Skip to content

LockWall v2.1.0 — SSH Protection

Latest
Latest

Choose a tag to compare

View all tags
@SMSerg2000 SMSerg2000 released this 12 Jul 13:24
v2.1.0
2dc4521

🔑 LockWall v2.1.0 — SSH Protection

LockWall now protects a fourth attack vector: Windows OpenSSH Server.

What's new

  • SSH brute-force protection — LockWall watches the OpenSSH/Operational event
    log and automatically blocks IPs with repeated failed sshd logins
    (Failed password for … from IP port …).
  • Shared thresholds — SSH attempts count together with RDP, OWA and SQL Server:
    one attacker gets blocked no matter which door they knock on. Progressive blocking
    and password-spray detection apply to SSH too.
  • Off by default — enable it in Settings → SSH Protection (requires Windows
    OpenSSH Server installed; service restart to apply). Per-source thresholds supported.
  • UI & alerts — green SSH badge on Blocked IPs, Dashboard protection indicator,
    SSH labels in Telegram/Email notifications.

Reliability

  • Survives early system boot — if Windows Firewall (BFE) isn't ready yet when
    the service starts, engine initialization now retries with backoff instead of
    dying silently (the Event 7034 case). The service also registers dependencies
    on BFE/EventLog and installs an SCM auto-restart recovery policy.
  • Web UI is isolated from protection — a busy port 8880 no longer takes the
    blocking engine down; the dashboard just retries in the background.

Notifications

  • Native TLS trust — certificate verification for Telegram/SMTP now uses the
    Windows certificate store (like any native app), fixing
    CERTIFICATE_VERIFY_FAILED under the service account while keeping
    verification ON.
  • New: lockwall.exe test-notify — send a test notification from the console
    to verify Telegram/Email delivery without waiting for a real block.

Notes

  • Why not Security Event 4625? On Windows, sshd authenticates via a local logon call,
    so its 4625 events contain no source IP — the sshd log channel is the only reliable
    source. LockWall reads it natively (no agents, as always).
  • The log parser is hardened against username-based IP spoofing, and single attempts are
    never double-counted.
  • Upgrading over v2.0.0 is seamless: your configuration, password, whitelist and block
    history are preserved.

⬇️ Download

LockWall-Setup-x64.msi (~14.4 MB) — Windows 10 / Server 2016+ (64-bit).

Run the installer — on upgrade your existing settings are kept; on a clean install open
http://127.0.0.1:8880/ and log in with admin / lockwall (you'll be asked to change
the password on first login).

⚠️ Whitelist your trusted networks before exposing the server — see the
User Guide.

🔐 Verify your download

SHA-256:

d4d4f7cd7176d9b7ddbccf54e57b7e49645f4f739d1cace7172b959a96ad7e1c  LockWall-Setup-x64.msi

Get-FileHash .\LockWall-Setup-x64.msi -Algorithm SHA256

VirusTotal scan:
https://www.virustotal.com/gui/file/d4d4f7cd7176d9b7ddbccf54e57b7e49645f4f739d1cace7172b959a96ad7e1c

Download only from this Releases page or from lockwall.app.

Full history: CHANGELOG.md

Assets 4
Loading