Skip to content

Use case

SSH brute force, from the log to a verified block.

Every server with SSH exposed gets login attempts all day long. atalince counts those attempts, blocks the source in the kernel firewall and shows when the block is actually there.

01The problem

Noise that hides what matters.

Bots try users and passwords nonstop. With a weak password, one attempt can succeed. Even with key-only login, the noise fills the log and hides the attempt that matters.

Blocking helps, but a block only counts if the rule is in the firewall. A reload, another tool or a silent failure can leave it out.

02How atalince handles it

Four steps, all visible in the dashboard.

  1. 01 · Read

    journald, auth.log or secure

    The agent finds the source on its own and switches to journald when the file stops receiving sshd's lines.

  2. 02 · Count

    One attempt per connection

    Wrong passwords, invalid users and attempts against existing users on key-only servers. IPv4 and IPv6.

  3. 03 · Block

    In the kernel firewall

    In protection mode, the IP goes into the ATALINCE-BANS chain. Before turning it on, add your IP to the allowed IPs.

  4. 04 · Check

    By reading the rule back

    The block only shows as verified after the agent reads the rule in the firewall. Without evidence, the state stays unknown.

03Verified protection

An applied block is not a verified block.

Request, reported application and firewall read are different states. atalince shows each one separately and only calls verified what it read back from the kernel.

  1. Detected

    The detector reads the log and identifies the attack. · 14:19:03 UTC

  2. Block requested

    The dashboard asks that server's agent to block. · 14:19:05 UTC

  3. Applied, reported by agent

    The agent applies it to the firewall and sends a receipt. · 14:19:06 UTC

  4. Firewall read verified

    A kernel read confirms the rule is there. · 15:00:00 UTC

No evidence; this is not success.

When the receipt or the read is missing, the state stays unknown. The dashboard never rounds up.

api-sp-01 · atalince-agentDetected

04Beyond the block

Close the door, not just the gap.

  • Hardening checks 12 sshd directives, such as PermitRootLogin and PasswordAuthentication, by the value actually in effect.
  • The CVE inventory shows whether the installed OpenSSH version has a known vulnerability.
  • Alerts in the dashboard and by email; on Pro, also via Slack, Telegram and webhook.

Go deeper

Founders program

Use atalince from the start.

Pro features for up to 3 servers, free of charge, for 12 months. Every application is reviewed by the team.

Become a Founder