sshsentry: know when someone is trying to break into your server

For small business owners and indie operators without a security team: sshsentry reads your SSH logs for you and tells you in plain English what happened and what to do.

Free and open source. One Python script on your server. This page is a live, in-browser demo, and nothing you paste leaves this tab.

Watch it catch an attack

A server log replays line by line below. This is the bundled sample log: one attacker guesses passwords, another guesses until they get in. The alerts are generated live by the demo engine as each line arrives (the same engine as the "Try it on your own log" tool, with escalation on), followed by the daily digest.

Server log (/var/log/auth.log)

sshsentry alerts

What it does

Plain-English alerts

Brute force, logins after failed attempts, new IPs or countries, and new users or SSH keys. Sent to stdout, email, Slack or a webhook, with a CRITICAL escalation when an attacker gets in.

Daily digest

One short screen each morning, sent even on quiet days ("No incidents today"). Kept locally in SQLite and as text files.

JSON output

--format json for digests, threshold suggestions, sharing history, exports and verification, with a versioned schema field.

Verifiable exports

--export-digests makes a zip for your records or an auditor. --verify-export and --verify-chain report PASS or FAIL and name the day that broke.

Hash chaining

Each digest's hash covers the previous one, and the chain hash is printed in every emailed digest. Tamper-evident, not tamper-proof.

Learn mode

Watches quietly for a few days, then suggests a brute-force threshold based on your own traffic. Off by default.

sshsentry detects and alerts. It doesn't block anything, so pair it with fail2ban, a firewall and key-only SSH.

Try it on your own log

This is a demo port of sshsentry's detection logic, written in JavaScript so it runs entirely in your browser. Nothing is uploaded: there is no backend and no external script. The real tool is a single Python script (sshsentry.py); this page reproduces its --replay sample-auth.log --digest-now output for the four log rules, brute-force escalation and the daily digest. Not ported: GeoIP country lookups, the /etc/passwd and authorized_keys checks, SQLite state, alert delivery and sharing.

1. A log

Or paste lines from /var/log/auth.log or /var/log/secure. It stays in this tab.

2. Thresholds (same keys as sshsentry.yaml)

Equivalent to python3 sshsentry.py --replay your.log --digest-now

3. Alerts

4. Daily digest


    

  

  

  

    
Disclaimer

    
sshsentry helps you notice and respond to suspicious logins. It can't guarantee your server is secure or stop every break-in.

    
The responder runs real, destructive commands on your server: it locks accounts, blocks IPs, and rotates passwords and keys. You're responsible for every step you approve, so read each one before you say yes. When it says no unexplained changes were found, that doesn't prove your server is clean.

    
If an incident involves customer data, legal duties, or anything you can't explain, get a professional. If you have cyber insurance, call your insurer's hotline before you hire anyone.

    
sshsentry is provided as-is under the MIT license, with no warranty of any kind.

  

  

    

      Footnote: savings calculator (time saved and a breach-risk estimate)
  

    
Time first, then risk (estimates)

    
sshsentry's most concrete value is time. You read a short, plain-English digest instead of digging through auth logs.
    At a median sysadmin's loaded cost (about $68/hr), that's roughly 9 to 20 hours and $600 to $1,400 per server per year,
    if someone reviews logs by hand today. If nobody does, sshsentry saves no time; what you get is visibility you don't have now.

    
Second, and with care: the estimated avoided breach cost is about $1 to $4,700 a year
    per organization, depending on how cautious the assumptions are. That range comes from insurer claims data (Coalition, Verizon),
    Verizon's breach-vector data and IBM's small-business breach cost, multiplied by our own assumed effect of earlier detection.
    These are estimates, not guarantees. sshsentry detects and alerts; it does not block attacks or prevent breaches, and SSH is only
    one way in. Pair it with key-only auth, patching and fail2ban.

    

      
      
      
      
      
      
    

    

    

      
CautiousAggressive

      
        
Admin hours saved per year

        
Value of that time

        
Avoided-breach cost ESTIMATE
per organization, not per server; see assumptions below

        
Total estimated value per year

        
Subscription per year

        
Payback period

      
    

    
    

      How we calculate this (every assumption and source)
      
    
        
  • Loaded rate = base wage ÷ 0.70, because wages are 70.0% of total compensation (BLS ECEC, June 2026). A loaded or MSP rate is used as is. The default wage of $47.66/hr is the BLS OEWS May 2025 median for Network & Computer Systems Administrators, which gives $68.09/hr loaded.
    • 
        
  • Volume factor (assumption A3): v = 1 + 0.1 × log10(1 + attempts per day). Busier logs take a little longer to read, but only a little.
    • 
        
  • Manual review time (assumption A1): 10 min per server per week (cautious) or 20 (aggressive), times v. This is replaced by a 2-minute digest read per server per week. No published SSH-triage benchmark exists.
    • 
        
  • Hours saved per year = servers × 52 × max(0, minutes × v − 2) ÷ 60. If nobody reviews logs by hand today, the minutes are 0, so hours and time value are 0.
    • 
        
  • Value of time = hours saved × loaded rate.
    • 
        
  • Avoided-breach estimate = P × S × D × C, per organization per year:
          
      
            
    • P = 1.21% annual claim probability (Coalition 2026 Claims Report, businesses under $25M revenue; taken from a search summary, not read directly).
      • 
            
    • S = share of breaches through the SSH/credential vector. Cautious: 13% (Verizon DBIR 2026, credential abuse as the initial entry vector) × 25% assumed to be SSH (assumption A2) = 3.25%. Aggressive: 39% (DBIR 2026, credential abuse anywhere in the breach chain).
      • 
            
    • D = risk reduction from earlier detection (assumption A4, no source): 10% cautious, 30% aggressive. Detection shortens how long an attacker goes unnoticed; it does not prevent compromise.
      • 
            
    • C = breach cost. Cautious: $38,000 (Verizon 2026 Breach Impact Study, median SMB insured loss). Aggressive: $3.31M (IBM Cost of a Data Breach 2023, average for organizations with fewer than 500 employees, which includes lost business). The two differ by about 90×, so don't read the aggressive figure as a typical loss.
      • 
            
    • Result: about $1.49 per year (cautious) to $4,686 per year (aggressive).
      • 
          
    • 
        
  • Subscription = price × 12 × servers. sshsentry itself is free and open source (MIT). The $3/server/month default is a hypothetical premium-tier price (assumption A5).
    • 
        
  • Payback (months) = 12 × subscription per year ÷ total value per year.
    • 
        
  • Sources:
          
      
            
    • IBM Cost of a Data Breach 2023 (SMB, <500 employees: $3.31M)
      • 
            
    • Verizon DBIR 2026 (credential abuse: 13% initial entry, 39% anywhere in the chain)
      • 
            
    • Verizon 2026 Breach Impact Study (SMB median: $38K)
      • 
            
    • Coalition 2026 Claims Report (1.21%)
      • 
            
    • BLS OEWS May 2025 ($47.66/hr median)
      • 
            
    • BLS ECEC June 2026 (wages are 70% of compensation)
      • 
          
    
          Full citations are in sshsentry-financial-analysis.md.
    •