abrown38andClaude Opus 5.5
d06bf8d531
Files and the journal, patterns with one <IP>, bounties within a window, bans in a Housecarl ban list with repeat offenders' bans growing; presets for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot, nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban; a Debian package with a sandboxed unit; an end-to-end test with Housecarl. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.4 KiB
Markdown
29 lines
1.4 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to Guard are documented here. The format follows
|
|
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
|
|
[Semantic Versioning](https://semver.org/).
|
|
|
|
## [Unreleased]
|
|
|
|
### Added
|
|
|
|
- First version. Guard watches log files (followed through rotation and
|
|
truncation) and the systemd journal (by unit and syslog identifier),
|
|
matches lines with patterns holding one `<IP>`, counts each address's
|
|
bounty within a window, and bans an address that reaches a watch's
|
|
hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the
|
|
watch's protocol and ports, for a time that grows for repeat
|
|
offenders. IPv6 addresses are counted and banned by the ban list's
|
|
prefix (/64). Never banned: `never_ban` (addresses, prefixes, host
|
|
names), loopback, link-local, multicast; Housecarl adds its own. Bans
|
|
wait while Housecarl can't be reached, across restarts.
|
|
- Presets: `sshd`, `jarl`, `housecarl`, `steward`, `bind-xfr`,
|
|
`postfix-sasl`, `dovecot`, `nginx-auth`, `housecarl-drops`
|
|
(Housecarl's log of dropped packets, TCP only by default).
|
|
- Commands: `guard run`, `check`, `config [--example]`, `presets`,
|
|
`test` (a watch's patterns over a log), `status` (through a local
|
|
socket), `bans`, `ban`, `unban`, `version`.
|
|
- A Debian package with a sandboxed systemd unit, as the `guard` user in
|
|
the `adm` and `systemd-journal` groups.
|