SSHLOCKOUT(8)

NAME
sshlockout - utility to block port 22 on preauth failures

SYNOPSIS

    #
    # pf(4) configuration.
    #
    # in /etc/pf.conf
    #
    table <lockout> persist { }
    # and later in /etc/pf.conf - see below
    #
    block in quick on $ext_if proto tcp from <lockout> to any port 22
    # in /etc/syslog.conf
    #
    auth.info;authpriv.info          |exec /usr/sbin/sshlockout -pf "lockout"
    # in root's crontab
    #
    3 3 * * *       pfctl -tlockout -T expire 86400
    #
    # ipfw(8) configuration.
    #
    ipfw table 0 create
    ipfw add deny ip from '<0>' to any
    # in /etc/syslog.conf
    #
    auth.info;authpriv.info         |exec /usr/sbin/sshlockout -ipfwtbl 0
    # in root's crontab
    #
    3 3 * * *       ipfw -fq table 0 expire 86400

DESCRIPTION
This program is generally installed in /etc/syslog.conf as a pipe to parse the sshd(8) demons error log in realtime. In addition, a root crontab entry should generally be created to clean out stale entries in the pf(4) or ipfw(8) table at least once a day. Using expire instead of flush will maintain a rolling window of locked out IPs. The pf(4) or ipfw(8) module must be loaded and running with the table and rules properly configured.

This program will monitor the ssh syslog output and keep track of attempts to login to unknown users as well as preauth failures. If 5 attempts fail in any one hour period, a permanent entry is added to the pf(4) or ipfw(8) table for the associated IP address. You still have to add a rule to pf.conf(5) or use ipfw(8) to block IP addresses listed in this table. The cron entry you create cleans the block list out typically once a day.

This program generally limits brute-force attempts to break into a machine via ssh.

When setting up the pf(4) or ipfw(8) rules, note that the table will be filled based on failed ssh connections destined to that particular machine. If the machine is acting as a router you can decide whether you want the pf(4) or ipfw(8) rule to lockout that suspect IP to just the machine, or to everything it routes to. We usually recommend an unconditional blocking rule.

NOTICE
This program is still a work in progress.

SEE ALSO
ssh(1), pf(4), syslog.conf(5), ipfw(8), sshd(8)

HISTORY
The sshlockout utility first appeared in DragonFly 4.1.

AUTHORS
Matthew Dillon <dillon@backplane.com>