CLI reference
From sshsentry --help in 0.2.0. Installed from PyPI the command is sshsentry; from the repo it's python3 sshsentry.py.
| Option | What it does |
|---|---|
-c, --config PATH | YAML config path (default /etc/sshsentry/sshsentry.yaml) |
--log PATH | override the log file path |
--db PATH | override the SQLite state path |
--replay FILE, --dry-run FILE | process FILE from the start and print alerts; never sends anything |
--once | process new log lines once, then exit (timers) |
--approve IP | mark an IP as known for all users, then exit |
--test-alerts | send a sample alert to each enabled destination |
--digest-now | print a digest of the last 24 h now (sent if digest.send; print-only with --replay) |
--digests [N] | list the last N stored daily digests (default 7) |
--digest DATE | show one stored daily digest (YYYY-MM-DD) |
--resend DATE | send a stored daily digest again |
--export-digests START END | zip stored digests for a date range, with manifest + SHA-256 |
-o, --output PATH | with --export-digests: zip path |
--host-label LABEL | with --export-digests: label in the manifest |
--verify-chain | recompute the local digest hash chain |
--verify-export ZIP | verify an exported zip (no config needed) |
--expected-head HASH | with --verify-export: a chain hash that left the server earlier |
--suggest-threshold | print the learn-mode threshold suggestion |
--accept-threshold | write the suggested brute-force threshold into the config |
--show-shared | list everything this install has shared |
--forget-me | delete local sharing history (and ask the endpoint to delete it, if configured) |
--local-only | with --forget-me: skip the remote request |
--format text|json | output format for digests, replay, suggestions, sharing and verify commands |
Common recipes
sudo sshsentry --approve 198.51.100.23 # stop new-IP alerts for your office IPsudo sshsentry --test-alerts # check email/Slack/webhooksudo sshsentry --digests # last 7 days at a glancesudo sshsentry --export-digests 2026-10-01 2026-10-31 -o oct.zipsshsentry --verify-export oct.zip --expected-head 3f9a0c1d2b4e
JSON documents carry a "schema" field (for example sshsentry.replay/1). Timestamps are UTC ISO-8601.