Skip to content
shadcn.io

shadcn.io is not affiliated with official shadcn/ui

Monitoring blocks

Pro

SSH Login Activity Monitoring Block for Svelte

Two tabs: eight open SSH sessions with a word for usual or new origin and a local End session with Undo, and four hours of failed attempts in 10-minute columns beside the addresses behind them, a pattern word and Copy as ban list.

Framework
UI library

Preview

Preview width

Installation

Part of Pro
Pro unlocks the code and one-line install of every Pro button and text effect, plus the MCP for your AI editor.
Get ProSign in
Have Pro already? Sign in to open it.Opens here as soon as you're Pro.

Overview

Spot a new origin among the sessions and a brute-force run among the failures with this SSH view for Svelte with Ark UI. It is Knockbeat, an access-monitoring agent, and the header is worked out from the data ("2 of 8 open sessions come from an origin that is new for that user"). In a hairline frame with a plus mark on each corner, the Sessions tab lists eight sessions: the user, the source address from a documentation range, when it began and how long it has been idle against a typed 14:20 UTC, and the word "Usual origin" or "New origin for this user, first seen 12 Oct", new origins first. End session is a ghost button with Undo in the same cell. The Attempts tab draws failed attempts per 10 minutes for the last four hours, then lists the addresses with attempts, usernames tried and a pattern word (Brute force, Password spray or Single miss) worked out from those two numbers. Ticked addresses copy as a ban list. Guides draw the frame and its bands; the entrance is CSS only.

FAQ

How do I load my own sessions and attempts?

Edit SESSIONS (user, source, minutes after midnight when it began, idle minutes and whether the origin is new), BUCKETS (24 counts, one per 10 minutes) and SOURCES (address, attempts, distinct usernames). The idle and open times come from the typed NOW, and the pattern word from patternOf: 20 or more usernames is a spray, 30 or more attempts on few usernames is brute force, anything else a single miss.

Does End session end anything?

No. It marks the row "Ended in this demo" and offers Undo in the same place, so the row never changes height; focus moves to Undo and back. In your app call the endpoint that closes the session and keep the same confirmation.

Is the ban list real?

Copy as ban list puts the ticked addresses on the clipboard, one per line, and says so. Nothing is blocked; paste the list into your firewall or SSH deny rules yourself.

How is a pattern worked out?

A spray tries many usernames a few times each; brute force hammers a few usernames; a single miss is one or two attempts. The thresholds are plain numbers in patternOf so you can tune them to your own traffic.

What stays local in the demo?

All of it: sessions, attempts and addresses are invented, the clock is a typed 14:20 UTC and nothing is ended, blocked or sent.

All 100 monitoring blocks