abrown38andClaude Opus 5.5
d06bf8d531
Files and the journal, patterns with one <IP>, bounties within a window, bans in a Housecarl ban list with repeat offenders' bans growing; presets for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot, nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban; a Debian package with a sandboxed unit; an end-to-end test with Housecarl. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.4 KiB
1.4 KiB
The guard command
One binary is the daemon and its tools. Every command reads
/etc/guard/guard.yaml (--config for another); --json prints JSON.
| Command | |
|---|---|
guard run |
watch and ban: the daemon, as guard.service runs it |
guard check |
check the configuration, compile the patterns, and ask Housecarl for each ban list (and its log, for housecarl-drops) |
guard config |
the configuration as read, with the defaults filled in |
guard config --example |
a commented example |
guard presets [PRESET] |
the presets, or one's patterns |
guard test WATCH [FILE|-] [--lines N] [--all] |
what a watch's patterns find in a log, and whom they would ban (presets.md) |
guard status |
the running Guard: each watch's lines, matches, bans and highest bounties, the recent bans and why any failed, and bans waiting for Housecarl. Asks the socket: as root or the guard user |
guard bans [--list L] |
the ban list's active bans, from Housecarl |
guard ban ADDRESS [--list L] [--protocol tcp --port 22]... [--time 1d] [--reason R] |
ban by hand |
guard unban ADDRESS [--list L] |
lift an address's bans |
guard version |
|
guard completion bash |
bash completion (the package installs it) |
bans, ban and unban use Guard's token, so they act on the ban
lists it may ban into. hc bans, hc ban and hc unban on the
firewall do the same for every list.