Sshguard/zh-cn

sshguard 是一种入侵防御系统. sshguard 解析服务器日志，检测恶意行为，然后通过防火墙规则禁止恶意用户登录. sshguard 是用 C 写的，因此不需要额外的解析器.

工作原理
sshguard 是一个持续跟踪一个或多个日志文件的守护进程. 它通过分析由失败的登录尝试引发的守护进程的日志活动，通过更新系统的防火墙阻止这些用户进一步的连接尝试.

不像名字暗示的那样， sshguard 不仅可以解析 SSH 日志. 它也支持多种邮件系统和一些 FTP 系统. 它支持的服务的详细列表可以在 sshguard.net 网站找到.

Emerge
安装 ：

然后确保安装了 并被用作系统防火墙. 截止到本文写作时间，sshguard 还不支持.

更多关于使用和配置 Iptables 的信息可以参阅 IPtables 文章.

准备防火墙
sshguard 会使用 sshguard 链阻止恶意用户（通过阻止他们的 IP 地址）.

准备 iptable 链，并确保当检测到新的进入的连接会被触发：

监控日志文件
sshguard 背后的基本思路是，不通过 sshguard 的内置的配置文件，而是由管理员将需要监控的日志文件作为参数传给程序.

在 Gentoo 上，参数可以通过 文件进行配置：

确保日志文件对于运行 sshguard 的用户是可读的.

OpenRC
把 sshguard 加入到默认的运行级别，然后启动：

Blacklisting hosts
With the blacklisting option after a number of abuses the IP address of the attacker will be blocked permanently. The blacklist will be loaded at each startup and extended with new entries during operation. inserts a new address after it exceeded a threshold of abuses.

Blacklisted addresses are never scheduled to be released (allowed) again.

The  command line option enables blacklisting and requires a filename to use for permanent storage of the blacklist. An optional threshold is configurable within the same argument. This threshold is then first, after which the filename is mentioned separated by.

To enable blacklisting, create an appropriate directory and file:

Add the blacklist file to the configuration and alter the SSHGUARD_OPTS variable:

Restart the daemon to have the changes take effect:

File '/var/log/auth.log' vanished while adding!
When starting up, sshguard reports the following error:

Such an error (the file path itself can be different) occurs when the target file is not available on the system. Make sure that it is created, or update the sshguard configuration to not add it for monitoring.

On a syslog-ng system with OpenRC, the following addition to can suffice:

Reload the configuration for the changes to take effect:

参考

 * Iptables, 在 Gentoo 上安装和配置 iptables

外部资源
sshguard 文档 提供了进一步优化的所有信息.