1mm0rt41pc/guardian repository overview

⁠The Guardian

The Guadian is a simple script that watch for unusual tcp/http/ssh activity and ban ip via routing. It's a fail2ban like with some integrated feature and simplified configuration. The script install a iptables rule to catch all trafic to closed ports. Then the script parse logs: /var/log/messages /var/log/nginx/access.log

⁠Docker

docker run --name guardian -d --restart=always -v /var/log:/var/log -v /etc/guardian/:/etc/guardian/:ro -v /sys:/sys -v /proc:/proc -v /dev:/dev --network=host --privileged -e WATCH_PORTS_TCP=auto -e WATCH_PORTS_UDP=auto -e INTERFACE=ens3 -e BAN_DURATION=`expr 60 '*' 30` -e BAN_INCREMENTATION=`expr 60 '*' 5` 1mm0rt41pc/guardian