This is the readme file for ssh-scanguard

What is it:
ssh-scanguard is designed to short-circuit automated ssh login attempts by
blocking the source IP address for failed attempts.

How it works:
The program reads the system log file, /var/log/messages, on stdin and updates
a data file, /usr/local/etc/ssh-scanguard/data, for every failed ssh login attempt.
The data file is then referenced by /etc/hosts.deny which sshd consults for new connections.

The program is meant to be run with the daemontools supervise utility.

Install:

Edit the make file to decide where to place the script, the data directory,
and to identify the base supervise directory.

The values default to: /usr/local/bin, /usr/local/etc/ssh-scanguard, and /service


To install, type (as root)
  
  # make install

To link to the supervise directory, type

  # make service

Start the service

  # svc -u /service/ssh-scanguard

Add the following line to /etc/hosts.deny
  
  sshd: /usr/local/etc/ssh-scanguard/data

  
Enjoy!

-Gyepi Sam
