A production-ready SSH security framework that hardens your daemon, bans brute-force attackers before they exhaust their attempts, and streams every event to your SIEM — the work of three or four separate tools, in one.
$ git clone https://github.com/mobinert/ssh-fortressBrings sshd up to CIS Level 2 / NSA standards automatically — and validates the config before you rely on it.
A behavioural threat engine scores every source IP and bans at the kernel with nftables, before attackers exhaust auth attempts.
Forwards every SSH event to Elasticsearch, Splunk, Syslog or Kafka with async, back-pressured delivery.
Notifies you on Telegram, Email, Discord, Slack or ntfy the moment something looks wrong.
Exposes metrics for Grafana and Alertmanager, so SSH health lives right next to the rest of your stack.
Flags impossible travel, IP sprays, unusual login hours and root attempts — not just raw failure counts.
Finds weak, old or duplicate authorized keys before an attacker does.
Checks incoming IPs against AbuseIPDB and pre-bans known attackers on sight.
A doctor command validates everything, and designed HTML / JSON security reports summarize your posture on demand.
git clone https://github.com/mobinert/ssh-fortress.git cd ssh-fortress pip install -r requirements.txt sudo ssh-fortress doctor # validate your setup first sudo ssh-fortress harden # apply CIS/NSA hardening (with a safety net) sudo ssh-fortress watch # start adaptive brute-force protection
Near-zero overhead: inotify-driven log tailing uses no CPU when idle, ban decisions are O(1), and the systemd unit is capped at 20% CPU / 256 MB RAM.