abrown38andClaude Opus 5.5
ecf4129877
systemctl reload guard, guard reload or SIGHUP reads the configuration again: a watch keeps its bounties and counts under the same name and takes its new settings at once; its source starts again only if it changed; watches gone stop, new ones start; a file with a mistake is refused. The Housecarl connection, state, socket and log wait for a restart, and guard reload says so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
57 lines
3.0 KiB
Markdown
57 lines
3.0 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to Guard are documented here. The format follows
|
|
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
|
|
[Semantic Versioning](https://semver.org/).
|
|
|
|
## [Unreleased]
|
|
|
|
### Added
|
|
|
|
- First version. Guard watches log files (followed through rotation and
|
|
truncation) and the systemd journal (by unit and syslog identifier),
|
|
matches lines with patterns holding one `<IP>`, counts each address's
|
|
bounty within a window, and bans an address that reaches a watch's
|
|
hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the
|
|
watch's protocol and ports, for a time that grows for repeat
|
|
offenders. IPv6 addresses are counted and banned by the ban list's
|
|
prefix (/64). Never banned: `never_ban` (addresses, prefixes, host
|
|
names), loopback, link-local, multicast; Housecarl adds its own. Bans
|
|
wait while Housecarl can't be reached, across restarts.
|
|
- Presets: `sshd`, `jarl`, `housecarl`, `steward`, `bind-xfr`,
|
|
`postfix-sasl`, `dovecot`, `nginx-auth`, `housecarl-drops`
|
|
(Housecarl's log of dropped packets, TCP only by default).
|
|
- Commands: `guard run`, `check`, `config [--example]`, `presets`,
|
|
`test` (a watch's patterns over a log), `status` and `reload` (through
|
|
a local socket), `bans`, `ban`, `unban`, `version`.
|
|
- Reloading: `systemctl reload guard`, `guard reload` or SIGHUP reads
|
|
guard.yaml again without losing the bounties. A watch keeps its
|
|
bounties under the same name and takes its new settings at once; its
|
|
source starts again only if it changed; watches gone stop, new ones
|
|
start. A file with a mistake is refused. The Housecarl connection,
|
|
state, socket and log wait for a restart (`guard reload` says so).
|
|
- A Debian package with a sandboxed systemd unit, as the `guard` user in
|
|
the `adm` and `systemd-journal` groups, published with each release to
|
|
the Gitea Debian registry (`stable`, or `testing` for a release
|
|
candidate) along with tarballs for Linux amd64 and arm64.
|
|
|
|
### Fixed
|
|
|
|
- The package's `guard` user is now in the `adm` and `systemd-journal`
|
|
groups itself, as the documentation said, not only through its unit's
|
|
`SupplementaryGroups`. `sudo -u guard guard test` and `guard check`
|
|
could read neither `/var/log`'s files (`permission denied`) nor the
|
|
journal. Upgrading adds the groups.
|
|
- Shorter, plainer command output. Tables name a journal source by its
|
|
first two units or identifiers (`journal postfix/smtpd,
|
|
postfix/submission/smtpd +1`), so `presets`, `check` and `status`
|
|
fit a normal terminal. `guard test` prints the first 20 matching
|
|
lines (not 200) and the first 20 addresses it would ban (`--all` for
|
|
every one), single addresses without `/32`, and counts the matches
|
|
from `never_ban` addresses. When Housecarl doesn't answer, `guard check`
|
|
says so once ("Housecarl at URL doesn't answer: connection refused")
|
|
instead of once per ban list with the request's URL, and only asks for
|
|
`log:read` when Housecarl refused the log. `guard status` tells "not
|
|
running" from "no permission". `guard bans` says when there are none;
|
|
`guard unban` says "1 ban lifted".
|