FAQ
Does it change my server?
No. It reads the auth log, /etc/passwd and authorized_keys, and writes only its own SQLite state file (plus optional digest text files and an optional alert log). It never edits firewall rules, accounts or keys.
Does it block attacks?
No. sshsentry is detection only. Use fail2ban and a firewall for blocking. A responder is planned and appears only as a simulation in the live demo; it is not in this release.
Does anything leave my machine?
Only if you turn it on: email, Slack or webhook alerts, the digest delivery, or opt-in sharing of attacker IPs. All are off by default.
How noisy is it?
The first run is a silent baseline, repeats are muted for 60 minutes, and you can --approve your own IPs. Each destination can filter by min_severity.
What does it need?
Linux, Python 3.9+ and PyYAML. geoip2 and a free GeoLite2 database are optional, for country checks.
Is it for big fleets or compliance?
No. It's for one or a few servers: small businesses, indie developers and homelabs.
Can I see the code?
Yes, it's one MIT-licensed Python file on GitHub.
Still stuck? Ask in Discussions.