How To Install SSHGuard on Fedora 42

Server administrators worldwide face a growing threat from automated SSH brute-force attacks that target vulnerable systems around the clock. These relentless attacks can overwhelm system resources and potentially compromise server security. SSHGuard emerges as a lightweight, efficient solution written in C that monitors system logs and automatically blocks malicious IP addresses using your system’s firewall backend.

Unlike heavier alternatives such as Fail2ban, SSHGuard offers superior performance with minimal resource consumption while maintaining robust protection capabilities. This comprehensive guide will walk through the complete process of installing, configuring, and optimizing SSHGuard on Fedora 42, ensuring your SSH server remains secure against brute-force attacks and unauthorized access attempts.

What is SSHGuard?

Understanding SSHGuard’s Core Functionality

SSHGuard functions as a protective daemon that continuously monitors system logs for patterns indicating brute-force attacks against SSH and other services. The tool analyzes authentication failures, connection attempts, and suspicious activities in real-time, automatically triggering defensive measures when attack thresholds are exceeded.

When SSHGuard detects malicious activity, it immediately communicates with the system’s firewall backend to implement blocking rules that prevent further connection attempts from offending IP addresses. This automated response mechanism operates without administrator intervention, providing immediate protection against ongoing attacks while maintaining system accessibility for legitimate users.

SSHGuard vs. Other Security Tools

SSHGuard distinguishes itself from Python-based alternatives like Fail2ban through its C implementation, resulting in significantly lower memory usage and faster processing speeds. The tool supports multiple firewall backends including iptables, FirewallD, pf, and ipfw, making it versatile across different Linux distributions and Unix-like systems.

The lightweight architecture ensures minimal impact on system performance while delivering comprehensive protection against various attack vectors. SSHGuard’s simplicity also reduces configuration complexity and potential security vulnerabilities that might arise from more feature-rich but complex security solutions.

Prerequisites and System Requirements

Fedora 42 System Requirements

Fedora 42 installation requires a minimum of 2GB RAM and 15GB available disk space, though 4GB RAM is recommended for optimal performance. The system must have root or sudo privileges for installing packages and modifying system configurations. Additionally, ensure your Fedora 42 installation includes the OpenSSH server package, which provides the SSH service that SSHGuard will protect.

Verify your current Fedora version using the command cat /etc/fedora-release to confirm you’re running Fedora 42. Check that the SSH service is active with sudo systemctl status sshd before proceeding with SSHGuard installation.

Pre-Installation Checklist

Before installing SSHGuard, determine your current firewall configuration by checking whether FirewallD or iptables manages your system’s firewall rules. Fedora 42 uses FirewallD by default, which SSHGuard supports natively through the sshguard-firewalld package.

Examine your system’s log structure using sudo journalctl -u sshd to verify that SSH authentication events are being properly logged. Create backup copies of critical configuration files including /etc/ssh/sshd_config and any existing firewall rules to enable quick recovery if issues arise during configuration.

Installation Methods

Method 1: Installing via DNF Package Manager

The recommended approach for installing SSHGuard on Fedora 42 involves using the DNF package manager, which automatically handles dependencies and ensures proper system integration. Begin by updating your system repositories to access the latest package versions:

sudo dnf update -y

Install SSHGuard and its FirewallD backend with a single command:

sudo dnf install sshguard

This command automatically installs the sshguard-firewalld package since FirewallD serves as Fedora’s default firewall management system. The installation process creates the necessary configuration files, systemd service definitions, and firewall integration components.

Alternative backend packages are available for different firewall configurations. Install sshguard-iptables for direct iptables integration or sshguard-nftables for newer nftables-based setups. However, most Fedora 42 users should stick with the default FirewallD backend for optimal compatibility.

Verify the installation succeeded by checking the SSHGuard version:

sshguard -v

Method 2: Installing from Source Code

Advanced users may prefer compiling SSHGuard from source to access the latest features or customize compilation options. This method requires additional development tools and libraries.

Install the necessary build dependencies:

sudo dnf install gcc make libsystemd-devel autoconf automake

Download the latest source code from the official SSHGuard repository:

wget https://sourceforge.net/projects/sshguard/files/latest/download -O sshguard-latest.tar.gz
tar -xzf sshguard-latest.tar.gz
cd sshguard-*

Configure, compile, and install SSHGuard:

./configure --with-firewall=firewalld
make
sudo make install

Source installation provides greater control over compilation options but requires manual management of updates and system integration. Most users should prefer the package manager installation for easier maintenance and automatic updates.

Configuration Setup

Understanding SSHGuard Configuration File

SSHGuard’s main configuration file resides at /etc/sshguard.conf on Fedora systems. This file controls all aspects of SSHGuard’s behavior, including firewall backend selection, detection thresholds, and blocking parameters.

The configuration file uses a simple key-value format with comments explaining each option. Default settings work well for most installations, but customization allows fine-tuning for specific security requirements and environmental considerations.

Essential Configuration Parameters

Open the configuration file for editing:

sudo nano /etc/sshguard.conf

Key configuration options include:

Backend Selection: Specify the firewall backend SSHGuard should use:

BACKEND="/usr/lib/sshguard/sshg-fw-firewalld"

Attack Threshold: Set the number of failed attempts before blocking:

THRESHOLD=30

Block Duration: Configure initial blocking time in seconds:

BLOCK_TIME=120

Log Sources: Specify which log files to monitor:

LOGREADER="LANG=C /usr/bin/journalctl -afb -p info -n1 -t sshd -o cat"

Whitelist File: Protect trusted IP addresses from blocking:

WHITELIST_FILE="/etc/sshguard/whitelist"

Advanced Configuration Options

SSHGuard offers additional parameters for specialized environments. The PARDON_TIME setting controls how long the system remembers blocked addresses, while BLACKLIST_THRESHOLD determines when temporary blocks become permanent.

Configure service-specific monitoring by adjusting log readers to include additional services like Postfix, Vsftpd, or Apache. Custom log format support enables integration with non-standard logging configurations or centralized log management systems.

Firewall Integration

Configuring FirewallD Backend

Fedora 42’s default FirewallD integration requires minimal manual configuration since the sshguard-firewalld package handles most setup automatically. Verify FirewallD is active and running:

sudo systemctl status firewalld

SSHGuard creates a dedicated FirewallD service definition that manages blocking rules without interfering with existing firewall configurations. Check that the SSHGuard FirewallD backend is properly configured:

sudo firewall-cmd --list-all

The FirewallD backend automatically creates temporary blocking rules in the appropriate zone, ensuring blocked addresses cannot access any services while maintaining existing firewall policies for legitimate traffic.

Alternative: IPtables Backend Setup

Users preferring direct iptables integration can install the alternative backend package:

sudo dnf install sshguard-iptables

Configure SSHGuard to use the iptables backend by modifying the configuration file:

BACKEND="/usr/lib/sshguard/sshg-fw-iptables"

Create a dedicated SSHGuard chain in iptables:

sudo iptables -N SSHGUARD
sudo iptables -A INPUT -j SSHGUARD

Save the iptables configuration to ensure persistence across reboots:

sudo iptables-save > /etc/iptables/rules.v4

Service Management

Starting and Enabling SSHGuard Service

After installation and configuration, start the SSHGuard service and enable automatic startup on system boot:

sudo systemctl enable --now sshguard

This combined command both starts the service immediately and configures it to start automatically during system initialization. Verify the service is running correctly:

sudo systemctl status sshguard

A properly running service displays an “active (running)” status with recent log entries showing successful initialization and backend connectivity.

Service Configuration and Management

The SSHGuard systemd service file located at /usr/lib/systemd/system/sshguard.service defines service parameters and dependencies. Most users won’t need to modify this file, but custom environments may require adjustments to service dependencies or execution parameters.

Monitor service health using systemd journal logs:

sudo journalctl -u sshguard -f

Restart the service after making configuration changes:

sudo systemctl restart sshguard

Testing and Verification

Verifying SSHGuard Functionality

Confirm SSHGuard is actively monitoring and responding to threats by checking its operational status:

sudo systemctl status sshguard

Monitor real-time SSHGuard activity through system journals:

sudo journalctl -u sshguard -f

Test attack detection by attempting multiple failed SSH login attempts from a test system. SSHGuard should detect these attempts and implement blocking rules after exceeding the configured threshold.

Verify firewall rules are being created by examining current FirewallD or iptables rules:

sudo firewall-cmd --list-rich-rules

Log Analysis and Monitoring

SSHGuard generates detailed logs documenting detected attacks, blocked addresses, and system events. These logs provide valuable security intelligence and help administrators understand attack patterns targeting their systems.

Regular log analysis reveals attack trends, geographic origins of threats, and the effectiveness of current security measures. Consider implementing log rotation to manage disk space usage while maintaining sufficient historical data for security analysis.

Set up monitoring alerts using systemd journal integration or external log management systems to receive notifications when significant security events occur.

Troubleshooting Common Issues

Service Startup Problems

Configuration file syntax errors commonly prevent SSHGuard from starting properly. Validate your configuration syntax using:

sudo sshguard -t

Permission issues with log files can block SSHGuard’s ability to monitor authentication events. Ensure SSHGuard has read access to system logs:

sudo ls -la /var/log/secure /var/log/auth.log

SELinux policies may interfere with SSHGuard operation on Fedora systems. Check SELinux audit logs for denied operations:

sudo ausearch -m avc -ts recent | grep sshguard

Performance and Detection Issues

Fine-tune detection thresholds if SSHGuard generates too many false positives or fails to detect legitimate attacks. Lower threshold values increase sensitivity but may block legitimate users experiencing authentication difficulties.

Optimize log monitoring performance by adjusting log reader configurations to focus on relevant log sources. Excessive log processing can impact system performance, especially on high-traffic servers.

Review whitelist configurations regularly to ensure legitimate IP addresses remain protected from accidental blocking. Overly restrictive whitelists may leave important systems vulnerable to blocking during authentication issues.

Security Best Practices

SSH Server Hardening Recommendations

Complement SSHGuard protection with comprehensive SSH server hardening measures. Change the default SSH port from 22 to reduce automated attack visibility:

sudo nano /etc/ssh/sshd_config
# Add: Port 2222

Disable root login and password authentication in favor of key-based authentication:

# In /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Implement connection rate limiting and idle timeout configurations to further reduce attack surface:

# Add to /etc/ssh/sshd_config
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2

SSHGuard Optimization Techniques

Customize detection thresholds based on your environment’s specific needs. High-traffic environments may require higher thresholds to accommodate legitimate authentication retries, while low-traffic servers can use more aggressive settings.

Implement intelligent whitelist management by regularly reviewing and updating protected IP address ranges. Include your management networks, monitoring systems, and other infrastructure components that require consistent SSH access.

Consider implementing graduated blocking strategies where repeat offenders face longer blocking periods or permanent blacklisting. This approach provides stronger protection against persistent attackers while maintaining flexibility for occasional legitimate authentication failures.

Maintenance and Updates

Regular Maintenance Tasks

Keep SSHGuard updated through regular system package updates:

sudo dnf update sshguard

Periodically review and clean the blocked IP database to remove outdated entries and manage storage usage. Most blocking rules expire automatically, but manual cleanup may be necessary for heavily attacked systems.

Monitor log file sizes and ensure proper log rotation prevents excessive disk usage while maintaining adequate historical data for security analysis and compliance requirements.

System Integration Considerations

Fedora system updates may occasionally affect SSHGuard functionality, particularly when systemd or firewall components receive major updates. Test SSHGuard operation after significant system updates to ensure continued protection.

Integrate SSHGuard with centralized monitoring and alerting systems to provide comprehensive security oversight across multiple systems. This integration enables coordinated response to distributed attacks and improved security intelligence gathering.

Document your SSHGuard configuration and customizations as part of your system administration procedures. Proper documentation facilitates troubleshooting, system recovery, and knowledge transfer among administrative team members.

Advanced Configuration Examples

Multi-Service Protection Setup

Extend SSHGuard protection beyond SSH by monitoring additional services. Configure log readers to include mail servers, web servers, and other authentication-based services:

# Monitor multiple services
LOGREADER="LANG=C /usr/bin/journalctl -afb -p info -n1 -t sshd -t postfix/smtpd -t vsftpd -o cat"

This configuration enables SSHGuard to protect SMTP and FTP services alongside SSH, providing comprehensive brute-force attack protection across your server infrastructure.

Geographic Blocking Integration

Consider implementing geographic IP blocking alongside SSHGuard for enhanced protection against international threats. While SSHGuard focuses on behavioral analysis, geographic filtering can reduce attack surface by blocking entire countries or regions that don’t require access to your services.

Combine these approaches carefully to avoid blocking legitimate users while maintaining strong security postures against distributed attack networks.

Congratulations! You have successfully installed SSHGuard. Thanks for using this tutorial for installing SSHGuard protects hosts on Fedora 42 Linux system. For additional help or useful information, we recommend you check the official SSHGuard website.