abrown38andClaude Opus 5.5
ecf4129877
systemctl reload guard, guard reload or SIGHUP reads the configuration again: a watch keeps its bounties and counts under the same name and takes its new settings at once; its source starts again only if it changed; watches gone stop, new ones start; a file with a mistake is refused. The Housecarl connection, state, socket and log wait for a restart, and guard reload says so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.6 KiB
1.6 KiB
The guard command
One binary is the daemon and its tools. Every command reads
/etc/guard/guard.yaml (--config for another); --json prints JSON.
| Command | |
|---|---|
guard run |
watch and ban: the daemon, as guard.service runs it |
guard check |
check the configuration, compile the patterns, and ask Housecarl for each ban list (and its log, for housecarl-drops) |
guard config |
the configuration as read, with the defaults filled in |
guard config --example |
a commented example |
guard presets [PRESET] |
the presets, or one's patterns |
guard test WATCH [FILE|-] [--lines N] [--all] |
what a watch's patterns find in a log, and whom they would ban (presets.md) |
guard status |
the running Guard: each watch's lines, matches, bans and highest bounties, the recent bans and why any failed, and bans waiting for Housecarl. Asks the socket: as root or the guard user |
guard reload |
make the running Guard read guard.yaml again, keeping its bounties, and show what changed (as systemctl reload guard does; configuration.md). Asks the socket |
guard bans [--list L] |
the ban list's active bans, from Housecarl |
guard ban ADDRESS [--list L] [--protocol tcp --port 22]... [--time 1d] [--reason R] |
ban by hand |
guard unban ADDRESS [--list L] |
lift an address's bans |
guard version |
|
guard completion bash |
bash completion (the package installs it) |
bans, ban and unban use Guard's token, so they act on the ban
lists it may ban into. hc bans, hc ban and hc unban on the
firewall do the same for every list.