adam/guard
Watch
1
0
Fork
You've already forked guard
 0
Code Issues Pull requests Projects Releases 5 Packages 1 Wiki Activity Actions
5 releases 5 tags
  • v0.1.0-rc.1 c4e513f99c

    Guard v0.1.0-rc.1 Pre-release

    adam released this 2026-10-22 16:45:55 +01:00 | 7 commits to main since this release

    Added

    • First version. Guard watches log files (followed through rotation and
      truncation) and the systemd journal (by unit and syslog identifier),
      matches lines with patterns holding one <IP>, counts each address's
      bounty within a window, and bans an address that reaches a watch's
      hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the
      watch's protocol and ports, for a time that grows for repeat
      offenders. IPv6 addresses are counted and banned by the ban list's
      prefix (/64). Never banned: never_ban (addresses, prefixes, host
      names), loopback, link-local, multicast; Housecarl adds its own. Bans
      wait while Housecarl can't be reached, across restarts.
    • Presets: sshd, jarl, housecarl, steward, bind-xfr,
      postfix-sasl, dovecot, nginx-auth, housecarl-drops
      (Housecarl's log of dropped packets, TCP only by default).
    • Commands: guard run, check, config [--example], presets,
      test (a watch's patterns over a log), status (through a local
      socket), bans, ban, unban, version.
    • A Debian package with a sandboxed systemd unit, as the guard user in
      the adm and systemd-journal groups, published with each release to
      the Gitea Debian registry (stable, or testing for a release
      candidate) along with tarballs for Linux amd64 and arm64.
    Downloads