Many times on cloud hosting’s vps servers scanned by automated tools, like ssh scans.
This tools searching so many ports, for example ssh (22) port.
I Build an agent tool for solve this ssh scan issues.This tool using onuion/onuion model for analyze ssh sessions (like current session and old session history).
onuion/sshd (a.k.a onuion-sshd):
Onuion SSHD PAM Agent is a real-time risk analysis and enforcement layer for SSH connections. It integrates deeply with the Linux PAM (Pluggable Authentication Modules) stack to analyze login attempts, calculate risk scores, and automatically block malicious actors before they can gain access.
Real-time Risk Scoring: Uses the onuion engine to evaluate SSH login attempts based on historical data.
PAM Integration: Lightweight bridge between the PAM auth process and the security agent.
Automated Enforcement: Automatically blocks high-risk IP addresses using iptables.
Stateful Analysis: Tracks IP and User history (successful/failed attempts, device fingerprints, geo-data stubs).
Daemon Mode: Runs as a standard systemd service for reliability and persistent monitoring.
JSON Logging: Structured logs for easy integration with SIEM or log management tools.
🛠️ Installation
<ol>
<li>Prerequisites</li>
</ol>
Python 3.8+
iptables (for IP blocking)
PAM-enabled Linux system (Ubuntu, Debian, CentOS, etc.)
<ol>
<li>Install with script</li>
</ol>
<pre><code>
curl -o install.sh https://raw.githubusercontent.com/onuion/sshd/refs/heads/main/install.sh

chmod +x install.sh

./install.sh

</code></pre>
<ol>
<li>Configure PAM</li>
</ol>
To enable the agent for SSH sessions, you need to add it to your PAM configuration (usually /etc/pam.d/sshd or /etc/pam.d/common-auth):
Become a Medium member
Add the following line to the top of your PAM config:
auth required pam_exec.so expose_authtok /usr/bin/python3 /opt/onuion-sshd/pam_onuion_check.py
Note: The script uses environment variables provided by pam_exec.so (PAM_USER, PAM_RHOST) to communicate with the agent.
⚙️ CLI Usage (osshd)
The osshd command is the main interface for managing the agent.
Service Control
<pre><code>
osshd start: Start the agent service.

osshd stop: Stop the agent service.

osshd restart: Restart the agent (required after config changes).

osshd status: Check the status of the service.

</code></pre>
Configuration Management
<pre><code class="language-bash">
osshd config --list: Show current configuration values.

osshd config --set KEY=VALUE: Update a configuration value.

</code></pre>
Example Screenshot:
<img src="https://media.daily.dev/image/upload/s--v-bfdrys--/f_auto/v1775394361/ugc/content_00d07f00-1310-4274-8360-da14cef99e69?_a=BAMAMiWQ0" alt="img.png">
<h2>🛡️ Security &amp; Reliability</h2>
The agent is designed with a Fail-Open policy. If the agent service is down or there is a communication error, the PAM bridge will default to <code>continue_connection</code> to prevent legitimate users from being locked out due to an internal error.

🚀 Daily Open Source Tools Squad delivers daily articles, open-source projects, and technical resources for Developers & DevOps pros. Stay updated with the latest trends & insights!

📬 Join our mailing list! → theinfinity.dev

Daily Open Source Tools

onuion-sshd is an AI-powered SSH security agent that integrates with Linux PAM to perform real-time risk scoring on login attempts. It analyzes session history, calculates risk scores using the onuion model, and automatically blocks high-risk IPs via iptables. It runs as a systemd daemon, supports JSON logging for SIEM integration, and uses a fail-open policy to avoid locking out legitimate users. Installation is via a shell script, with PAM configuration requiring a single line addition.

If you need secure your ssh server then use onuion-sshd AI Agent.