abrown38andClaude Opus 5.5
d06bf8d531
Files and the journal, patterns with one <IP>, bounties within a window, bans in a Housecarl ban list with repeat offenders' bans growing; presets for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot, nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban; a Debian package with a sandboxed unit; an end-to-end test with Housecarl. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
1.5 KiB
Desktop File
56 lines
1.5 KiB
Desktop File
# Guard: watches logs and bans misbehaving addresses at the firewall
|
|
# (Housecarl's ban lists). Installed as /etc/systemd/system/guard.service
|
|
# (see docs/install.md).
|
|
[Unit]
|
|
Description=Guard: bans addresses that misbehave in the logs, at the firewall
|
|
Documentation=file:///usr/local/share/doc/guard/README.md
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/local/bin/guard --config /etc/guard/guard.yaml run
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
User=guard
|
|
Group=guard
|
|
# Reading logs: /var/log's files (adm) and the journal (systemd-journal).
|
|
# On the firewall, add housecarl to use Housecarl's local socket.
|
|
SupplementaryGroups=adm systemd-journal
|
|
UMask=0027
|
|
|
|
# /var/lib/guard: the state (repeat offenders, bans waiting for
|
|
# Housecarl). /run/guard: the socket guard status asks.
|
|
StateDirectory=guard
|
|
StateDirectoryMode=0750
|
|
ConfigurationDirectory=guard
|
|
ConfigurationDirectoryMode=0750
|
|
RuntimeDirectory=guard
|
|
RuntimeDirectoryMode=0750
|
|
|
|
# Sandboxing: Guard only reads logs and talks to Housecarl.
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|