SSHGuard is an intrusion prevention system that parses server logs, determines malicious activity, and uses the system firewall to block the IP addresses of malicious connections.
SSHGuard protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of several firewall backends, including iptables, ipfw, and pf.
The software runs on a machine as a small daemon, and receives log messages (in a number of ways, e.g. from syslog). When it determines that address X did something bad to service Y, it fires a rule in the machine’s firewall (one of the many supported) for blocking X.
SSHGuard keeps X blocked for some time, then releases it automatically.
Key Features
- Easy to set up, simple one-line command to use
- Touchiness and automatic blacklisting.
- Full IPv6 support.
- Monitor multiple log files at once and handles log rotation and temporary log files automatically.
- Small system footprint.
- Sophisticated whitelisting.
- Recognizes many logging formats transparently.
- Handles host names or addresses in log files.
- Supports the following log formats: cockpit, Common Log Format, macOS log , metalog, multilog, raw log files, syslog, syslog-ng, and systemd journal
- Recognizes attacks against: OpenSSH, Sendmail, Exim, Dovecot, Cucipop, UWimap (IMAP, POP), vsftpd, Postfix, proftpd, pure-ftpd, and FreeBSD ftpd.
- Integrates with the following firewall backends: FirewallID, ipfw, IPFILTER, netfilter/iptables, netfilter/ipset, PF, tcpd’s host.allow, and IBM AIX’s firewall.
- Simple, extensible firewall interface.
Website: www.sshguard.net
Support: Documentation, SourceForge Project Site, Git repository
Developer: Mij
License: BSD License
SSHGuard is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Intrusion Prevention for SSH | |
|---|---|
| Fail2Ban | Intrusion prevention software framework written in Python |
| CrowdSec | Modern and collaborative behavior detection engine |
| SSHGuard | Protects hosts from brute-force attacks against SSH and other services |
| denyhosts | Helps thwart SSH server attacks |
| IPBan | Detects repeated failed logins |
| CSF | ConfigServer Security & Firewall |
| reaction | Daemon that scans program outputs for repeated patterns, and takes action |
| BFD | Log-based security tool that detects authentication failures |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.