FreeBSD Manual Pages
SSHGUARD(8) SSHGuard Manual SSHGUARD(8) NAME sshguard - block brute-force attacks by aggregating system logs SYNOPSIS sshguard [-hv] [-a threshold] [-b threshold:blacklist_file] [-i pidfile] [-p blocktime] [-s detection_time] [-w address | whitelist_file] [file ...] DESCRIPTION sshguard protects hosts from brute-force attacks against SSH and other ser- vices. It aggregates system logs and blocks repeat offenders using one of several firewall backends. sshguard can monitor log files and the standard output of running a shell command. Log messages are parsed line-by-line for recognized attack pat- terns. Attackers are blocked when enough attack patterns are detected in a configurable time interval. Attackers are blocked temporarily but can also be permanently blocked using the blacklist option. sshguard must be configured before its first run. See sshguard-setup(7). OPTIONS -a threshold (default 30) Each detected attack increases an attacker's attack score, usually by 10. Block attackers when their attack score exceeds threshold. -b threshold:blacklist_file Blacklist an attacker when its attack score exceeds threshold. Blacklisted addresses are written to blacklist-file and never un- blocked, even after restarting sshguard. -i pidfile Write the PID of sshguard to pidfile. pidfile is removed when ssh- guard exits. -p blocktime (default 120) Block first-time attackers for blocktime seconds. Subsequent blocks increase in duration by a factor of 2. Since sshguard unblocks at- tackers at random intervals, actual block times may be somewhat longer. -s detection_time (default 1800) Reset an attacker's attack score after detection_time seconds since the last attack. This means that attackers who attack every detec- tion_time seconds are never blocked by sshguard. However, an in- creased detection_time may have an impact on legitimate users. [-w address | whitelist_file] Whitelist a single address, hostname, or address block given as ad- dress. This option can be given multiple times. Alternatively, pro- vide an absolute path to a whitelist_file containing addresses to whitelist. See WHITELISTING. -h Print usage information and exit. -v Print version information and exit. ENVIRONMENT SSHGUARD_USER When set, sandboxed processes drop permissions by changing to this user. Normally set and overridden in sshguard.conf using the SSH- GUARD_USER variable. SSHGUARD_DEBUG Set to enable verbose output from sshg-blocker. SSHGUARD_STATS_DIR When set, write Prometheus-compatible statistics to .prom files in this directory every minute. The STATS_DIR variable in sshguard.conf will set and override this environment variable. FILES %PREFIX%/etc/sshguard.conf See sample configuration file. WHITELISTING Whitelisted addresses are never blocked. Addresses can be specified on the command line or be stored in a file. On the command line, give the -w option one or more times with an IP ad- dress, CIDR address block, or hostname as an argument. Hostnames are re- solved once at startup. If a hostname resolves to multiple addresses, all of them are whitelisted. For example: sshguard -w 192.168.1.10 -w 192.168.0.0/24 -w friend.example.com -w 2001:0db8:85a3:0000:0000:8a2e:0370:7334 -w 2002:836b:4179::836b:0000/126 If the argument to -w begins with a forward slash ('/') or dot ('.'), the argument is treated as the path to a whitelist file. The whitelist file contains comments (lines beginning with '#'), addresses, address blocks, or hostnames, one per line. SEE ALSO sshguard-setup(7) 2.5.1 January 1, 2025 SSHGUARD(8)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | ENVIRONMENT | FILES | WHITELISTING | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=sshguard&manpath=FreeBSD+15.1-RELEASE+and+Ports>