macOS
Homebrewverified · 100%
brew install sshguardlocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install sshguardMacPorts ports tree · net/sshguard/Portfile · source: api.github.com
brew
Install sshguard with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper
Protect from brute force attacks against SSH. Version 2.5.1 via Homebrew; verified from local package data.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add sshguardAlpine Linux edge package indexes · sshguard · source: dl-cdn.alpinelinux.org
Debian aptverified · 92%
sudo apt install sshguardDebian stable package indexes · sshguard · source: deb.debian.org
Fedora dnfverified · 92%
sudo dnf install sshguardFedora Rawhide package metadata · sshguard · source: dl.fedoraproject.org
Nixverified · 92%
nix profile install nixpkgs#sshguardnixpkgs package indexes · pkgs/by-name/ss/sshguard/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S sshguardArch Linux sync databases · sshguard · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install sshguardopenSUSE Tumbleweed package metadata · sshguard · source: download.opensuse.org
overview
Package summary
Protect from brute force attacks against SSH
Project links
Commands and aliases
- sshguard
history
Project history and usage
SSHGuard is a small intrusion-prevention utility that watches system logs for brute-force attacks and blocks repeat offenders through a firewall backend. It became package-manager material because it gives Unix administrators a lightweight alternative to heavier log-monitoring stacks.
Project history
The official manual and README describe SSHGuard as a tool that aggregates logs and blocks attackers using backends such as pf, ipfw, firewalld, iptables, ipset, nftables, IPFILTER, and hosts.allow. The manual copyright dates begin in 2007, and the current manual version is 2.5.1.
Adoption history
SSHGuard's official site emphasizes portability and small size, describing it as small C and Bourne shell code with support for many log sources and firewall systems. The input package-manager facts show it available across Homebrew, Debian, Ubuntu, Fedora, Arch, Alpine, Nix, MacPorts, and openSUSE ecosystems.
How it is used
Operators configure `sshguard.conf`, choose a backend, and feed SSHGuard logs through files, syslog-style services, systemd journal, or macOS log streaming. Attackers are blocked after their score exceeds a threshold and can be temporarily blocked, permanently blacklisted, or whitelisted through explicit addresses or a whitelist file.
Why package nerds care
Package nerds care because SSHGuard is pure Unix plumbing: logs in, firewall commands out, minimal daemon surface. It is a good example of security tooling whose packaging value lies in service files, default config paths, backend selection, and integration with each operating system's logging and firewall conventions.
Timeline
- 2007: Official sshguard(8) manual copyright period begins.
- 2024: Official website footer and current site generation reflect active project site maintenance.
- 2025: Official manual pages list version 2.5.1 and date January 1, 2025.
Related projects
- SSHGuard is related to OpenSSH server logs, syslog, systemd journal, pf, ipfw, firewalld, iptables, ipset, nftables, IPFILTER, and other brute-force blocking tools.
Sources
security posture
Risk level: orange
broad file, network, media, or database tool signal. formula declares a Homebrew service.
Risk classifier
orange risk · medium confidence · infrastructure
Why
- broad file, network, media, or database tool signal
- formula declares a Homebrew service
Signals
- metadata:service
- text:ssh
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Formula metadata declares a service or daemon block.
- Homebrew bottle metadata is available for 8 platform targets.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
%PREFIX%/etc/sshguard.conf
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
sshguard | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version2.5.1
manager updated
local dataok
upstreamnot checked
latest detectednot detected
- infoNo package-manager update timestamp was available.low confidence
- infoRelease/tag comparison is only available for GitHub repositories.https://www.sshguard.net/none confidence
install metadata
Package metadata
| Package key | brew:sshguard |
|---|---|
| Version | 2.5.1 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/sshguard |
| Homepage | https://www.sshguard.net/ |
| Repository | https://bitbucket.org/sshguard/sshguard |
| Upstream docs | https://bitbucket.org/sshguard/sshguard/raw/master/README.rst |
| License | ISC |
| Source archive | https://downloads.sourceforge.net/project/sshguard/sshguard/2.5.1/sshguard-2.5.1.tar.gz |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, sonoma, ventura, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | declared |
| Caveats | Add the following lines to /etc/pf.conf to block entries in the sshguard table (replace $ext_if with your WAN interface): table <sshguard> persist block in quick on $ext_if proto tcp from <sshguard> to any port 22 label "ssh bruteforce" Then run sudo pfctl -f /etc/pf.conf to reload the rules. |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | sshguard |
| Version Scheme | 1 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
sshguard 2.4.3-1
Protects from brute force attacks against ssh
https://sshguard.sourceforge.net
sudo apt install sshguard- Section: net
- Architecture: amd64
- 2 dependencies
- 1 optional deps
- normalized package name match
- Matched by: Sshguard
Nix95%
sshguard
nix profile install nixpkgs#sshguard- normalized package name match
- Matched by: Sshguard
Ubuntu apt95%
sshguard 2.4.2-1
Protects from brute force attacks against ssh
http://sshguard.sourceforge.net
sudo apt install sshguard- Section: universe/net
- Architecture: amd64
- 2 dependencies
- 1 optional deps
- normalized package name match
- Matched by: Sshguard
apk95%
sshguard 2.5.1-r0
Protects hosts from brute-force attacks against SSH and other services
sudo apk add sshguard- License: ISC
- Architecture: x86_64
- Source Package: sshguard
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Sshguard
apk95%
sshguard-doc 2.5.1-r0
Protects hosts from brute-force attacks against SSH and other services (documentation)
sudo apk add sshguard-doc- License: ISC
- Architecture: x86_64
- Source Package: sshguard
- normalized package name match
- Matched by: Sshguard
apk95%
sshguard-openrc 2.5.1-r0
Protects hosts from brute-force attacks against SSH and other services (OpenRC init scripts)
sudo apk add sshguard-openrc- License: ISC
- Architecture: x86_64
- Source Package: sshguard
- normalized package name match
- Matched by: Sshguard
dnf95%
sshguard 2.5.1-3.fc44
Protects hosts from brute-force attacks against SSH and other services
sudo dnf install sshguard- License: BSD-3-Clause AND GPL-3.0-or-later AND LicenseRef-Fedora-Public-Domain
- Category: Unspecified
- Architecture: x86_64
- Source Package: sshguard
- 9 dependencies
- 3 provides
- normalized package name match
- Matched by: Sshguard
dnf95%
sshguard-firewalld 2.5.1-3.fc44
Configuration for firewalld backend of SSHGuard
sudo dnf install sshguard-firewalld- License: BSD-3-Clause AND GPL-3.0-or-later AND LicenseRef-Fedora-Public-Domain
- Category: Unspecified
- Architecture: x86_64
- Source Package: sshguard
- 3 dependencies
- 3 provides
- normalized package name match
- Matched by: Sshguard
dnf95%
sshguard-iptables 2.5.1-3.fc44
Configuration for iptables backend of SSHGuard
sudo dnf install sshguard-iptables- License: BSD-3-Clause AND GPL-3.0-or-later AND LicenseRef-Fedora-Public-Domain
- Category: Unspecified
- Architecture: x86_64
- Source Package: sshguard
- 3 dependencies
- 3 provides
- normalized package name match
- Matched by: Sshguard
dnf95%
sshguard-nftables 2.5.1-3.fc44
Configuration for nftables backend of SSHGuard
sudo dnf install sshguard-nftables- License: BSD-3-Clause AND GPL-3.0-or-later AND LicenseRef-Fedora-Public-Domain
- Category: Unspecified
- Architecture: x86_64
- Source Package: sshguard
- 2 dependencies
- 3 provides
- normalized package name match
- Matched by: Sshguard
pacman95%
sshguard 2.5.1-1
Brute force detector for SSH, Exim, VSFTPD and more. Blocks by ip with iptables
sudo pacman -S sshguard- License: GPL
- Architecture: x86_64
- 4 optional deps
- normalized package name match
- Matched by: Sshguard
zypper95%
sshguard 2.4.3-2.3
SSH brute force attack protector
sudo zypper install sshguard- License: ISC
- Category: Productivity/Networking/Security
- Architecture: x86_64
- Source Package: sshguard
- 7 dependencies
- 2 provides
- normalized package name match
- Matched by: Sshguard
MacPorts95%
sshguard
sudo port install sshguard- normalized package name match
- Matched by: Sshguard
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment