Shieldlist

ssh Gratuit

SSH brute force in every shape — wrong passwords, connections dropped inside authentication, invalid banners — counted together in one jail

Catégorie
ssh
Seuil
3/1m, 5/24h, 10/30d
Politique de ban
ssh
Signalement
ssh-brute-force
Parseurs
ssh-auth-fail ssh-preauth-abort ssh-auth-abandoned ssh-auth-timeout ssh-banner-invalid

Pourquoi elle est écrite ainsi

SSH brute force — the one jail for sshd, whichever way it words a failed
attempt: a wrong password (a host that takes passwords), a connection
dropped or reset in authentication (the only trace a key-only host
writes), or a client that never got past the banner. One event, one
hit: the "Invalid user" line is NOT scored — the same attempt writes a
Failed password (or a preauth close) right after it. A connection that
tries N passwords then drops counts N+1: the tries and the drop.

Thresholds are the point: a brute force is judged over time, not ten
minutes — the short window catches the loud one (3 in a minute), the
day the patient one (5 in 24 hours), the month the one that comes back
(10 in 30 days: the long memory punishes durably — Robin, 2026-09-07).
Nobody legitimate fails three times in a minute, nor ten times in a
month, on a server they administer. Was [3/5m, 10/6h].

Le fichier de la règle Voir le brut

# SSH brute force — the one jail for sshd, whichever way it words a failed
# attempt: a wrong password (a host that takes passwords), a connection
# dropped or reset in authentication (the only trace a key-only host
# writes), or a client that never got past the banner. One event, one
# hit: the "Invalid user" line is NOT scored — the same attempt writes a
# Failed password (or a preauth close) right after it. A connection that
# tries N passwords then drops counts N+1: the tries and the drop.
#
# Thresholds are the point: a brute force is judged over time, not ten
# minutes — the short window catches the loud one (3 in a minute), the
# day the patient one (5 in 24 hours), the month the one that comes back
# (10 in 30 days: the long memory punishes durably — Robin, 2026-09-07).
# Nobody legitimate fails three times in a minute, nor ten times in a
# month, on a server they administer. Was [3/5m, 10/6h].
rule: ssh
description: "SSH brute force in every shape — wrong passwords, connections dropped inside authentication, invalid banners — counted together in one jail"
about:
  purpose: >-
    Keep password guessers off the SSH port before one of them finds an account whose password is weak.
  blocks: >-
    Refused SSH logins from one address: three in a minute, five in a day, ten in a month — and the ban lengthens each time it comes back.
  applies_to: >-
    Any machine running OpenSSH, whether or not it accepts passwords: a key-only host still logs every attempt.
  requires:
    - >-
      sshd's own log, declared as `log: ssh` — /var/log/auth.log on Debian and Ubuntu, /var/log/secure on RHEL and its family.
  beware:
    - >-
      A colleague with a stale key or an expired password collects three refusals in a minute as fast as a bot does. Exempt the addresses your team works from before you arm this.
category: ssh
parsers:
  - ssh-auth-fail
  - ssh-preauth-abort
  - ssh-auth-abandoned
  - ssh-auth-timeout
  - ssh-banner-invalid
# levels are the machine's — strict halves these numbers, lenient doubles them, instant is the first hit
threshold: [3/1m, 5/24h, 10/30d]
ban: ssh
report: ssh-brute-force