{"id":17627,"date":"2015-09-10T14:46:51","date_gmt":"2015-09-10T19:46:51","guid":{"rendered":"https:\/\/secure.rosehosting.com\/blog\/?p=17627"},"modified":"2022-12-13T04:29:47","modified_gmt":"2022-12-13T10:29:47","slug":"how-to-install-sshguard-on-an-ubuntu-vps","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/how-to-install-sshguard-on-an-ubuntu-vps\/","title":{"rendered":"How to install SSHGuard on an Ubuntu VPS"},"content":{"rendered":"
SSHGuard is very useful monitoring tool for preventing brute force attacks. SSHGuard reads log messages from standard input and determines malicious activities. If an attack is detected, the attacking IP address is immediately blocked in the firewall. In this article we will guide you through the steps of installing SSHGuard on an Ubuntu VPS<\/a> and protecting your server against brute-force attacks.Excepts the SSH service as the name suggests, SHSGuard can also protect many services out of the box. Listed below are all services that can be protected by SSHGuard:<\/p>\n Log in to your server as user root<\/p>\n Before proceeding any further it is best to start a screen session by executing the following command<\/p>\n We will need to compile and install SSHGuard from source, so install the necessary packages<\/p>\n Make sure that all packages on your Ubuntu server are up to date<\/p>\n Now, Change the current working directory and download the latest SSHGuard source to your server<\/p>\n Unpack the downloaded archive<\/p>\n All SSHGuard files will be unpacked in a new ‘sshguard-1.5’ directory. Go inside that directory and compile and install the source<\/p>\n This will install the sshguard binary on your server.<\/p>\n SSHGuard does not have its own configuration file so we need to configure it with Iptables. First of all create a new chain in iptables so SSHGuard can insert its blocking rules<\/p>\n Now update the INPUT chain to pass the traffic to the sshguard chain created in the previous step. This will tell iptables to block all traffic from the offending IP addresses<\/p>\n If you want to block the offending IP addresses only for a specific service such as SSH, pop, imap, ftp, etc… you can use the multiport iptables module. For example, if you want to block the traffic for the FTP service you can use the following command<\/p>\n You can also block the offending IP addresses for multiple servives using the following command<\/p>\n This rule will block the traffic for the SSH, mail and FTP services.<\/p>\n Once you configure iptables to block all services that you need, save the iptables configuration<\/p>\n That’s all. You can visit SSHGuard’s official documentation to learn how to configure SSHGuard according to your needs.<\/p>\n Of course you don\u2019t have to do any of this if you use one of our Ubuntu Web Hosting<\/a> services, in which case you can simply ask our expert Linux admins to install SSHGuard for you. They are available 24\u00d77 and will take care of your request immediately.<\/p>\n PS.<\/strong><\/span> If you liked this post please share it with your friends on the social networks using the buttons on the left or simply leave a reply below. Thanks.<\/p>\n","protected":false},"excerpt":{"rendered":" SSHGuard is very useful monitoring tool for preventing brute force attacks. SSHGuard reads log messages from standard input and determines … <\/p>\n\n
ssh root@IP<\/pre>\n
screen -U -S sshguard<\/pre>\n
apt-get install gcc make<\/pre>\n
apt-get update\r\napt-get upgrade<\/pre>\n
cd \/opt\r\nwget http:\/\/downloads.sourceforge.net\/project\/sshguard\/sshguard\/sshguard-1.5\/sshguard-1.5.tar.bz2<\/pre>\n
bunzip2 sshguard-1.5.tar.bz2\r\ntar -xvf sshguard-1.5.tar<\/pre>\n
cd sshguard-1.5\r\n.\/configure \u2013with-firewall=iptables\r\nmake && make install<\/pre>\n
iptables -N sshguard<\/pre>\n
iptables -A INPUT -j sshguard<\/pre>\n
iptables -A INPUT -m multiport -p tcp --destination-ports 21 -j sshguard<\/pre>\n
iptables -A INPUT -m multiport -p tcp --destination-ports 22,25,21 -j sshguard<\/pre>\n
service iptables save<\/pre>\n