SSHLOCKOUT(8)

NAME
sshlockout - utility to block port 22 on preauth failures

SYNOPSIS
sshlockout table
auth.info;authpriv.info |exec /usr/local/sbin/sshlockout -pf lockout
3 3 * * * pfctl -tlockout -Tflush

DESCRIPTION
This program is generally installed in /etc/syslog.conf as a pipe to parse the sshd(8) demons error log in realtime. In addition, a root crontab entry should generally be created to clean out the pf(4) table at least once a day. The pf(4) module must be loaded and operational as well.

This program will monitor the ssh syslog output and keep track of attempts to login to unknown users as well as preauth failures. If 5 attempts fail in any one hour period, a permanent entry is added to the pf(4) table for the associated IP address. You still have to add a rule to pf.conf(5) to block IP addresses listed in this table. The cron entry you create cleans the block list out typically once a day.

This program generally limits brute-force attempts to break into a machine via ssh.

NOTICE
This program is still a work in progress.

SEE ALSO
ssh(1), pf(4), syslog.conf(5), sshd(8)

HISTORY
The sshlockout utility first appeared in DragonFly 4.1.

AUTHORS
Matthew Dillon <dillon@backplane.com>