adam/guard
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

4 Releases 4 Tags

RSS Feed
  • v0.1.0-rc.1+git7-b87cc6f 9c655abae2
    Compare

    Guard v0.1.0-rc.1+git7-b87cc6f
    release / release (push) Successful in 31s
    Details
    Pre-Release

    adam released this 2026-10-23 11:55:52 +00:00 | 2 commits to main since this release

    Added

    • First version. Guard watches log files (followed through rotation and
      truncation) and the systemd journal (by unit and syslog identifier),
      matches lines with patterns holding one <IP>, counts each address's
      bounty within a window, and bans an address that reaches a watch's
      hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the
      watch's protocol and ports, for a time that grows for repeat
      offenders. IPv6 addresses are counted and banned by the ban list's
      prefix (/64). Never banned: never_ban (addresses, prefixes, host
      names), loopback, link-local, multicast; Housecarl adds its own. Bans
      wait while Housecarl can't be reached, across restarts.
    • Presets: sshd, jarl, housecarl, steward, bind-xfr,
      postfix-sasl, dovecot, nginx-auth, housecarl-drops
      (Housecarl's log of dropped packets, TCP only by default).
    • Commands: guard run, check, config [--example], presets,
      test (a watch's patterns over a log), status (through a local
      socket), bans, ban, unban, version.
    • A Debian package with a sandboxed systemd unit, as the guard user in
      the adm and systemd-journal groups, published with each release to
      the Gitea Debian registry (stable, or testing for a release
      candidate) along with tarballs for Linux amd64 and arm64.

    Fixed

    • The package's guard user is now in the adm and systemd-journal
      groups itself, as the documentation said, not only through its unit's
      SupplementaryGroups. sudo -u guard guard test and guard check
      could read neither /var/log's files (permission denied) nor the
      journal. Upgrading adds the groups.
    • Shorter, plainer command output. Tables name a journal source by its
      first two units or identifiers (journal postfix/smtpd, postfix/submission/smtpd +1), so presets, check and status
      fit a normal terminal. guard test prints the first 20 matching
      lines (not 200) and the first 20 addresses it would ban (--all for
      every one), single addresses without /32, and counts the matches
      from never_ban addresses. When Housecarl doesn't answer, guard check
      says so once ("Housecarl at URL doesn't answer: connection refused")
      instead of once per ban list with the request's URL, and only asks for
      log:read when Housecarl refused the log. guard status tells "not
      running" from "no permission". guard bans says when there are none;
      guard unban says "1 ban lifted".
    Downloads