Sshguard/zh-cn

sshguard 是一种入侵防御系统. sshguard 解析服务器日志，检测恶意行为，然后通过防火墙规则禁止恶意用户登录. sshguard 是用 C 写的，因此不需要额外的解析器.

工作原理
sshguard 是一个持续跟踪一个或多个日志文件的守护进程. 它通过分析由失败的登录尝试引发的守护进程的日志活动，通过更新系统的防火墙阻止这些用户进一步的连接尝试.

不像名字暗示的那样， sshguard 不仅可以解析 SSH 日志. 它也支持多种邮件系统和一些 FTP 系统. 它支持的服务的详细列表可以在 sshguard.net 网站找到.

Emerge
安装 ：

Additional software
Depending on the init system and the desired firewall backend to be used by sshguard, additional software may be required to be emerged in order for sshguard to block malicious actors.

More information on various supported backends can be found by reading the setup manpage:

iptables
然后确保安装了 并被用作系统防火墙. 截止到本文写作时间，sshguard 还不支持.

更多关于使用和配置 Iptables 的信息可以参阅 IPtables 文章.

nftables
When nftables are being used as the system firewall:

准备防火墙
sshguard 会使用 sshguard 链阻止恶意用户（通过阻止他们的 IP 地址）.

准备 iptable 链，并确保当检测到新的进入的连接会被触发：

Then verify that the appropriate path to the iptables backend library is set in :

监控日志文件
sshguard 背后的基本思路是，不通过 sshguard 的内置的配置文件，而是由管理员将需要监控的日志文件作为参数传给程序.

在 Gentoo 上，参数可以通过 文件进行配置：

确保日志文件对于运行 sshguard 的用户是可读的.

OpenRC
把 sshguard 加入到默认的运行级别，然后启动：

systemd
Use systemd's conventional way to enable it, and then start it:

Blacklisting hosts
With the blacklisting option after a number of abuses the IP address of the attacker or a IP subnet will be blocked permanently. The blacklist will be loaded at each startup and extended with new entries during operation. inserts a new address after it exceeded a threshold of abuses.

Blacklisted addresses are never scheduled to be released (allowed) again.

To enable blacklisting, create an appropriate directory and file:

While defining a blacklist it is important to exclude trusted IP networks and hosts in a whitelist.

To enable whitelisting, create an appropriate directory and file:

The whitelist has to include the loopback interface, and should have at least 1 IP trusted network f.e. 192.0.2.0/24.

Add the BLACKLIST_FILE and WHITELIST_FILE file to the configuration. Example configuration listed blocks all hosts after the first login attempt. To setup a less agressive blocking policy, adjust the THRESHOLD and BLACKLIST_FILE integer, and set it to f.e. 10 instead of 2:

Restart the daemon to have the changes take effect:

File '/var/log/auth.log' vanished while adding!
When starting up, sshguard reports the following error:

Such an error (the file path itself can be different) occurs when the target file is not available on the system. Make sure that it is created, or update the sshguard configuration to not add it for monitoring.

On a syslog-ng system with OpenRC, the following addition to can suffice:

Reload the configuration for the changes to take effect:

外部资源
sshguard 文档 提供了进一步优化的所有信息.