DragonFly On-Line Manual Pages

Search: Section:  

SSHLOCKOUT(8)          DragonFly System Manager's Manual         SSHLOCKOUT(8)


NAME

     sshlockout -- utility to block port 22 on preauth failures


SYNOPSIS

     #
     # pf(4) configuration.
     #

     # in /etc/pf.conf
     #
     table <lockout> persist { }

     # and later in /etc/pf.conf - see below
     #
     block in quick on $ext_if proto tcp from <lockout> to any port 22

     # in /etc/syslog.conf
     #
     auth.info;authpriv.info          |exec /usr/sbin/sshlockout -pf "lockout"

     # in root's crontab
     #
     3 3 * * *       pfctl -tlockout -T expire 86400

     #
     # ipfw(8) configuration.
     #
     ipfw table 0 create
     ipfw add deny ip from '<0>' to any

     # in /etc/syslog.conf
     #
     auth.info;authpriv.info         |exec /usr/sbin/sshlockout -ipfwtbl 0

     # in root's crontab
     #
     3 3 * * *       ipfw -fq table 0 expire 86400


DESCRIPTION

     This program is generally installed in /etc/syslog.conf as a pipe to
     parse the sshd(8) demons error log in realtime.  In addition, a root
     crontab entry should generally be created to clean out stale entries in
     the pf(4) or ipfw(8) table at least once a day.  Using expire instead of
     flush will maintain a rolling window of locked out IPs.  The pf(4) or
     ipfw(8) module must be loaded and running with the table and rules
     properly configured.

     This program will monitor the ssh syslog output and keep track of
     attempts to login to unknown users as well as preauth failures.  If 5
     attempts fail in any one hour period, a permanent entry is added to the
     pf(4) or ipfw(8) table for the associated IP address.  You still have to
     add a rule to pf.conf(5) or use ipfw(8) to block IP addresses listed in
     this table.  The cron entry you create cleans the block list out
     typically once a day.

     This program generally limits brute-force attempts to break into a
     machine via ssh.

     When setting up the pf(4) or ipfw(8) rules, note that the table will be
     filled based on failed ssh connections destined to that particular
     machine.  If the machine is acting as a router you can decide whether you
     want the pf(4) or ipfw(8) rule to lockout that suspect IP to just the
     machine, or to everything it routes to.  We usually recommend an
     unconditional blocking rule.


NOTICE

     This program is still a work in progress.


SEE ALSO

     ssh(1), pf(4), syslog.conf(5), ipfw(8), sshd(8)


HISTORY

     The sshlockout utility first appeared in DragonFly 4.1.


AUTHORS

     Matthew Dillon <dillon@backplane.com>

DragonFly 5.3                 September 13, 2017                 DragonFly 5.3

Search: Section: