How To Install SSHGuard on Ubuntu 24.04 LTS

SSHGuard provides robust protection against brute-force attacks by monitoring system logs and automatically blocking malicious IP addresses. This intrusion prevention daemon operates efficiently in the background, analyzing authentication attempts and implementing firewall rules to safeguard your Ubuntu 24.04 LTS server. Unlike resource-intensive alternatives, SSHGuard delivers enterprise-grade security with minimal system overhead.

Understanding SSHGuard and Its Security Benefits

SSHGuard functions as a log-based intrusion prevention system that monitors authentication logs across multiple services. The daemon analyzes patterns in system logs to identify suspicious activity, particularly brute-force attacks targeting SSH, FTP, and mail services. When malicious behavior is detected, SSHGuard automatically adds blocking rules to your firewall, preventing further attacks from the same source.

The security tool supports various firewall backends including iptables, nftables, and UFW. This versatility ensures compatibility with different Ubuntu configurations and security setups. SSHGuard’s C-based implementation provides superior performance compared to Python-based alternatives like Fail2ban. The daemon can protect multiple services simultaneously, making it an efficient solution for comprehensive server security.

Modern Ubuntu installations benefit from SSHGuard’s ability to integrate seamlessly with systemd and journald logging systems. The tool reads logs in real-time, ensuring rapid response to security threats. Advanced features include progressive ban times, whitelist support, and customizable attack thresholds, allowing administrators to fine-tune security policies according to their specific requirements.

Prerequisites and System Requirements

Before installing SSHGuard on Ubuntu 24.04 LTS, verify your system meets the necessary requirements. Your server should have at least 1GB of RAM and adequate disk space for log storage. Administrative privileges are essential for installation and configuration tasks.

Network connectivity ensures access to Ubuntu’s package repositories during installation. A basic understanding of Linux command-line operations and firewall management will facilitate the setup process. Consider performing the installation on a fresh Ubuntu 24.04 LTS system to avoid conflicts with existing security configurations.

Verify your Ubuntu version using lsb_release -a and ensure your system is fully updated before proceeding. Having SSH access configured properly is crucial, as incorrect SSHGuard configuration could potentially lock you out of your server.

Step-by-Step Installation Process

System Preparation

Begin by updating your Ubuntu 24.04 LTS system to ensure all packages are current. Execute the following commands to refresh package repositories and upgrade existing software:

sudo apt update
sudo apt upgrade -y

This process ensures compatibility with the latest security patches and resolves potential dependency conflicts. Reboot your system if kernel updates were installed during this process.

Install essential build tools if you plan to compile SSHGuard from source:

sudo apt install build-essential gcc make

These packages provide the necessary compilation environment for source-based installations.

Installing SSHGuard from Ubuntu Repositories

The most straightforward method involves using Ubuntu’s official package repositories. Install SSHGuard using the Advanced Package Tool (APT):

sudo apt install sshguard

This command downloads and installs SSHGuard along with its required dependencies. The package manager automatically handles dependency resolution, ensuring all necessary components are properly configured. Ubuntu’s repositories contain tested versions of SSHGuard that integrate well with the operating system.

Verify the installation by checking the installed version:

sshguard --version

The package installation creates the necessary systemd service files and default configuration templates. This method provides automatic security updates through the standard Ubuntu update mechanism.

Alternative Source Installation Method

Advanced users may prefer installing SSHGuard from source code to access the latest features. Download the source code from the official repository:

wget https://sourceforge.net/projects/sshguard/files/latest/download -O sshguard-latest.tar.gz
tar -xzf sshguard-latest.tar.gz
cd sshguard-*/

Configure the build environment and compile the software:

./configure
make
sudo make install

Source installation provides access to cutting-edge features but requires manual updates and maintenance. This method suits environments requiring specific SSHGuard versions or custom compilation options.

Initial Configuration and Setup

Understanding the Configuration File

SSHGuard’s primary configuration file resides at /etc/sshguard/sshguard.conf. This file contains essential settings that control the daemon’s behavior and security policies. Understanding these directives enables fine-tuning of protection mechanisms.

Key configuration parameters include:

• BACKEND: Specifies the firewall system (iptables, nftables, or UFW)
• THRESHOLD: Sets the attack score triggering IP blocks
• BLOCK_TIME: Defines the duration of IP bans
• DETECTION_TIME: Configures the time window for attack detection
• WHITELIST_FILE: Points to trusted IP address lists

Edit the configuration file using your preferred text editor:

sudo nano /etc/sshguard/sshguard.conf

Default settings provide reasonable security for most installations. However, customization may be necessary based on your specific security requirements and network environment.

Service Management Configuration

Enable and start the SSHGuard service using systemd commands:

sudo systemctl start sshguard
sudo systemctl enable sshguard

These commands activate SSHGuard immediately and ensure automatic startup during system boot. Verify the service status to confirm proper operation:

sudo systemctl status sshguard

A properly running service displays “active (running)” status with recent log entries showing successful initialization. Check for any error messages that might indicate configuration issues.

Monitor SSHGuard activity using journal logs:

sudo journalctl -u sshguard -f

This command provides real-time log output, allowing you to observe SSHGuard’s response to authentication attempts and potential attacks.

Basic Configuration Examples

Configure moderate security settings by adjusting key parameters in the configuration file. Set a reasonable attack threshold:

THRESHOLD=30

This setting triggers IP blocking after accumulating 30 attack points. Different types of failed authentication attempts contribute varying point values to this total.

Adjust ban duration for initial offenses:

BLOCK_TIME=600

This configuration blocks attacking IPs for 10 minutes initially. SSHGuard implements progressive blocking, increasing ban duration for repeat offenders.

Create a whitelist file to protect trusted addresses:

sudo nano /etc/sshguard/whitelist

Add trusted IP addresses or network ranges:

192.168.1.0/24
10.0.0.100

This prevents accidental blocking of administrative systems and trusted networks.

Firewall Integration Methods

UFW Integration for Ubuntu’s Default Firewall

Ubuntu’s Uncomplicated Firewall (UFW) provides the simplest integration method for SSHGuard. First, verify UFW status and enable it if necessary:

sudo ufw status
sudo ufw enable

Configure SSHGuard to work with UFW by editing the UFW before-rules file:

sudo nano /etc/ufw/before.rules

Add the SSHGuard chain configuration near the beginning of the file, after the initial comments but before existing rules:

# SSHGuard chain
:sshguard - [0:0]

# Pass traffic to SSHGuard for analysis
-A ufw-before-input -p tcp --dport 22 -j sshguard

This configuration creates a dedicated SSHGuard chain and directs SSH traffic through it for analysis. The integration allows SSHGuard to insert blocking rules dynamically without conflicting with UFW’s management.

Restart UFW to apply the new configuration:

sudo ufw reload

Verify the integration by checking UFW status and looking for SSHGuard-related rules:

sudo ufw status verbose

Test the configuration by monitoring logs during normal SSH activity to ensure proper traffic flow and rule application.

Direct iptables Integration

For systems using iptables directly, manual chain creation provides SSHGuard integration. Create the SSHGuard chain and establish traffic routing:

sudo iptables -N sshguard
sudo iptables -A INPUT -j sshguard

These commands create a dedicated chain for SSHGuard rules and direct input traffic through it. The configuration allows SSHGuard to manage blocking rules independently of other iptables configurations.

Save the iptables configuration to ensure persistence across reboots:

sudo iptables-save > /etc/iptables/rules.v4

For automated restoration, install the iptables-persistent package:

sudo apt install iptables-persistent

This package automatically restores iptables rules during system startup, maintaining SSHGuard integration functionality.

Modern nftables Integration

Ubuntu 24.04 LTS supports nftables as a modern alternative to iptables. Configure SSHGuard to use the nftables backend by modifying the configuration file:

sudo nano /etc/sshguard/sshguard.conf

Set the backend to nftables:

BACKEND="nft-sets"

This configuration leverages nftables’ set functionality for efficient IP blocking. The nftables backend provides improved performance and more sophisticated traffic filtering capabilities compared to traditional iptables.

Verify nftables integration by checking the ruleset after SSHGuard starts:

sudo nft list ruleset

Look for SSHGuard-created sets and rules in the output. The nftables integration offers advanced features like atomic rule updates and improved memory efficiency.

Advanced Configuration Options

Customizing Detection Parameters

Fine-tune SSHGuard’s detection sensitivity by adjusting attack scoring and time windows. Modify the configuration file to implement custom thresholds for different services:

# SSH attacks (default: 10 points per failed login)
# FTP attacks (default: 20 points per failed login)
# Multiple rapid attempts increase point values

Configure progressive blocking to increase ban times for repeat offenders:

BLOCK_TIME=600       # Initial 10-minute ban
BLOCK_TIME_MAX=86400 # Maximum 24-hour ban

This configuration implements escalating penalties, effectively deterring persistent attackers while allowing for occasional legitimate mistakes.

Adjust the detection time window to balance security and usability:

DETECTION_TIME=300

A 5-minute detection window provides reasonable protection while minimizing false positives from legitimate authentication delays.

Whitelist Configuration Management

Implement comprehensive whitelist management to protect trusted systems and networks. Create organized whitelist entries for different categories:

sudo nano /etc/sshguard/whitelist

Structure whitelist entries logically:

# Administrative networks
192.168.1.0/24
10.0.0.0/16

# Specific trusted servers
203.0.113.10
198.51.100.25

# Cloud service providers (if applicable)
# Add specific IP ranges for legitimate services

Implement dynamic whitelist management for environments with changing trusted addresses. Consider scripting whitelist updates for automated infrastructure management.

Regular whitelist review ensures continued accuracy and security. Remove obsolete entries and add new trusted sources as your infrastructure evolves.

Enhanced Log Monitoring Configuration

Configure multiple log sources to expand SSHGuard’s monitoring capabilities. Edit the configuration to include additional services:

# Monitor multiple log files
FILES="/var/log/auth.log /var/log/mail.log /var/log/vsftpd.log"

This configuration extends protection beyond SSH to include mail servers and FTP services. SSHGuard analyzes patterns across all specified log sources, providing comprehensive intrusion detection.

Integrate with rsyslog for centralized logging in complex environments:

sudo nano /etc/rsyslog.d/10-sshguard.conf

Add configuration for remote log collection:

# Forward authentication logs to central server
auth.* @@log-server.example.com:514

This setup enables SSHGuard deployment in distributed environments with centralized log management.

Testing and Verification

Simulating Controlled Attack Scenarios

Test SSHGuard functionality using controlled attack simulation from external systems. Never test from the same server where SSHGuard is installed to avoid accidental lockouts.

From a separate system, attempt multiple failed SSH logins:

ssh invalid-user@your-server-ip
# Enter incorrect passwords multiple times

Monitor SSHGuard’s response in real-time using journal logs:

sudo journalctl -u sshguard -f

Observe log entries indicating attack detection and IP blocking actions. Successful testing shows entries like “Blocking 192.0.2.100 for 600 seconds” indicating proper functionality.

Use tools like hydra for more comprehensive testing (from external systems only):

hydra -l testuser -P /usr/share/wordlists/rockyou.txt ssh://target-server

This provides controlled brute-force simulation for thorough SSHGuard testing.

Monitoring SSHGuard Activity and Performance

Implement comprehensive monitoring to track SSHGuard effectiveness and system impact. Create monitoring scripts to analyze blocking statistics:

sudo journalctl -u sshguard --since="24 hours ago" | grep "Blocking"

This command provides daily blocking statistics for security reporting and analysis.

Monitor system performance impact:

top -p $(pgrep sshguard)
htop -p $(pgrep sshguard)

SSHGuard typically maintains minimal resource usage, with CPU consumption under 1% and memory usage below 10MB.

Check active firewall rules created by SSHGuard:

sudo iptables -L sshguard -n -v
sudo ufw status numbered

These commands display current blocking rules and their traffic statistics, providing insight into attack frequency and geographic distribution.

Set up automated monitoring alerts for excessive attack activity:

#!/bin/bash
# Alert script for high attack volumes
ATTACKS=$(journalctl -u sshguard --since="1 hour ago" | grep "Blocking" | wc -l)
if [ $ATTACKS -gt 10 ]; then
    echo "High attack volume detected: $ATTACKS blocks in last hour" | mail -s "SSHGuard Alert" admin@example.com
fi

Troubleshooting Common Issues

Service Startup and Configuration Problems

Address common SSHGuard startup failures by examining systemd service logs. Check for configuration syntax errors:

sudo journalctl -u sshguard --no-pager

Common issues include incorrect backend specifications or invalid configuration directives. Verify configuration file syntax using SSHGuard’s built-in validation:

sudo sshguard -t

This command performs configuration testing without starting the service, identifying syntax errors and misconfigurations.

Resolve permission issues that prevent log file access:

sudo chown syslog:adm /var/log/auth.log
sudo chmod 640 /var/log/auth.log

Ensure SSHGuard has appropriate permissions to read authentication logs and write to firewall systems.

Fix systemd service dependencies for proper startup ordering:

sudo systemctl edit sshguard

Add dependency configuration if needed:

[Unit]
After=network.target rsyslog.service
Requires=network.target

Firewall Integration Troubleshooting

Resolve UFW integration conflicts by checking rule ordering and chain creation. Verify SSHGuard chain existence:

sudo iptables -L sshguard

If the chain doesn’t exist, manually create it or restart the UFW service:

sudo systemctl restart ufw
sudo systemctl restart sshguard

Address iptables backend issues by ensuring proper chain configuration and rule insertion capabilities. Check for conflicting firewall management tools that might interfere with SSHGuard operations.

Diagnose nftables integration problems by examining ruleset creation:

sudo nft list sets
sudo nft list chains

Verify that SSHGuard successfully creates and manages nftables sets for IP blocking functionality.

Performance and Log Management Issues

Optimize SSHGuard performance in high-traffic environments by implementing log rotation and management strategies. Configure logrotate for authentication logs:

sudo nano /etc/logrotate.d/auth-logs

Add rotation configuration:

/var/log/auth.log {
    daily
    rotate 30
    compress
    delaycompress
    notifempty
    postrotate
        systemctl reload rsyslog
        systemctl reload sshguard
    endscript
}

Address high CPU usage during attack periods by adjusting detection algorithms and implementing rate limiting. Consider upgrading system resources if SSHGuard struggles with log processing volumes.

Resolve memory issues by monitoring SSHGuard’s memory consumption and implementing system resource limits if necessary:

sudo systemctl edit sshguard

Add resource limitations:

[Service]
MemoryLimit=100M
CPUQuota=50%

Security Best Practices and Optimization

Hardening SSHGuard Configuration

Implement advanced security measures by optimizing threshold settings and ban durations. Configure aggressive settings for high-security environments:

THRESHOLD=15          # Lower threshold for faster blocking
BLOCK_TIME=1800      # 30-minute initial ban
BLOCK_TIME_MAX=604800 # 7-day maximum ban

These settings provide enhanced protection against persistent attackers while maintaining reasonable recovery times for legitimate users.

Implement service-specific protection by configuring multiple SSHGuard instances for different services. Create separate configuration files for specialized monitoring requirements.

Enable comprehensive logging for security auditing and compliance requirements:

SSHGUARD_DEBUG=1

This configuration provides detailed attack information for forensic analysis and security reporting.

Maintenance and Monitoring Best Practices

Establish regular maintenance schedules for SSHGuard configuration review and updates. Monitor attack patterns to identify emerging threats and adjust protection accordingly.

Implement automated backup procedures for SSHGuard configurations:

#!/bin/bash
# Backup SSHGuard configuration
tar -czf /backup/sshguard-config-$(date +%Y%m%d).tar.gz /etc/sshguard/

Schedule regular security assessments to evaluate SSHGuard effectiveness and identify potential improvements.

Configure integration with centralized security information and event management (SIEM) systems for enterprise environments. Forward SSHGuard alerts to security monitoring platforms for comprehensive threat analysis.

Maintain updated threat intelligence by subscribing to security advisories and updating SSHGuard regularly through Ubuntu’s package management system.

Congratulations! You have successfully installed SSHGuard. Thanks for using this tutorial for installing SSHGuard on Ubuntu 24.04 LTS system. For additional help or useful information, we recommend you check the official SSHGuard website.