abrown38andClaude Opus 5.5
d06bf8d531
Files and the journal, patterns with one <IP>, bounties within a window, bans in a Housecarl ban list with repeat offenders' bans growing; presets for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot, nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban; a Debian package with a sandboxed unit; an end-to-end test with Housecarl. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.4 KiB
1.4 KiB
Changelog
All notable changes to Guard are documented here. The format follows Keep a Changelog, and versions follow Semantic Versioning.
[Unreleased]
Added
- First version. Guard watches log files (followed through rotation and
truncation) and the systemd journal (by unit and syslog identifier),
matches lines with patterns holding one
<IP>, counts each address's bounty within a window, and bans an address that reaches a watch's hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the watch's protocol and ports, for a time that grows for repeat offenders. IPv6 addresses are counted and banned by the ban list's prefix (/64). Never banned:never_ban(addresses, prefixes, host names), loopback, link-local, multicast; Housecarl adds its own. Bans wait while Housecarl can't be reached, across restarts. - Presets:
sshd,jarl,housecarl,steward,bind-xfr,postfix-sasl,dovecot,nginx-auth,housecarl-drops(Housecarl's log of dropped packets, TCP only by default). - Commands:
guard run,check,config [--example],presets,test(a watch's patterns over a log),status(through a local socket),bans,ban,unban,version. - A Debian package with a sandboxed systemd unit, as the
guarduser in theadmandsystemd-journalgroups.