LockWall v2.1.0 — SSH Protection

🔑 LockWall v2.1.0 — SSH Protection

LockWall now protects a fourth attack vector: Windows OpenSSH Server.

What's new

• SSH brute-force protection — LockWall watches the OpenSSH/Operational event
  log and automatically blocks IPs with repeated failed sshd logins
  (Failed password for … from IP port …).
• Shared thresholds — SSH attempts count together with RDP, OWA and SQL Server:
  one attacker gets blocked no matter which door they knock on. Progressive blocking
  and password-spray detection apply to SSH too.
• Off by default — enable it in Settings → SSH Protection (requires Windows
  OpenSSH Server installed; service restart to apply). Per-source thresholds supported.
• UI & alerts — green SSH badge on Blocked IPs, Dashboard protection indicator,
  SSH labels in Telegram/Email notifications.

Reliability

• Survives early system boot — if Windows Firewall (BFE) isn't ready yet when
  the service starts, engine initialization now retries with backoff instead of
  dying silently (the Event 7034 case). The service also registers dependencies
  on BFE/EventLog and installs an SCM auto-restart recovery policy.
• Web UI is isolated from protection — a busy port 8880 no longer takes the
  blocking engine down; the dashboard just retries in the background.

Notifications

• Native TLS trust — certificate verification for Telegram/SMTP now uses the
  Windows certificate store (like any native app), fixing
  CERTIFICATE_VERIFY_FAILED under the service account while keeping
  verification ON.
• New: lockwall.exe test-notify — send a test notification from the console
  to verify Telegram/Email delivery without waiting for a real block.

Notes

• Why not Security Event 4625? On Windows, sshd authenticates via a local logon call,
  so its 4625 events contain no source IP — the sshd log channel is the only reliable
  source. LockWall reads it natively (no agents, as always).
• The log parser is hardened against username-based IP spoofing, and single attempts are
  never double-counted.
• Upgrading over v2.0.0 is seamless: your configuration, password, whitelist and block
  history are preserved.

---

⬇️ Download

LockWall-Setup-x64.msi (~14.4 MB) — Windows 10 / Server 2016+ (64-bit).

Run the installer — on upgrade your existing settings are kept; on a clean install open
http://127.0.0.1:8880/ and log in with admin / lockwall (you'll be asked to change
the password on first login).

⚠️ Whitelist your trusted networks before exposing the server — see the
User Guide.

🔐 Verify your download

SHA-256:

d4d4f7cd7176d9b7ddbccf54e57b7e49645f4f739d1cace7172b959a96ad7e1c  LockWall-Setup-x64.msi

Get-FileHash .\LockWall-Setup-x64.msi -Algorithm SHA256

VirusTotal scan:
https://www.virustotal.com/gui/file/d4d4f7cd7176d9b7ddbccf54e57b7e49645f4f739d1cace7172b959a96ad7e1c

Download only from this Releases page or from lockwall.app.

---

Full history: CHANGELOG.md

LockWall v2.0.0

🛡️ LockWall v2.0.0 — First Public Release

Real-time brute-force protection for RDP, OWA, and SQL Server on Windows — from a
single lightweight service. LockWall watches the Windows Event Log, detects failed
logins, and automatically blocks attacking IPs via Windows Firewall, with a web
dashboard, Telegram/Email notifications, and optional GeoIP.

Free proprietary freeware — all three protocols, every feature, no license key,
no seat limits.

---

⬇️ Download

LockWall-Setup-x64.msi (~13.5 MB) — Windows 10 / Server 2016+ (64-bit).

Run the installer, accept the license — the service installs to C:\LockWall and
starts automatically. Then open http://127.0.0.1:8880/ and log in with
admin / lockwall (you'll be asked to change the password on first login).

⚠️ First-time setup: whitelist your trusted networks before exposing the
server, so you never lock yourself out. See the User Guide.

---

🔐 Verify your download

LockWall is closed-source freeware, so every release is verifiable.

SHA-256:

a6c8994acb543ac07a5b4c81904d91d45bb1741d895801b918ea0b957f5a676b  LockWall-Setup-x64.msi

Get-FileHash .\LockWall-Setup-x64.msi -Algorithm SHA256

VirusTotal scan (0 detections):
https://www.virustotal.com/gui/file/a6c8994acb543ac07a5b4c81904d91d45bb1741d895801b918ea0b957f5a676b

Download only from this Releases page or from lockwall.app —
never from third-party mirrors.

---

💻 Requirements

• Windows 10 / Server 2016 or newer, 64-bit
• Administrator privileges (Windows Firewall + audit policy)
• ~100 MB disk

---

See CHANGELOG.md for the full feature list.