FRP-SSH-Guard v0.0.6 is available

FRP-SSH-Guard v0.0.6 is now available. This release makes quiet, repeated SSH probing easier to spot and gives administrators a clearer view of what the guard has observed. It adds local alerts and timestamped reports while retaining the existing fast detection, jail scope, and ban durations.

Download v0.0.6 · Explore the product

Spot slower probing

An independent detector watches for 20 authentication failures over 24 hours on the server’s own SSH service. It complements the existing short-window detector.

The default is observation only: reaching this new threshold produces an alert, not a ban or strike. Administrators can explicitly enable enforcement to use their existing ban duration and shared or per-port jail policy. Suspicious groups of automatically banned sources from the same subnet are also reported, without automatically blocking the entire subnet.

Keep alerts local and readable

A new alerts.log in ~/.frp-ssh-guard/ puts the newest event first. It records slow-probe thresholds, suspected subnet clusters, and successful logins from previously untrusted sources. Such a login is a signal to review, not proof of compromise.

The default limit is 10 MiB. The oldest complete records are discarded when the file reaches its cap, with no rotated archives. Alerts contain no account names, passwords, or raw authentication messages. If the user’s home directory is temporarily unavailable, a bounded private system spool holds alerts until they can be merged back.

Understand what happened

The new doctor command checks monitoring, SSH rule coverage, whitelist coverage, and alert access. report 24h separates authentication failures, threshold observations, new automatic bans, and sampled dropped packets within the requested window.

Authentication bans are recorded directly and reconciled with kernel samples so one ban contributes one strike. Packet counters are checkpointed across controlled reloads. Sampling still has limits: packet counts are not connection counts, and a sudden shutdown can lose drops that have not yet been sampled.

Install the update; the new guard takes effect automatically

Download frp-ssh-guard_0.0.6.deb and SHA256SUMS from the release page:

sha256sum --ignore-missing -c SHA256SUMS
sudo apt install ./frp-ssh-guard_0.0.6.deb

Package revision 0.0.6-2 automatically refreshes an active guard. Installation applies the updated firewall rules using the accepted configuration and restarts the SSH monitors. No separate reload or reboot is needed. Custom settings, pending edits, saved ban scope and expiry, boot enablement, and timer schedules are retained; rate meters reset.

Download both the package and its checksum again if you already have the earlier v0.0.6 build. APT recognizes the higher internal revision and upgrades it normally. For a fresh or disabled installation, configure the protected ports and use enable for first activation. Native SSH protection and whitelist learning remain opt-in. status, doctor, and report 24h are optional checks.

See the release notes and validation record for the current regression, package, and disposable-VM checks and their coverage limits.