OpenSSH Brute-Force Protection for Windows

OpenSSH provides encrypted remote access and file transfers through SSH, SFTP and SCP. On Windows, administrators can use OpenSSH Server to manage machines remotely and exchange files with Windows, Linux and other systems. It is available as a Windows component starting with Windows 10 build 1809 and Windows Server 2019.

Expose an SSH server to the Internet, and automated password guessing can begin within seconds. SSH servers listening on port 22 are a common target for automated attacks. Bots cycle through usernames and passwords, retry continuously and fill your logs with failed login attempts. Encryption protects the connection, but it does not stop someone from trying to guess an account's password.

The Windows Security log can show the scale of this activity. In this example, filtering for Event ID 4625 returns 9,021 entries. The selected event identifies sshd.exe as the caller process:

Date and time        Source                               Event ID  Task Category  Keywords
2021-08-15 07:08:19  Microsoft Windows security auditing  4625      Logon          Audit Failure
2021-08-15 07:08:04  Microsoft Windows security auditing  4625      Logon          Audit Failure
2021-08-15 07:07:55  Microsoft Windows security auditing  4625      Logon          Audit Failure
2021-08-15 07:07:54  Microsoft Windows security auditing  4625      Logon          Audit Failure
2021-08-15 07:07:54  Microsoft Windows security auditing  4625      Logon          Audit Failure
2021-08-15 07:07:54  Microsoft Windows security auditing  4625      Logon          Audit Failure

Selected Windows Security log entries: repeated failed logons.

Log Name:      Security
Source:        Microsoft Windows security auditing
Event ID:      4625
Logged:        8/15/2021 7:07:55 AM
Task Category: Logon
Keywords:      Audit Failure

Account Name:  NOUSER

Failure Information:
  Failure Reason: Unknown user name or bad password.
  Status:         0xC000006D
  Sub Status:     0xC0000064

Process Information:
  Caller Process ID:   0xec0
  Caller Process Name: C:\Windows\System32\OpenSSH\sshd.exe

Selected fields from event 4625: a failed logon initiated by sshd.exe.

Repeated failures across many usernames are a typical sign of automated password guessing. A single failed login can also be a legitimate user's typing mistake. RdpGuard monitors failed-login events in the OpenSSH Operational log and temporarily blocks the source IP address when detections reach your configured limit. This cuts off further attempts from that address during the blocking period and reduces repeated authentication traffic.

For 64-bit Windows and Windows Server. Supported Windows versions.

OpenSSH Brute-Force Protection for Windows

See Also