SSHLOCKOUT(8)

NAME
sshlockout - utility to block port 22 on preauth failures

SYNOPSIS

    #
    # pf(4) configuration.
    #
    # in /etc/pf.conf
    #
    table <lockout> persist
    # and later in /etc/pf.conf - see below
    #
    block in quick on egress proto tcp from <lockout> to port ssh
    # in /etc/syslog.conf
    #
    auth.info;authpriv.info | exec /usr/bin/doas -n /usr/local/sbin/sshlockout -pf "lockout"
    # in root's crontab
    #
    3 3 * * *       pfctl -tlockout -T expire 86400

DESCRIPTION
This program is generally installed in /etc/syslog.conf as a pipe to parse the sshd(8) demons error log in realtime. In addition, a root crontab entry should generally be created to clean out stale entries in the pf(4) table at least once a day. Using expire instead of flush will maintain a rolling window of locked out IPs. pf(4) must be loaded and running with the table and rules properly configured.

This program will monitor the ssh syslog output and keep track of attempts to login to unknown users as well as preauth failures. If 5 attempts fail in any one hour period, a permanent entry is added to the pf(4) table for the associated IP address. You still have to add a rule to pf.conf(5) to block IP addresses listed in this table. The cron entry you create cleans the block list out typically once a day.

This program generally limits brute-force attempts to break into a machine via ssh.

When setting up the pf(4) rules, note that the table will be filled based on failed ssh connections destined to that particular machine. If the machine is acting as a router you can decide whether you want the pf(4) rule to lockout that suspect IP to just the machine, or to everything it routes to. We usually recommend an unconditional blocking rule.

NOTICE
This program is still a work in progress.

SEE ALSO
ssh(1), pf(4), syslog.conf(5), sshd(8)

HISTORY
The sshlockout utility first appeared in DragonFly 4.1.

AUTHORS
Matthew Dillon <dillon@backplane.com>