BlockSSHD is a Perl script based on BruteForceBlocker v1.2.3 that dynamically adds IPTables rules for Linux and pf firewall rules for BSD that block SSH brute force attacks. It can also detect ProFTPd login failures.
BlockSSHD checks a log file you specify, for example /var/log/secure on a Red Hat, for SSH login failure messages. If it detects a failure message it records the source IP address and starts a counter. If messages continue to be detected from the same source IP address the counter is incremented for each message. When the counter reaches a user-specified threshold then the script will add a firewall rule blocking SSH connections from that source IP address. A user-specified time-out is also defined to trigger a reset of the counter. If the counter is incremented but has not yet reached the blocking threshold and a new login failure message arrives then BlockSSHD checks the time-out. If the last increment of the counter occurred earlier than the current time minus the time-out period then the counter is reset rather than incremented. The time-out defaults to 600 seconds (10 minutes).
The BlockSSHD script can unblock IP address after a period. This is enabled in the blocksshd.conf configuration file using the unblock option and with the period set using the unblock_timeout option.
The BlockSSHD script can also log the IP addresses blocked to a file and re-apply these blocked IP addresses when the script is re-started. This allows you to restore previously blocked IP addresses after a restart or when your firewall rules are flushed.
The BlockSSHD script has some command line options:
*) -d | --daemon | --start - Runs the script as a daemon
*) --stop - Stops the script
*) -h | --help - Prints help text
*) -v | --version - Print the version
Running the BlockSSHD script without any command line options will start it interactively.
You will also find a Red Hat style init script in the init directory in the distribution package.
For installation instructions see the INSTALL file in the distribution package.
You can download BlockSSHD here.
Please feel free to email me with any issues
Copyright 2006, James Turnbull
Support for pf added by Anton - valqk@webreality.org - www.webreality.org
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA