adam/guard
Watch
1
0
Fork
You've already forked guard
 0
Code Issues Pull requests Projects Releases 5 Packages 1 Wiki Activity Actions
5 releases 5 tags
  • v0.1.0-rc.2 9bb5155417

    Guard v0.1.0-rc.2 Pre-release

    adam released this 2026-10-25 01:32:20 +00:00 | 0 commits to main since this release

    Added

    • First version. Guard watches log files (followed through rotation and
      truncation) and the systemd journal (by unit and syslog identifier),
      matches lines with patterns holding one <IP>, counts each address's
      bounty within a window, and bans an address that reaches a watch's
      hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the
      watch's protocol and ports, for a time that grows for repeat
      offenders. IPv6 addresses are counted and banned by the ban list's
      prefix (/64). Never banned: never_ban (addresses, prefixes, host
      names), loopback, link-local, multicast; Housecarl adds its own. Bans
      wait while Housecarl can't be reached, across restarts.
    • Presets: sshd, jarl, housecarl, steward, bind-xfr,
      postfix-sasl, dovecot, nginx-auth, housecarl-drops
      (Housecarl's log of dropped packets, TCP only by default).
    • Commands: guard run, check, config [--example], presets,
      test (a watch's patterns over a log), status and reload (through
      a local socket), bans, ban, unban, version.
    • Reloading: systemctl reload guard, guard reload or SIGHUP reads
      guard.yaml again without losing the bounties. A watch keeps its
      bounties under the same name and takes its new settings at once; its
      source starts again only if it changed; watches gone stop, new ones
      start. A file with a mistake is refused. The Housecarl connection,
      state, socket and log wait for a restart (guard reload says so).
    • A Debian package with a sandboxed systemd unit, as the guard user in
      the adm and systemd-journal groups, published with each release to
      the Gitea Debian registry (stable, or testing for a release
      candidate) along with tarballs for Linux amd64 and arm64.

    Fixed

    • The package's guard user is now in the adm and systemd-journal
      groups itself, as the documentation said, not only through its unit's
      SupplementaryGroups. sudo -u guard guard test and guard check
      could read neither /var/log's files (permission denied) nor the
      journal. Upgrading adds the groups.
    • Shorter, plainer command output. Tables name a journal source by its
      first two units or identifiers (journal postfix/smtpd, postfix/submission/smtpd +1), so presets, check and status
      fit a normal terminal. guard test prints the first 20 matching
      lines (not 200) and the first 20 addresses it would ban (--all for
      every one), single addresses without /32, and counts the matches
      from never_ban addresses. When Housecarl doesn't answer, guard check
      says so once ("Housecarl at URL doesn't answer: connection refused")
      instead of once per ban list with the request's URL, and only asks for
      log:read when Housecarl refused the log. guard status tells "not
      running" from "no permission". guard bans says when there are none;
      guard unban says "1 ban lifted".
    Downloads