adam/guard
Watch
1
0
Fork
You've already forked guard
 0
Code Issues Pull requests Projects Releases 5 Packages 1 Wiki Activity Actions
5 releases 5 tags
  • v0.1.0-rc.1+git5-73ab640 96f551be80

    Guard v0.1.0-rc.1+git5-73ab640 Pre-release

    adam released this 2026-10-23 12:47:17 +01:00 | 4 commits to main since this release

    Added

    • First version. Guard watches log files (followed through rotation and
      truncation) and the systemd journal (by unit and syslog identifier),
      matches lines with patterns holding one <IP>, counts each address's
      bounty within a window, and bans an address that reaches a watch's
      hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the
      watch's protocol and ports, for a time that grows for repeat
      offenders. IPv6 addresses are counted and banned by the ban list's
      prefix (/64). Never banned: never_ban (addresses, prefixes, host
      names), loopback, link-local, multicast; Housecarl adds its own. Bans
      wait while Housecarl can't be reached, across restarts.
    • Presets: sshd, jarl, housecarl, steward, bind-xfr,
      postfix-sasl, dovecot, nginx-auth, housecarl-drops
      (Housecarl's log of dropped packets, TCP only by default).
    • Commands: guard run, check, config [--example], presets,
      test (a watch's patterns over a log), status (through a local
      socket), bans, ban, unban, version.
    • A Debian package with a sandboxed systemd unit, as the guard user in
      the adm and systemd-journal groups, published with each release to
      the Gitea Debian registry (stable, or testing for a release
      candidate) along with tarballs for Linux amd64 and arm64.

    Fixed

    • The package's guard user is now in the adm and systemd-journal
      groups itself, as the documentation said, not only through its unit's
      SupplementaryGroups. sudo -u guard guard test and guard check
      could read neither /var/log's files (permission denied) nor the
      journal. Upgrading adds the groups.
    Downloads