Sentry detects and prevents bruteforce attacks against sshd using minimal system resources.


To prevent inadvertant lockouts, Sentry auto-whitelists IPs that have connected more than 3 times and succeeded at least once. Now that forgetful colleague behind the office NAT router won’t get us locked out of our system. Again. Nor the admin whose script just failed to login 12 times in 2 seconds.

Sentry includes support for adding IPs to a firewall. Support for IPFW, PF, ipchains is included. Firewall support is disabled by default. Firewall rules may terminate existing session(s) to the host (attn. IPFW users). Get your IPs whitelisted (connect 3x or use –whitelist) before enabling the firewall option.


Sentry is written in perl, which is installed nearly everywhere you find sshd. It has no dependencies. Installation and deployment is extremely simple.


Sentry supports blocking connection attempts using tcpwrappers and several popular firewalls. It is easy to extend sentry to support additional blocking lists.

Sentry was written to protect the SSH daemon but also blocks on FTP and MUA logs. As this was written, the primary attack platform in use is bot nets comprised of exploited PCs on high-speed internet connections. These bots are used for carrying out SSH attacks as well as spam delivery. Blocking bots prevents multiple attack vectors.

The programming style of sentry makes it easy to insert code for additonal functionality.


The primary goal of Sentry is to minimize the resources an attacker can steal, while consuming minimal resources itself. Most bruteforce blocking apps (denyhosts, fail2ban, sshdfilter) expect to run as a daemon, tailing a log file. That requires a language interpreter to always be running, consuming at least 10MB of RAM. A single hardware node with dozens of virtual servers will lose hundreds of megs to daemon protection. Sentry uses resources only when connections are made.

Once an IP is blacklisted for abuse, whether by tcpd or a firewall, the resources it can consume are practically zero.


  • ip

    An IP address. The IP should come from a reliable source that is difficult to spoof. Tcpwrappers is an excellent source. UDP connections are a poor source as they are easily spoofed. The log files of TCP daemons can be good source if they are parsed carefully to avoid log injection attacks.

All actions except report and help require an IP address. The IP address can be manually specified by an administrator, or preferably passed in by a TCP server such as tcpd (tcpwrappers), inetd, or tcpserver (daemontools).


  • blacklist

    deny all future connections

  • whitelist

    whitelist all future connections, remove the IP from the blacklists, and make it immune to future connection tests.

  • delist

    remove an IP from the white and blacklists. This is useful for testing that sentry is working as expected.

  • connect

    register a connection by an IP. The connect method will log the attempt and the time. See CONNECT.

  • update

    Check the most recent version of sentry against the installed version and update if a newer version is available. This is most reliable when LWP::UserAgent is installed.


Download Sentry

bash || sh
export SENTRY_URL=
curl -O $SENTRY_URL || wget $SENTRY_URL || fetch --no-verify-peer $SENTRY_URL

Run it:

perl --update

Running --update will:

  • create the sentry database (if needed)
  • install the perl script (if needed)
  • prompt you to edit /etc/hosts.allow (if needed)

That’s all.


Easy Way

perl /var/db/sentry/ --update

Hard Way

download as above

diff /var/db/sentry/

resolve any configuration differences

cp /var/db/sentry/
chmod 755 /var/db/sentry/