Sshguard - Revision history

John3-16: Removed {{DISPLAYTITLE:SSHGuard}} as DISPLAYTITLE is not currently changing page title from Sshguard to SSHGuard (upstream name) - see discussion at Display title - amend to SSHGuard; otherwise, page appears under "Categories: Pages with ignored display titles".

2026-01-17T18:20:33Z

Removed {{DISPLAYTITLE:SSHGuard}} as DISPLAYTITLE is not currently changing page title from Sshguard to SSHGuard (upstream name) - see discussion at Display title - amend to SSHGuard; otherwise, page appears under "Categories: Pages with ignored display titles".

← Older revision		Revision as of 18:20, 17 January 2026
Line 1:		Line 1:
	~~{{DISPLAYTITLE:SSHGuard}}~~

	[https://www.sshguard.net/ SSHGuard] protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of several firewall backends, including '''iptables''' and '''nftables'''; SSHGuard also supports firewalls used elsewhere, including ipfw and pf.		[https://www.sshguard.net/ SSHGuard] protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of several firewall backends, including '''iptables''' and '''nftables'''; SSHGuard also supports firewalls used elsewhere, including ipfw and pf.

John3-16: 1. /* nftables backend */ Added subheading and amended context accordingly; 2. Amended page title from Sshguard to SSHGuard; 3. Style/grammar amendments, including clarification that ipfw and pf are not available on Alpine Linux.

2026-01-07T21:13:50Z

1. nftables backend: Added subheading and amended context accordingly; 2. Amended page title from Sshguard to SSHGuard; 3. Style/grammar amendments, including clarification that ipfw and pf are not available on Alpine Linux.

← Older revision		Revision as of 21:13, 7 January 2026
Line 1:		Line 1:
	~~[https~~://www.sshguard.net/ sshguard] protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of several firewall backends, including iptables, ipfw, and pf.		{{DISPLAYTITLE:SSHGuard}}

	sshguard ~~can read log messages from standard input (suitable for piping~~ from ~~syslog) or monitor one or more log files. Log messages are parsed, line-by~~-~~line, for recognized patterns~~. ~~If an attack, such as~~ several ~~login failures within a few seconds~~, ~~is detected~~, ~~the offending IP is blocked. Offenders are unblocked after a set interval, but can be semi-permanently banned using the blacklist option~~.		[https://www.sshguard.net/ SSHGuard] protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of several firewall backends, including '''iptables''' and '''nftables'''; SSHGuard also supports firewalls used elsewhere, including ipfw and pf.

	~~sshguard~~ does not support custom log parsing. Check the website ~~too~~ see which services they support.		SSHGuard can read log messages from standard input (suitable for piping from ''syslog'') or monitor one or more log files. Log messages are parsed, line-by-line, for recognized patterns. If an attack, such as several login failures within a few seconds, is detected, the offending IP is blocked. Offenders are unblocked after a set interval, but can be semi-permanently banned using the blacklist option.

			SSHGuard does not support custom log parsing. Check the website upstream to see which services they support.

	== Installation ==		== Installation ==

	~~Sshguard~~ can use several backends, you can see them with ~~<code>~~ls /usr/libexec/sshg-fw*~~</code>~~. The easiest backend on Alpine is nftables. After ~~you~~ install sshguard~~, you will need to create a config file or it won't start.~~		SSHGuard can use several backends; you can see them listed with {{ic\|$ ls /usr/libexec/sshg-fw*}}. The easiest backend on Alpine Linux is [[Nftables\|nftables]], but a section is given below for [[Iptables]] also. After either firewall has been installed, install {{Pkg\|sshguard}}:

	{{Cmd\|apk add sshguard ~~nftables~~}}		{{Cmd\|$ doas apk add sshguard}}

			You will need to create the following configuration file or else SSHGuard won't start.

	{{Cat\|/etc/sshguard.conf\|#!/bin/sh		{{Cat\|/etc/sshguard.conf\|#!/bin/sh
Line 16:		Line 20:
	}}		}}

	You can view the rules with ~~<code>nft list ruleset</code>~~		== nftables backend ==

			The nftables ruleset (tables and sets) required by SSHGuard are created dynamically with this SSHGuard daemon. You can view the rules that are active with:

	~~== Iptables backend ==~~		{{ic\|$ doas nft list ruleset}}

	~~To use the~~ iptables backend~~, you must first create a chain called "sshguard". Enable the iptables-service to save the rules at shutdown and reload them when booting~~		== iptables backend ==

	~~{{Cmd\|~~iptables -N sshguard		To use the '''iptables''' backend, you must first create a chain called "sshguard". Enable the iptables-service to save the rules at shutdown and reload them when booting
	iptables -~~A INPUT -j sshguard~~
	~~rc-update add iptables boot}}~~

	~~You can view the rules with <code>~~iptables -~~L</code>~~		{{Cmd\|$ doas iptables -N sshguard
			$ doas iptables -A INPUT -j sshguard
			$ doas rc-update add iptables boot}}

			You can view the rules with {{ic\|$ doas iptables -L}}

	[[category:Security]]		[[category:Security]]

ChTaube: iptables: Chain 'sshguard' has to be created first.

2024-04-17T18:13:41Z

iptables: Chain 'sshguard' has to be created first.

← Older revision		Revision as of 18:13, 17 April 2024
Line 22:		Line 22:
	To use the iptables backend, you must first create a chain called "sshguard". Enable the iptables-service to save the rules at shutdown and reload them when booting		To use the iptables backend, you must first create a chain called "sshguard". Enable the iptables-service to save the rules at shutdown and reload them when booting

	{{Cmd\|iptables -A INPUT -j sshguard		{{Cmd\|iptables -N sshguard
			iptables -A INPUT -j sshguard
	rc-update add iptables boot}}		rc-update add iptables boot}}

Sertonix: use pkg and cat template

2023-08-25T13:16:00Z

use pkg and cat template

← Older revision		Revision as of 13:16, 25 August 2023
Line 9:		Line 9:
	Sshguard can use several backends, you can see them with <code>ls /usr/libexec/sshg-fw*</code>. The easiest backend on Alpine is nftables. After you install sshguard, you will need to create a config file or it won't start.		Sshguard can use several backends, you can see them with <code>ls /usr/libexec/sshg-fw*</code>. The easiest backend on Alpine is nftables. After you install sshguard, you will need to create a config file or it won't start.

	apk add sshguard nftables		{{Cmd\|apk add sshguard nftables}}
	~~vi /etc/sshguard.conf~~

	#!/bin/sh		{{Cat\|/etc/sshguard.conf\|#!/bin/sh
	BACKEND='/usr/libexec/sshg-fw-nft-sets'		BACKEND{{=}}'/usr/libexec/sshg-fw-nft-sets'
	FILES='/var/log/messages'		FILES{{=}}'/var/log/messages'
			}}

	You can view the rules with <code>nft list ruleset</code>		You can view the rules with <code>nft list ruleset</code>
Line 22:		Line 22:
	To use the iptables backend, you must first create a chain called "sshguard". Enable the iptables-service to save the rules at shutdown and reload them when booting		To use the iptables backend, you must first create a chain called "sshguard". Enable the iptables-service to save the rules at shutdown and reload them when booting

	iptables -A INPUT -j sshguard		{{Cmd\|iptables -A INPUT -j sshguard
	rc-update add iptables boot		rc-update add iptables boot}}

	You can view the rules with <code>iptables -L</code>		You can view the rules with <code>iptables -L</code>

Innsill: + category:Security

2019-09-13T14:52:04Z

+ category:Security

← Older revision		Revision as of 14:52, 13 September 2019
Line 26:		Line 26:

	You can view the rules with <code>iptables -L</code>		You can view the rules with <code>iptables -L</code>


			[[category:Security]]

Bogon: Created page with "[https://www.sshguard.net/ sshguard] protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of..."

2019-05-05T19:26:24Z

Created page with "[https://www.sshguard.net/ sshguard] protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of..."

New page

[https://www.sshguard.net/ sshguard] protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of several firewall backends, including iptables, ipfw, and pf.

sshguard can read log messages from standard input (suitable for piping from syslog) or monitor one or more log files. Log messages are parsed, line-by-line, for recognized patterns. If an attack, such as several login failures within a few seconds, is detected, the offending IP is blocked. Offenders are unblocked after a set interval, but can be semi-permanently banned using the blacklist option.

sshguard does not support custom log parsing. Check the website too see which services they support.

== Installation ==

Sshguard can use several backends, you can see them with <code>ls /usr/libexec/sshg-fw*</code>. The easiest backend on Alpine is nftables. After you install sshguard, you will need to create a config file or it won't start.

apk add sshguard nftables
vi /etc/sshguard.conf

#!/bin/sh
BACKEND='/usr/libexec/sshg-fw-nft-sets'
FILES='/var/log/messages'

You can view the rules with <code>nft list ruleset</code>

== Iptables backend ==

To use the iptables backend, you must first create a chain called "sshguard". Enable the iptables-service to save the rules at shutdown and reload them when booting

iptables -A INPUT -j sshguard
rc-update add iptables boot

You can view the rules with <code>iptables -L</code>