I'm running a VPS (under ArchLinux) and was wondering if sshguard was useful in the following case.
My iptables rule for SSH in looks like this :
iptables -A INPUT -p tcp --source $Trusted --dport 22 -j ACCEPT
with $Trusted a set of Trusted IPs, currently only my VPN IP. Basically iptables deny all and then accept only what I need.
I had a look at sshguard and it requires to create an iptables chain and then use :
iptables -A INPUT -p tcp --dport 22 -j sshguard
I'm asking that question because to me it looks like adding this rule opens up ssh more than it is with an IP restriction.
Should I use sshguard normally or only use the following rule in case my Trusted IP has been spoofed ?
iptables -A INPUT -p tcp --source $Trusted --dport 22 -j sshguard