Sshguard

sshguard is an intrusion prevention system. sshguard parses server logs, determines malicious activity, and then bans malicious users via firewall rules. sshguard is written in C so it does not tax an interprator.

How it works
The package is a simple daemon which continuously tracks one or more log files. It parses the log events that daemons send out in case of failed login attempts and then blocks any further attempts of those users by updating the system's firewall.

Unlike what the name implies, sshguard does not only parse SSH logs. It also supports many mail systems as well as a few FTP ones. A full listing of supported services can be found on the sshguard.net website.

Software
Install :

Also make sure that is installed and used as the system firewall. At the time of writing, sshguard does not support yet.

More information about using and configuring iptables can also be found on the Gentoo wiki.

Preparing the firewall
When sshguard blocks any malicious users (by blocking their IP addresses), it will use the  chain.

Prepare the chain, and make sure it is also triggered when new incoming connections are detected:


 * iptables -A INPUT -j sshguard}}

Watching logfiles
The basic idea behind sshguard is that the administrator passes on the log file(s) to watch as options to the application - there is no native sshguard configuration file.

On Gentoo, the options can be best configured in the file:

Make sure that the log files are accessible for the runtime user that sshguard uses.

Service
Have sshguard be started by default by adding it to the default runlevel, and then start it:

External resources
The sshguard documentation provides all the information needed to further tune the application.