Tink vs sshguard
sshguard is the log-to-firewall ban daemon. It reads auth logs, counts attacks, and tells iptables or pf to block the IP. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
sshguard blocks IPs. Tink answers “why is this VPS sick?”
Accidental sysadmins land on sshguard because a syslog pipe plus BACKEND=iptables stops the brute-force wave. Then disk is at 91%, nginx dies, and last night's block list does not say what to run. A filling /var is a Tink warning; it is not a THRESHOLD hit.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using sshguard if you already want log-to-firewall SSH bans. Use Tink if you run Linux servers and want a mechanic. They can sit on the same box.
| Feature | Tink | sshguard |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Install sshguard, pick a BACKEND (iptables/nftables/pf), and pipe syslog into it |
| What you get | Working monitoring, diagnosis, and approved fixes | Log-to-firewall bans: THRESHOLD, BLOCK_TIME, DETECTION_TIME — not a fleet mechanic |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source. You still pay the person who SSHs in after the outage |
| Hidden costs | None — fully managed | Backend vs nftables drift, syslog pipe, and whether anyone watched disk while IPs were being blocked |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Auth-log parser + firewall backend. sshguard does not watch fill time or propose a restart |
| Configuration | None after install — heuristics and AI | sshguard.conf: BACKEND, THRESHOLD, BLOCK_TIME, and whether the log pipe matches this distro |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read sshguard block lists and firewall counters yourself |
| Fix execution | Proposes and executes approved commands with an audit trail | Blocks IPs only — sshguard cannot restart nginx, free disk, or rotate a cert |
| Alerting | Built-in across 8 channels | None by default — a blocked /24 is not a Telegram page |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live blocks only — sshguard does not forecast fill time or a quiet NIC going bad later |
| SSH brute-force detection | Built-in — parses auth.log every scan | Yes — that is the job. It still will not say the disk is at 91% |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down, sshguard is down too — no presence ping to Telegram |
| Public status page | Shareable URL with 90-day history | Not included — sshguard has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — a block list is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + sshguard.conf. No mechanic you text when /var filled |
| Learning curve | None — works after install | Low to start the daemon; higher to keep the firewall backend and log pipe honest |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators who already want log-to-firewall SSH bans and will still SSH in when the box is sick |
When sshguard is the right choice
Keep using sshguard when you already want that exact job:
- Log-to-firewall bans — you need THRESHOLD hits on auth.log, not a fleet digest.
- Host-oriented — sshguard reads logs and talks to iptables/pf; it is not a mechanic.
- No extra service — a daemon you install on the box, not a hub, SaaS mechanic, or Telegram bot.
- No conversation layer wanted — some operators prefer sshguard.conf and will never use a mechanic.
The real cost of “just run sshguard”
The package is cheap to install. A working ops loop for five Linux boxes is not:
- A complete sshd block list still means you SSH into the host and change the box by hand when it gets sick
- Host fill, nginx, certs, and a quiet agent never appear unless you built extra checks
- A filling /var is a Tink disk warning on every scan — sshguard stays a firewall list until you are looking
- A single VPS with nobody logged in still needs a mechanic, not another blocked /24
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens sshguard after the outage, and every scan includes a diagnosis a quiet block list will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs lsof · Tink vs ss · Tink vs tcpdump