Active Threat Protection Scope
IDS Guard automatically detects and mitigates SSH brute-force attempts, HTTP 404 scanner spam, malicious URL probing, rapid connection floods, and unauthorized admin login attempts.
IDS Guard is an integrated intrusion detection and automated threat mitigation service embedded directly into the One-Click infrastructure. It continuously monitors web server access logs, system authentication streams, socket connections, and network behavior in real time to neutralize malicious sources before service degradation occurs.
Operating as an active defensive engine alongside RuleEngine, IDS Guard transforms passive log tracking into automated kernel-level firewall blocks, dynamic rate-limiting, and centralized threat correlation.
IDS Guard automatically detects and mitigates SSH brute-force attempts, HTTP 404 scanner spam, malicious URL probing, rapid connection floods, and unauthorized admin login attempts.
IDS Guard runs as a native systemd background daemon (one-click-guard.service), giving it unmediated visibility across both system security logs and web hosting virtual host targets.
The monitoring pipeline continuously parses and correlates events across:
/var/log/auth.log and /var/log/secure (SSH brute-force detection).ss -tun to detect active TCP connection floods./etc/one-click/rule-engine/guard/monitor_stats.db.
To protect legitimate users and minimize false positives, IDS Guard applies threshold-based temporary blocks that dynamically drop offending traffic via iptables / ip6tables.
| Threat Event | Threshold Trigger | Mitigation Action | Default Duration |
|---|---|---|---|
| SSH Brute-Force | Repeated invalid SSH auth failures | Kernel IP Drop (Port 22) | 1 Hour (3,600s) |
| Web Scanner / 404 Spam | 10+ 404 responses from single IP | All-Port Firewall Drop | 1 Hour (3,600s) |
| Admin Login Spam | 5+ failed /wp-login.php attempts |
All-Port Firewall Drop | 24 Hours (86,400s) |
| Permanent Bans | Manual override or repeat offender escalation | Permanent IPTables Rule | 10 Years (315,360,000s) |
# Temporarily block target attacker ID for 1 hour (3600s)
one-click engine 'audit block 12'
# Block target ID for custom duration (e.g. 300 seconds)
one-click engine 'audit block 12 dur=300'
# Permanently ban target attacker ID
one-click engine 'audit block 12 perm'
# Manually unblock target IP/ID and record override in history
one-click engine 'audit unblock 12'IDS Guard consolidates internal threat metrics with external reputation engines and local Fail2Ban jail states into a single unified security console.
/etc/fail2ban/jail.local) for application ports./etc/one-click/rule-engine/guard/abuseipdb.key, automatically reporting malicious IP behavior to AbuseIPDB.# Store encrypted AbuseIPDB API key
one-click engine 'audit key YOUR_API_KEY'
# Query IP reputation and confidence score via AbuseIPDB
one-click engine 'audit lookup 1.2.3.4'
# View global banlist (Combines RuleEngine Guard + Fail2Ban Jails)
one-click engine 'audit banlist'
# Display historical security events and mitigation log
one-click engine 'audit history'
# View active SSH brute-force metrics and target usernames
one-click engine 'audit ssh'By unifying real-time socket tracking, web application log analysis, automated net-filter blocks, and external threat intelligence, IDS Guard provides an adaptive, hands-free security layer that keeps hosted infrastructure online and protected against active network threats.