Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have installed sshguard using homebrew on my Mac OS X machine, but would now like to get sshguard to startup automatically when the system starts up.

I've tried two approaches. Firstly I've tried creating a folder in /Library/StartupItems called sshguard, and created a standard StartupParameters.plist file along with a bash shell script file called sshguard. When I rebooted my machine however, sshguard was never running (I used ps -ax | grep sshguard to check).

The second approach was to create a file named net.sshguard.sshguard in /Library/LaunchDaemons/ with the following XML:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>KeepAlive</key>
  <true/>
  <key>Label</key>
  <string>net.sshguard.sshguard</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/sbin/sshguard</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>UserName</key>
  <string>matthew</string>
  <key>WorkingDirectory</key>
  <string>/usr/local/sbin</string>
</dict>
</plist>

Now when I run launchctl load -w /Library/LaunchDaemons/net.sshguard.sshguard.plist that appears to install the script OK as launchctl list shows that the Daemon script is installed. I then run launchctl start net.sshguard.sshguard and everything appears to be working.

However, when I run ps -ax | grep sshguard I can see that sshguard is not actually running. I've tried rebooting too, and when I then run launchctl list sshguard is not in the list.

If I run sshguard in debug mode SSHGUARD_DEBUG=true /usr/local/sbin/sshguard it appears that it works fine.

And I've checked the permissions of net.sshguard.sshguard.plist and they are the same as the other working files, effectively 775.

Can anyone help advise me on how to get sshguard to startup automatically on a Mac?

Thanks, Matt

share|improve this question

migrated from stackoverflow.com Aug 24 '11 at 19:42

This question came from our site for professional and enthusiast programmers.

add comment

3 Answers

up vote 3 down vote accepted

I was looking for a way to do this as well, and figured out why it wouldn't stay running: you need to specify the log file to monitor (assuming sshguard 1.5). Try this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>EnvironmentVariables</key>
    <dict>
        <key>SSHGUARD_DEBUG</key>
        <string>false</string>
    </dict>
    <key>KeepAlive</key>
    <true/>
    <key>Label</key>
    <string>net.sshguard.sshguard</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/sbin/sshguard</string>
        <string>-l</string>
        <string>/var/log/secure.log</string>
    </array>
    <key>QueueDirectories</key>
    <array/>
    <key>RunAtLoad</key>
    <true/>
    <key>WatchPaths</key>
    <array/>
</dict>
</plist>
share|improve this answer
    
@nighhwk1, you're a genius, that's worked perfectly. Thanks. –  Matthew O'Riordan Aug 30 '11 at 17:08
add comment

I've used this low tech and very-much-not-OS-X-stylish approach to start daemons on boot for OS X machines.

First create a script that starts your daemon for you, save it in /usr/local/sbin/. For example:

#!/bin/sh
# Make sure the system is really up before running this...
sleep 60s
# Export any environment variables you might need here...
#export SSHGUARD_DEBUG=true
# Start your daemon
/usr/local/sbin/sshguard

Make sure that script is executable:

sudo chmod 755 /usr/local/bin/start-sshguard

Test that it works from the command line like so:

sudo /usr/local/bin/start-sshguard

And now place an entry in to the root user's crontab that runs on system reboot:

sudo echo "@reboot root /usr/local/sbin/start-sshguard" >> /etc/crontab

It should start on system boot now without having to go through all that Launchd stuff to make it happen.

share|improve this answer
    
Thanks for your suggestion, but I'd really prefer to avoid a solution like this due to its "hackiness". Saying that, if I don't have any luck with a more generic solution, I'll be sure to give this a try and feedback here. Thanks again. –  Matthew O'Riordan Aug 25 '11 at 5:53
    
@Matthew the trouble is you're trying to squeeze a non-OS X daemon into OS X launch control semantics. Sometimes that doesn't work well. Just because it builds on OS X, doesn't mean it's OS X aware or friendly. Just BSD friendly. And the above method is BSD friendly. –  Ian C. Aug 25 '11 at 14:37
    
C, well launchctl didn't work, so I have tried our your solution. Very strangely, I think I've done everything right but it's not working either. I created the start-sshguard script and tested it using sudo, and it worked fine. I then added the line to the cron by running crontab -e and inserting the line "@reboot root /usr/local/sbin/start-sshguard" into the file. But when my machine starts up, and I ps -ax | grep sshguard I see that it's not running. Very odd, do you have any other ideas? Is there a way to see the log of what happened with the cron job? –  Matthew O'Riordan Aug 30 '11 at 9:53
    
First thing to check is root's mail box since any output from the cron job would have been delivered there. Try: sudo mail to read root's mail box. –  Ian C. Aug 30 '11 at 13:35
    
THanks @Ian C, there was an issue when I ran sudo mail, saying that the sh command root did not exist. So I changed the line "@reboot root /usr/local/sbin/start-sshguard" to "@reboot /usr/local/sbin/start-sshguard" and that seemed to work (in so much as that I no longer received mail messages on reboot" However, sshguard is still not running, and now I have no error messages. Any further ideas? –  Matthew O'Riordan Aug 30 '11 at 17:02
show 1 more comment

You don't seem to be doing anything wrong with your launchd property list (when you can get it to work, launchd is by far the best way to do this sort of thing on Mac OS X, by the way), but here are a couple of things to check:

  • Does user matthew have the necessary permissions for the working directory (/usr/local/sbin) (at least read and execute, possibly write if anything is output to the working directory)? Also, if you're

  • While we're on this, why are you setting the working directory to /usr/local/sbin? This is the directory the program will be run in. This does not need to be the same directory the program will be run from, given that you've specified the full path. Unless you know the program's going to manipulate files in locations relative to its current working directory (most dæmons don't - working directories are mainly a sop for us puny humans) you probably don't need to set this at all.

  • Have you had a look at the output of sudo launchctl list net.sshguard.sshguard? This should, at a minimum, give you the exit status of sshguard which may help you figure out why it's exiting.

  • Is sshguard one of these fork-then-exit programs that launches a dæmon in the background then returns you to your terminal? If so, you can't use it (directly) with the KeepAlive key - when it exits, launchd thinks it has quit, and tries to start it up again, which, depending on how sshguard handles this could cause problems. If sshguard is fork-then-exit, and you can figure out how it indicates to the fork that it's the actual dæmon (an extra parameter, or a slightly different command, for instance) use that directly with launchd. If you can't, don't use the KeepAlive key.

  • Finally, try setting things up with a GUI. I used to recommend Lingon here, but it's come over all Mac-App-Store-we-want-£3. You might be able to find one of the older versions or an alternative kicking around the internet, though. It'll make sure you haven't typed anything wrong and allow you to be certain you haven't put something in the wrong place (which the lack of automatic loading on reboot would suggest has happened, although what you describe doing seems right to me).

share|improve this answer
1  
In addition to the above, is sshguard owned by root and are its configuration files not readable and writable by the world? –  Matijs Aug 24 '11 at 21:28
    
Thanks so much for your feedback. As you have stated, I would really like to get this to work with launchctl, as opposed to hacking a work around for this. I've checked the permissions and everything is right, no files are written as far as I can tell. When I run the application manually i.e. /usr/local/sbin/sshguard, it works. I have removed the working directory. When I run the list net.sshguard.sshguard command everything looks fine, last exit code is 0. When launchctl list I see no PID indicating it's not started. sshguard does not fork. So without GUI, what else can I do? –  Matthew O'Riordan Aug 25 '11 at 5:52
    
I downloaded the GUI and tried that, and I get the same result unfortunately. Any further ideas? –  Matthew O'Riordan Aug 30 '11 at 9:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.