sshguard(8)

💅 NAME 💅

ok so bestie, sshguard — it blocks brute-force attacks by aggregating system logs. that's the whole vibe. 🛡️✨

(this is the sshguard(8) manual page, btw — SSHGuard Manual, iykyk 🎀)

---

✨ SYNOPSIS ✨

sshguard [-hv] [-a threshold] [-b threshold:blacklist_file] [-i pidfile]
[-m block_time_multiplier] [-p blocktime] [-s detection_time] [-w
address | whitelist_file] [file ...]

---

🦋 DESCRIPTION 🦋

sshguard protects hosts from brute-force attacks against SSH and other services. no cap, that's its whole job. it aggregates system logs and blocks repeat offenders using one of several firewall backends. 👑

sshguard can monitor log files and the standard output of running a shell command. log messages are parsed line-by-line for recognized attack patterns. attackers get blocked when enough attack patterns are detected in a configurable time interval. attackers are blocked temporarily, but you can also permanently block them using the blacklist option. so rude, so deserved. 💀

🚨 bestie listen: sshguard must be configured before its first run. see sshguard-setup(7).

---

🌸 OPTIONS 🌸

• -a threshold (default 30) — every detected attack bumps an attacker's attack score, usually by 10. block attackers when their attack score exceeds threshold. literally the "you've gone too far" line.
• -b threshold:blacklist_file — blacklist an attacker when its attack score exceeds threshold. blacklisted addresses are written to blacklist-file and never unblocked, even after restarting sshguard. permanent. iconic. no takebacks. 🚫
• -i pidfile — write the PID of sshguard to pidfile. pidfile is removed when sshguard exits. tidy queen behavior.
• -m block_time_multiplier (default 2) — for repeat attackers, multiply blocktime by block_time_multiplier for each subsequent block. they keep coming back? the blocks keep getting longer. 🙈
• -p blocktime (default 120) — block first-time attackers for blocktime seconds. subsequent blocks increase in duration by a configurable factor (see the -m option). and since sshguard unblocks attackers at random intervals, actual block times may be somewhat longer. close enough, we're not doing math at a party. 🎀
• -s detection_time (default 1800) — reset an attacker's attack score after detection_time seconds since the last attack. this means attackers who attack every detection_time seconds are never blocked by sshguard. 😭 however, an increased detection_time may have an impact on legitimate users. so pls be careful with that one.
• [-w address | whitelist_file] — whitelist a single address, hostname, or address block given as address. this option can be given multiple times. alternatively, provide an absolute path to a whitelist_file containing addresses to whitelist. see WHITELISTING. 🫶
• -h — print usage information and exit.
• -v — print version information and exit.

---

🌈 ENVIRONMENT 🌈

• SSHGUARD_USER — when set, sandboxed processes drop permissions by changing to this user. normally set and overridden in sshguard.conf using the SSHGUARD_USER variable.
• SSHGUARD_DEBUG — set to enable verbose output from sshg-blocker. the "tell me everything" button. 👀
• SSHGUARD_STATS_DIR — when set, write Prometheus-compatible statistics to .prom files in this directory every minute. the STATS_DIR variable in sshguard.conf will set and override this environment variable.

---

🎀 FILES 🎀

• %PREFIX%/etc/sshguard.conf — see sample configuration file.

---

⭐ WHITELISTING ⭐

whitelisted addresses are never blocked. periodt. 💅 addresses can be specified on the command line or be stored in a file.

on the command line, give the -w option one or more times with an IP address, CIDR address block, or hostname as an argument. hostnames are resolved once at startup. if a hostname resolves to multiple addresses, all of them are whitelisted. for example:

sshguard -w 192.168.1.10 -w 192.168.0.0/24 -w friend.example.com
    -w 2001:0db8:85a3:0000:0000:8a2e:0370:7334
    -w 2002:836b:4179::836b:0000/126

if the argument to -w begins with a forward slash ('/') or dot ('.'), the argument is treated as the path to a whitelist file. sneaky but correct.

the whitelist file contains comments (lines beginning with '#'), addresses, address blocks, or hostnames, one per line. 🍓

---

🧚 SEE ALSO 🧚

sshguard-setup(7)

---

💜 and that's the whole page, bestie! this was SSHGuard Manual, version 2.6.0, dated May 10, 2026 — go forth and block those brutes, you absolute main character. 🌟