OpenSSH Protection Settings for Windows

RdpGuard's OpenSSH protection monitors failed SSH logins on Windows and temporarily blocks source IP addresses when detections reach your configured limit. Run RdpGuard on the Windows computer hosting OpenSSH Server, then enable protection as described below.

1. Run RdpGuard Dashboard as administrator. Under Monitored protocols, click OpenSSH while its status is Disabled.

   

2. Wait for RdpGuard to save the setting and restart its service automatically. The OpenSSH status changes to Enabled. This button toggles protection directly; clicking it again disables protection.

To adjust the failed-login limit or block duration, open Tools, Options, General. You can also whitelist trusted IP addresses and configure notifications when an address is blocked.

OpenSSH records authentication messages in Event Viewer, Applications and Services Logs, OpenSSH, Operational. This is the log used by RdpGuard's OpenSSH protection.

Typical messages include Failed password and Invalid user:

sshd: Failed password for invalid user test2 from 120.224.50.233 port 57821 ssh2
Invalid user admin from 203.0.113.25 port 51957

• Make sure OpenSSH Server is installed and running, and the OpenSSH, Operational log exists and is enabled. If OpenSSH was installed after RdpGuard protection was enabled, restart the RdpGuard service so it can start monitoring the new log.
• Check for new Event ID 4 entries with the failed-password or invalid-user messages shown above. RdpGuard reads new events from OpenSSH/Operational; the presence of Security event 4625 alone does not verify this module's detection.
• If OpenSSH logs only to files, check SyslogFacility in %ProgramData%\ssh\sshd_config. LOCAL0 sends logs to files, which this module does not read. The default AUTH uses Windows event logging. Restart OpenSSH Server after changing its configuration; see Microsoft's OpenSSH logging documentation.
• If an address is detected but not blocked, check the configured limit and whitelist. For monitoring errors, open View, Show event log in RdpGuard Dashboard.

The current OpenSSH event parser recognizes IPv4 addresses in the messages above. By default, blocked addresses lose access to all server ports. If you use blocking for selected ports, include the SSH listening port - normally 22, or your custom port.