How to get sshguard to run at startup on a Mac

Question

I have installed sshguard using homebrew on my Mac OS X machine, but would now like to get sshguard to startup automatically when the system starts up.

I've tried two approaches. Firstly I've tried creating a folder in /Library/StartupItems called sshguard, and created a standard StartupParameters.plist file along with a bash shell script file called sshguard. When I rebooted my machine however, sshguard was never running (I used ps -ax | grep sshguard to check).

The second approach was to create a file named net.sshguard.sshguard in /Library/LaunchDaemons/ with the following XML:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>KeepAlive</key>
  <true/>
  <key>Label</key>
  <string>net.sshguard.sshguard</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/sbin/sshguard</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>UserName</key>
  <string>matthew</string>
  <key>WorkingDirectory</key>
  <string>/usr/local/sbin</string>
</dict>
</plist>

Now when I run launchctl load -w /Library/LaunchDaemons/net.sshguard.sshguard.plist that appears to install the script OK as launchctl list shows that the Daemon script is installed. I then run launchctl start net.sshguard.sshguard and everything appears to be working.

However, when I run ps -ax | grep sshguard I can see that sshguard is not actually running. I've tried rebooting too, and when I then run launchctl list sshguard is not in the list.

If I run sshguard in debug mode SSHGUARD_DEBUG=true /usr/local/sbin/sshguard it appears that it works fine.

And I've checked the permissions of net.sshguard.sshguard.plist and they are the same as the other working files, effectively 775.

Can anyone help advise me on how to get sshguard to startup automatically on a Mac?

Thanks, Matt

Answer 1

I was looking for a way to do this as well, and figured out why it wouldn't stay running: you need to specify the log file to monitor (assuming sshguard 1.5). Try this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>EnvironmentVariables</key>
    <dict>
        <key>SSHGUARD_DEBUG</key>
        <string>false</string>
    </dict>
    <key>KeepAlive</key>
    <true/>
    <key>Label</key>
    <string>net.sshguard.sshguard</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/sbin/sshguard</string>
        <string>-l</string>
        <string>/var/log/secure.log</string>
    </array>
    <key>QueueDirectories</key>
    <array/>
    <key>RunAtLoad</key>
    <true/>
    <key>WatchPaths</key>
    <array/>
</dict>
</plist>

Answer 2

I've used this low tech and very-much-not-OS-X-stylish approach to start daemons on boot for OS X machines.

First create a script that starts your daemon for you, save it in /usr/local/sbin/. For example:

#!/bin/sh
# Make sure the system is really up before running this...
sleep 60s
# Export any environment variables you might need here...
#export SSHGUARD_DEBUG=true
# Start your daemon
/usr/local/sbin/sshguard

Make sure that script is executable:

sudo chmod 755 /usr/local/bin/start-sshguard

Test that it works from the command line like so:

sudo /usr/local/bin/start-sshguard

And now place an entry in to the root user's crontab that runs on system reboot:

sudo echo "@reboot root /usr/local/sbin/start-sshguard" >> /etc/crontab

It should start on system boot now without having to go through all that Launchd stuff to make it happen.

Answer 3

You don't seem to be doing anything wrong with your launchd property list (when you can get it to work, launchd is by far the best way to do this sort of thing on Mac OS X, by the way), but here are a couple of things to check:

• Does user matthew have the necessary permissions for the working directory (/usr/local/sbin) (at least read and execute, possibly write if anything is output to the working directory)? Also, if you're

• While we're on this, why are you setting the working directory to /usr/local/sbin? This is the directory the program will be run in. This does not need to be the same directory the program will be run from, given that you've specified the full path. Unless you know the program's going to manipulate files in locations relative to its current working directory (most dæmons don't - working directories are mainly a sop for us puny humans) you probably don't need to set this at all.

• Have you had a look at the output of sudo launchctl list net.sshguard.sshguard? This should, at a minimum, give you the exit status of sshguard which may help you figure out why it's exiting.

• Is sshguard one of these fork-then-exit programs that launches a dæmon in the background then returns you to your terminal? If so, you can't use it (directly) with the KeepAlive key - when it exits, launchd thinks it has quit, and tries to start it up again, which, depending on how sshguard handles this could cause problems. If sshguard is fork-then-exit, and you can figure out how it indicates to the fork that it's the actual dæmon (an extra parameter, or a slightly different command, for instance) use that directly with launchd. If you can't, don't use the KeepAlive key.

• Finally, try setting things up with a GUI. I used to recommend Lingon here, but it's come over all Mac-App-Store-we-want-£3. You might be able to find one of the older versions or an alternative kicking around the internet, though. It'll make sure you haven't typed anything wrong and allow you to be certain you haven't put something in the wrong place (which the lack of automatic loading on reboot would suggest has happened, although what you describe doing seems right to me).