I run sshblack (found via Sebastian Hagedorn's site) as well as a portknocker in macOS Sierra, since the syslog now is accessed via the 'log show' command you'd have to adjust the log config settings below if you're on an earlier version of the os or use fail2ban following the linked instructions above. Also use key based authentication with passwords turned off (How to Set Up a Password-less SSH Login - add a passphrase). Then I download blocklists daily and block IPs in the firewall. Should be safe now...
block drop log quick from <ssh-block> to any
## In sshblack
my($LOG) = '/usr/bin/log show --style syslog --last 5s\|';
my($ADDRULE) = '/sbin/pfctl -t ssh-block -T add ipaddress';
my($DELRULE) = '/sbin/pfctl -t ssh-block -T delete ipaddress';
my($REASONS) = '(maximum authentication attempts exceeded|Invalid user|authentication failed|Auth fail)';
Add a 5 sec delay to the loop
Change to this (~line 190):
You do get an error in the log but it seems to work fine anyway.
To add blocklists that automatically updates, do this:
Install wget (which requires brew):
brew install wget
table <blocklist> persist file "/usr/local/etc/all.txt"
block drop log quick from <blocklist> to any
Create a LaunchDaemon:
sudo nano /Library/LaunchDaemons/blocklist.de.allips.plist
with the content:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<string>/bin/mkdir -p /usr/local/etc ; /usr/local/bin/wget -N -P /usr/local/etc rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt ; /usr/local/bin/wget -N -P /usr/local/etc https://lists.blocklist.de/lists/all.txt ; pfctl -t blocklist -T replace -f /usr/local/etc/all.txt</string>
<string>Blocklist.de PF Update</string>
Load the plist
sudo launchctl load -w /Library/LaunchDaemons/blocklist.de.allips.plist
This sshd config may also be useful in combination with the key authentication mentioned above:
Some background: I ran the blocking scripts (Blocking around 50000 IPs) and during approx. 5 days sshblack still detected ~160 IPs with failed login attempts to SSHD or SMTPD. This is why I went down the Portknocking route, now the SSH-attackers are blocked by the firewall instead.
Edit: I went through my sshd-log and spotted that I missed a "reason" in the log. I've added it above (the last one).
Failed ssh logins(with ip-blocklists enabled)
Date No of unique ips
13-Mar - 31
14-Mar - 29
15-Mar - 30
16-Mar - 39
17-Mar - 43
18-Mar - 41
19-Mar - 35
20-Mar - 44
21-Mar - 24
22-Mar - 18
23-Mar - 17
24-Mar - 20
25-Mar - 7 (portknocking enabled during this date)
Most of these guys were banned after 3 failed attempts.