Content
- Log parsers2
- Attack scenarios6
- Contexts1
SSHD - Bruteforce Protection
Collection
- Version
- 0.9
- Name
- crowdsecurity/sshd
sshd support : parser and brute-force detection
Install with a top-level collection
5 collections include itsudo cscli collections install crowdsecurity/opnsenseInstalls 8 parsers and 8 scenarios, via FreeBSD - Generic Protection.
View OPNsense →Installation
sudo cscli collections install crowdsecurity/sshdThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/sshdparsers:- crowdsecurity/sshd-logs- crowdsecurity/sshd-success-logsscenarios:- crowdsecurity/ssh-bf- crowdsecurity/ssh-slow-bf- crowdsecurity/ssh-time-based-bf- crowdsecurity/ssh-cve-2024-6387- crowdsecurity/ssh-refused-conn- crowdsecurity/ssh-generic-testdescription: "sshd support : parser and brute-force detection"labels:label: "SSHD - Bruteforce Protection"contexts:- crowdsecurity/bf_baseauthor: crowdsecuritytags:- security_engine- linux- ssh- bruteforce
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
SSHD collection
A collection to defend sshd against common attacks :
- ssh parser
- ssh bruteforce & enumeration detection
- ssh 'slow' bruteforce & enumeration detection
Acquisition template
Example acquisition for this collection :
1filenames:2 - /var/log/auth.log3labels:4 type: syslog
notes :
- If you are using
syslog, set type tosysloginstead - Depending on your distribution/OS, paths to log files might change
- Only relevant if you are manually installing collection