^%(__prefix_line)srefused connect from \S+ \(\)\s*$ ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ - ^%(__prefix_line)s\[.*\] Received disconnect from .* Bye\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 018913db6a840c1502df5630afcf371be0053ba1 Mon Sep 17 00:00:00 2001 From: jamesstout Date: Tue, 30 Apr 2013 04:24:56 +0800 Subject: [PATCH 08/11] ENH+TST: ssh failure messages for OpenSolaris and OS X --- testcases/files/logs/sshd | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd index 8e6c1273..e3e5c67e 100644 --- a/testcases/files/logs/sshd +++ b/testcases/files/logs/sshd @@ -29,5 +29,25 @@ Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but #8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47 Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers -# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648020 +#9 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648020 +# should this be removed? regex was removed in https://github.com/fail2ban/fail2ban/commit/bb7628591c124309774d5f4787d2a4f07cf6b906 Nov 8 11:19:38 bar sshd[25427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.6 + +#10 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182 +Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interactive for from 205.186.180.55 port 42742 ssh2 +Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2 + +#11 OSX syslog error +Apr 29 14:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from dusky via 192.168.1.201 +Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from n29.c07.mtsvc.net via 192.168.1.201 +Apr 29 20:11:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for from 205.186.180.35 port 42742 ssh2 +Apr 29 20:12:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.22 port 54520 ssh2 +Apr 29 20:13:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for james from 205.186.180.42 port 54520 ssh2 +Apr 29 20:14:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for from 205.186.180.44 port 42742 ssh2 +Apr 30 01:42:12 Jamess-iMac.local sshd[2554]: Failed keyboard-interactive/pam for invalid user jamedds from 205.186.180.77 port 33723 ssh2 +Apr 29 12:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication failure for james from 205.186.180.88 via 192.168.1.201 +Apr 29 13:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication failure for james from 205.186.180.99 via 192.168.1.201 +Apr 29 15:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication error for james from 205.186.180.100 via 192.168.1.201 +Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201 +Apr 29 17:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.102 +Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103 \ No newline at end of file From 86a5de040ba9bcee897fe5c2b1aaa0a0a695eb7c Mon Sep 17 00:00:00 2001 From: jamesstout Date: Tue, 30 Apr 2013 04:35:36 +0800 Subject: [PATCH 09/11] ENH: Use .local config files for logtarget and jail Per: https://github.com/fail2ban/fail2ban/pull/182#discussion_r3886353 --- README.Solaris | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/README.Solaris b/README.Solaris index b8883e7f..b03a31a1 100644 --- a/README.Solaris +++ b/README.Solaris @@ -67,10 +67,24 @@ fail2ban. FAIL2BAN CONFIGURATION -OPT: Edit /etc/fail2ban/fail2ban.conf and change logtarget to /var/adm/fail2ban.log -REQ: Edit /etc/fail2ban/jail.conf and move down to the [ssh-tcpwrapper] section. - Here, set enabled = true and logpath = /var/adm/auth.log. Set the sendmail - dest address to something useful or drop the line to stop it spamming you. +OPT: Create /etc/fail2ban/fail2ban.local containing: + +logtarget = /var/adm/fail2ban.log + + +REQ: Create /etc/fail2ban/jail.local containing: + +[ssh-tcpwrapper] + +enabled = true +filter = sshd +action = hostsdeny + sendmail-whois[name=SSH, dest=you@example.com] +ignoreregex = for myuser from +logpath = /var/adm/auth.log + +Set the sendmail dest address to something useful or drop the line to stop it spamming you. +Set 'myuser' to your username to avoid banning yourself or drop it. START (OR RESTART) FAIL2BAN From 0c2900e458f642ae2772526700c0888a187084bd Mon Sep 17 00:00:00 2001 From: jamesstout Date: Tue, 30 Apr 2013 05:41:29 +0800 Subject: [PATCH 10/11] BF: fail2ban.local needs section headers --- README.Solaris | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/README.Solaris b/README.Solaris index b03a31a1..49056062 100644 --- a/README.Solaris +++ b/README.Solaris @@ -69,6 +69,27 @@ FAIL2BAN CONFIGURATION OPT: Create /etc/fail2ban/fail2ban.local containing: +# Fail2Ban main configuration file +# +# Comments: use '#' for comment lines and ';' for inline comments +# +# Changes: in most of the cases you should not modify this +# file, but provide customizations in fail2ban.local file, e.g.: +# +# [Definition] +# loglevel = 4 +# +[Definition] + +# Option: logtarget +# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT. +# Only one log target can be specified. +# If you change logtarget from the default value and you are +# using logrotate -- also adjust or disable rotation in the +# corresponding configuration file +# (e.g. /etc/logrotate.d/fail2ban on Debian systems) +# Values: STDOUT STDERR SYSLOG file Default: /var/log/fail2ban.log +# logtarget = /var/adm/fail2ban.log From 932bd102fe4ce101013d58da6f1894555239fd58 Mon Sep 17 00:00:00 2001 From: jamesstout Date: Sat, 4 May 2013 18:38:05 +0800 Subject: [PATCH 11/11] ENH: Removed unused log line removed #9 per https://github.com/fail2ban/fail2ban/pull/182#discussion_r4068885 --- testcases/files/logs/sshd | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd index e3e5c67e..12d01022 100644 --- a/testcases/files/logs/sshd +++ b/testcases/files/logs/sshd @@ -13,7 +13,6 @@ Jan 5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM ::ffff:1.2.3.4 #4 Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213 - #5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch Mar 3 00:17:22 [sshd] User root from 210.188.220.49 not allowed because not listed in AllowUsers Feb 25 14:34:11 belka sshd[31607]: User root from ferrari.inescn.pt not allowed because not listed in AllowUsers @@ -29,15 +28,11 @@ Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but #8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47 Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers -#9 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648020 -# should this be removed? regex was removed in https://github.com/fail2ban/fail2ban/commit/bb7628591c124309774d5f4787d2a4f07cf6b906 -Nov 8 11:19:38 bar sshd[25427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.6 - -#10 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182 +#9 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182 Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interactive for from 205.186.180.55 port 42742 ssh2 Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2 -#11 OSX syslog error +#10 OSX syslog error Apr 29 14:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from dusky via 192.168.1.201 Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from n29.c07.mtsvc.net via 192.168.1.201 Apr 29 20:11:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for from 205.186.180.35 port 42742 ssh2