Close port 22.Keep the shell.
Port 22 is the most scanned port on the internet. SSHepherd closes it and keeps your shell access working.
Port 22 answers everyone.Even after the usual fixes.
An internet-facing SSH daemon answers every probe it receives. That answer is enough to fingerprint the OpenSSH version, match it against known CVEs, and start credential stuffing.
A scanner finds the new port seconds later, version banner and all.
Password guessing gets harder. The daemon still answers every probe, and every new CVE.
The exposure moves to the gateway, which is now the thing to patch tonight.
SSHepherd doesn’t guard port 22.It closes it.
The port is closed.Not hidden.
SSHepherd closes the listening port on the protected host. Not filtered, not redirected, not port-knocked — there is no socket accepting inbound connections.
The host makes an outbound connection to the SSHepherd broker and holds it. An administrator authenticates to the broker, and their session is carried back down that existing outbound path. Nothing initiates a connection to the server, so there is no inbound path to exploit.
Only authorised identities are admitted. Every session can be monitored, recorded and ended on demand.
Developed by Full Armor Corporation. Distributed, deployed and supported across Southeast Asia by Auris.
- Nothing listens inbound
- Access via broker only
- Every session monitored
Your team keeps working.Scanners get nothing.
Administrators keep using the terminal, keys and tooling they already have.
There is no service to enumerate, so no version to fingerprint and no login to brute-force.
Failed-authentication noise from the open internet disappears, because nothing reaches the daemon.
SSH sessions can be monitored live, recorded for audit, and terminated on demand.
Watch it work.
SSHepherd® with Linux SSH. A recorded demo from Full Armor, the developer of SSHepherd®.
Common questions.
Does SSHepherd replace SSH?
No. SSH is still the protocol and your existing client, keys and workflows are unchanged. SSHepherd removes the inbound listening port and carries the session over an outbound connection instead.
Is this the same as changing the SSH port or using port knocking?
No. Both of those leave a service listening — one on a different number, one behind a sequence. SSHepherd closes the port completely, so there is no socket to discover by any means.
How long does it take to protect a server?
About ten minutes per host. SSHepherd sits over existing infrastructure and does not require the network to be re-architected.
What happens to my audit trail?
It improves. Sessions run through the broker, so they can be recorded end to end and exported as a clean audit trail, rather than reconstructed from server-side logs.
See it onyour own servers.
Tell us roughly what you run: how many servers, and whether they are on-premise or in the cloud. We will set up a demo with an engineer and reply within one business day.