guard/CHANGELOG.md

Changelog

All notable changes to Guard are documented here. The format follows Keep a Changelog, and versions follow Semantic Versioning.

[Unreleased]

Added

• First version. Guard watches log files (followed through rotation and truncation) and the systemd journal (by unit and syslog identifier), matches lines with patterns holding one <IP>, counts each address's bounty within a window, and bans an address that reaches a watch's hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the watch's protocol and ports, for a time that grows for repeat offenders. IPv6 addresses are counted and banned by the ban list's prefix (/64). Never banned: never_ban (addresses, prefixes, host names), loopback, link-local, multicast; Housecarl adds its own. Bans wait while Housecarl can't be reached, across restarts.
• Presets: sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot, nginx-auth, housecarl-drops (Housecarl's log of dropped packets, TCP only by default).
• Commands: guard run, check, config [--example], presets, test (a watch's patterns over a log), status (through a local socket), bans, ban, unban, version.
• A Debian package with a sandboxed systemd unit, as the guard user in the adm and systemd-journal groups, published with each release to the Gitea Debian registry (stable, or testing for a release candidate) along with tarballs for Linux amd64 and arm64.

Fixed

• The package's guard user is now in the adm and systemd-journal groups itself, as the documentation said, not only through its unit's SupplementaryGroups. sudo -u guard guard test and guard check could read neither /var/log's files (permission denied) nor the journal. Upgrading adds the groups.