guard/CHANGELOG.md

Changelog

All notable changes to Guard are documented here. The format follows Keep a Changelog, and versions follow Semantic Versioning.

[Unreleased]

Added

• First version. Guard watches log files (followed through rotation and truncation) and the systemd journal (by unit and syslog identifier), matches lines with patterns holding one <IP>, counts each address's bounty within a window, and bans an address that reaches a watch's hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the watch's protocol and ports, for a time that grows for repeat offenders. IPv6 addresses are counted and banned by the ban list's prefix (/64). Never banned: never_ban (addresses, prefixes, host names), loopback, link-local, multicast; Housecarl adds its own. Bans wait while Housecarl can't be reached, across restarts.
• Presets: sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot, nginx-auth, housecarl-drops (Housecarl's log of dropped packets, TCP only by default).
• Commands: guard run, check, config [--example], presets, test (a watch's patterns over a log), status (through a local socket), bans, ban, unban, version.
• A Debian package with a sandboxed systemd unit, as the guard user in the adm and systemd-journal groups, published with each release to the Gitea Debian registry (stable, or testing for a release candidate) along with tarballs for Linux amd64 and arm64.

Fixed

• The package's guard user is now in the adm and systemd-journal groups itself, as the documentation said, not only through its unit's SupplementaryGroups. sudo -u guard guard test and guard check could read neither /var/log's files (permission denied) nor the journal. Upgrading adds the groups.
• Shorter, plainer command output. Tables name a journal source by its first two units or identifiers (journal postfix/smtpd, postfix/submission/smtpd +1), so presets, check and status fit a normal terminal. guard test prints the first 20 matching lines (not 200) and the first 20 addresses it would ban (--all for every one), single addresses without /32, and counts the matches from never_ban addresses. When Housecarl doesn't answer, guard check says so once ("Housecarl at URL doesn't answer: connection refused") instead of once per ban list with the request's URL, and only asks for log:read when Housecarl refused the log. guard status tells "not running" from "no permission". guard bans says when there are none; guard unban says "1 ban lifted".