locksshould

Locksshould is a term used in information security discussions to describe a policy or mechanism that ties SSH access controls to automatic lockout actions following suspicious authentication activity. The term blends “lock” and “SSH” and is used to explore safeguards against brute-force and credential-stuffing attacks on SSH services.

Origin and usage of the term are informal; it does not represent a standardized protocol. In discussions, locksshould refers to strategies that impose temporary or permanent access restrictions when authentication anomalies are detected. Common elements associated with the concept include temporary account lockouts, IP-based blocking, connection rate limiting, and enforcing stronger authentication requirements such as keys and multi-factor authentication.

Mechanisms and implementation options in practice may involve server configurations and external tools. SSH server settings can enforce limits on failed attempts and disable root access to reduce risk. External tools like fail2ban, psad, or generic firewall controllers can be employed to identify offending addresses and institute lockouts or bans for a defined period. Rate limiting, monitoring, and alerting are often integrated to inform administrators of ongoing attack patterns while maintaining legitimate access for authorized users.

Criticism and considerations center on the potential downsides of lockouts. Overly aggressive policies can lock out legitimate users, particularly in environments with shared or dynamic IP addresses. There is also potential for denial-of-service risks and administrative overhead. Effective implementations typically balance security with accessibility, leveraging key-based authentication, MFA, and sensible thresholds to minimize disruption.

Related concepts include SSH, authentication, account lockout policies, rate limiting, and security tools such as fail2ban.