SSHGuard is a lightweight intrusion-prevention daemon that protects Unix-like hosts from brute-force attacks. It aggregates system logs, parses them for recognised attack patterns, and blocks repeat offenders at the firewall level through one of several backends — nftables, iptables, ipset, firewalld, PF, ipfw or IPFILTER. Written in portable C and Bourne shell in roughly 3,000 lines of code, it is small enough for embedded systems, simple enough to audit, and has been part of the BSD and Linux package sets for well over a decade.

Key Features

• Wide log ingestion — reads syslog, syslog-ng, systemd journal, metalog, multilog, the macOS log, cockpit, common-log-format web logs and plain log files, or the output of any shell command via a configurable log reader
• Compiled signature parser — attack signatures are compiled into a full lexical analyser (a deterministic finite-state machine) instead of regexes, so detection stays fast as signatures grow and crafted log lines cannot trigger regex denial-of-service
• Privilege separation — the parser runs as a separate, unprivileged process, sandboxed where the operating system supports it; only the small blocker component touches the firewall
• Seven firewall backends — nftables sets, iptables, ipset, firewalld, PF, ipfw and IPFILTER, with a hosts.allow fallback for systems without a usable firewall interface
• Temporary blocks by default — attackers are unblocked after a configurable time (120 seconds by default, doubling on repeat offences), so a false positive cannot lock you out permanently; permanent blacklisting is an opt-in second threshold that writes offenders to a blacklist file
• Sophisticated whitelisting — whitelist single addresses, CIDR blocks, hostnames or an entire whitelist file; loopback and private ranges are protected out of the box
• Full IPv6 support — attackers from both address families are blocked
• Tunable sensitivity — attack threshold, block time and detection window are all configurable on the command line or in sshguard.conf
• Attack signatures for many services — OpenSSH, Postfix, Exim, Dovecot, Cyrus, BIND, Gitea, OpenVPN, Proxmox VE, Microsoft SQL Server for Linux, plus generic HTTP 401 responses
• Prometheus metrics — since version 2.5.0 SSHGuard can emit Prometheus-compatible metrics for the attackers it blocks

Why Use SSHGuard?

Any internet-facing SSH or mail service collects thousands of login attempts a day; left alone those attempts fill your logs, waste CPU on password hashing and stay one weak credential away from a compromise. Blocking the source at the firewall removes all three problems at once. SSHGuard is one of the smallest tools that does this well: no database, no agent, no web interface and no cloud account — a config file and a service start. Its parser is deliberately sandboxed and built as a finite-state machine rather than a stack of regexes, the same design decision that makes it immune to the input-crafted CPU exhaustion that plagues naive log-scanning blockers. Blocks are reversible by default, and every major Linux and BSD distribution packages it, so there is nothing to build.

Use Cases

• Hardening a VPS or bare-metal server — put SSHGuard in front of sshd, Postfix, Dovecot or a web server login to cut noise and block repeat offenders automatically
• Constrained and embedded systems — routers, single-board computers and appliances where a 3,000-line C daemon fits but a heavier IPS does not
• BSD fleets — PF, ipfw and IPFILTER backends mean FreeBSD, OpenBSD, NetBSD and DragonFly BSD hosts are first-class citizens
• Existing firewall workflows — if you already manage nftables sets, ipsets or firewalld zones, SSHGuard slots into the rules you have instead of demanding its own
• Observability — feed the Prometheus metrics into your monitoring stack to alert on attack spikes

Platform

Linux · FreeBSD · OpenBSD · NetBSD · DragonFly BSD · macOS · Solaris

Licence

ISC (the OpenBSD licence, based on the ISC licence) — a permissive, BSD-style licence.

Website

sshguard.net · source: github.com/sshguard/sshguard