SysWarden
github.com/duggytuxy/syswardenLinux
Open-source, host-local Linux security orchestrator combining nftables enforcement, system telemetry, threat-intelligence feeds, out-of-band WAAP log analysis and a terminal dashboard. It requires Linux administration and is not an inline proxy.
- Homepage:github.com/duggytuxy/syswarden
- GitHub:github.com/duggytuxy/syswarden
- Web info:web-check.xyz/check/github.com
SysWarden Source Code
Author
Description
Linux defense. Your host. Your rules. Host-local Linux defense with auditable, fail-closed enforcement.
Homepage
https://syswarden.ioRepository
- LicenseGPL-3.0
- Created09 Feb 26
- Primary languageGo
- Size57,850 KB
- Stars389
- Forks31
- Watchers389
Top Contributors
@github-actions[bot] (147)
@dependabot[bot] (58)
@step-security-bot (9)
@thomasboni (1)
@matty69v (1)
Recent Commits
Fix : verify live journald identity after cold boot (#299) Co-authored-by: duggytuxy <[email protected]>
Docs : complete the v4.10.3 correction record (#298) Co-authored-by: duggytuxy <[email protected]>
Fix : preserve administrator state during verified product removal (#296) * Fix : preserve administrator state during verified product removal * Fix : complete removal command contracts and static checks * Fix : verify the removal recovery command inventory * Fix : retire resolved legacy security suppressions * Fix : preserve reviewed configuration and complete bounded table retirement Retire a dedicated historical Fail2ban table and its persistent declaration only when complete action evidence covers every object. Fence the final table deletion against concurrent changes and retain the semantics of existing version-one runtime and persistence reviews. Add explicit, digest-bound retention of customized modular TOML at its original paths through uninstall, native remove and native purge. Read the same bounded private decision after CLI removal so later administrator edits also survive a deferred purge. Keep unknown files and unsupported ownership outside this authority and document the remaining recovery limits. * Fix : recover reviewed historical firewall persistence * Fix : preserve independently reviewed administrator firewall policy * Fix : align removal help contract and reuse explicit build cache * Fix : preserve hardened removal loaders and historical data * Test : constrain legacy cache fixtures to pinned roots * Fix : retire proven historical iptables rules before payload removal * Test : isolate historical compatibility preflight fixtures --------- Co-authored-by: duggytuxy <[email protected]>
Fix historical native removal and OSINT installation availability (#295) * fix: complete removal after interrupted historical package upgrades * fix: keep validated OSINT disagreement from blocking installation --------- Co-authored-by: duggytuxy <[email protected]>
Prepare protected v4.10.3 Patch IVV from fresh signed native evidence (#294) Co-authored-by: duggytuxy <[email protected]>
Fix durable WireGuard ownership across filesystem device renumbering (#293) Co-authored-by: duggytuxy <[email protected]>
Fix : prepare qualified signatures for v4.10.3 (#292) Co-authored-by: duggytuxy <[email protected]>
Patch : v4.10.3 preserve historical WireGuard upgrades and clients (#291) * Patch : preserve historical WireGuard upgrades and clients Screen legacy WireGuard conflicts before native unpack. Add exact generated-state proof, separate digest-authorized retirement and journaled client-preserving migration, and token-bound shared forwarding under retained operator policy. Cover half-configured recovery, durable interruption, ownership drift and isolated kernel behavior. Native first-hop and release acceptance remain required. * Align candidate CLI process version contract * Keep agent instructions local and record native WireGuard acceptance --------- Co-authored-by: duggytuxy <[email protected]>
docs: record verified v4.10.2 publication and current stable release (#290) Co-authored-by: duggytuxy <[email protected]>
Fix : bind v4.10.2 IVV to signed native evidence (#289) Co-authored-by: duggytuxy <[email protected]>
Fix : prepare qualified signatures for v4.10.2 (#288) Co-authored-by: duggytuxy <[email protected]>
Patch : v4.10.2 recover historical WireGuard and preserve package consistency (#287) * Patch : v4.10.2 recover both WireGuard generations and preserve package consistency * Fix : reject historical WireGuard conflicts before command preparation * Fix : bind RPM assembly recovery assertions to the current helper --------- Co-authored-by: duggytuxy <[email protected]>
Fix : bind v4.10.1 Patch IVV to signed product and native evidence (#286) * Fix : bind v4.10.1 Patch IVV to signed product and native evidence * Fix : retain empty proof integrity across access-time updates --------- Co-authored-by: duggytuxy <[email protected]>
Fix : prepare qualified signatures for v4.10.1 (#285) Co-authored-by: duggytuxy <[email protected]>
Patch : v4.10.1 recover legacy WireGuard removal (#284) * Patch : v4.10.1 recover legacy WireGuard removal * Fix : align RHEL package-owned identity with v4.10.1 * Fix : align CLI process contract with v4.10.1 * Fix : bind RHEL lifecycle attestations to v4.10.1 --------- Co-authored-by: duggytuxy <[email protected]>
Fix : classify post-release pushes without moving published tags (#282) Co-authored-by: duggytuxy <[email protected]>
Docs : publish the v4.10.0 record and link the documentation portal (#281) Co-authored-by: duggytuxy <[email protected]>
CI : enforce protected intermediate IVV publication (#280) Co-authored-by: duggytuxy <[email protected]>
Fix : accept annotated firewalld default zone headers (#279) Co-authored-by: duggytuxy <[email protected]>
Fix : preserve frozen inputs across IVV publication tooling (#278) * Fix : bind IVV publication inputs to the required assurance producer * Fix : reverify the original signed updater before IVV publication --------- Co-authored-by: duggytuxy <[email protected]>
Docs : add the official Discord community badge (#277) * Docs : add the official Discord community badge * Docs : use the permanent Discord invitation --------- Co-authored-by: duggytuxy <[email protected]>
Fix : reverify the original signed IVV updater across tooling commits (#276) Co-authored-by: duggytuxy <[email protected]>
CI : bind frozen IVV product to protected offline updater (#275) Co-authored-by: duggytuxy <[email protected]>
CI : freeze v4.10.0 IVV scope and product evidence (#274) Co-authored-by: duggytuxy <[email protected]>
ci: derive release validation tracks from version history (#273) * ci: derive release validation tracks from version history * docs: name IVV and IVVQ release tracks --------- Co-authored-by: duggytuxy <[email protected]>
fix(firewall): initialize whitelist families before policy reload (#268) * fix(firewall): initialize whitelist families before policy reload * test: document intentional whitelist fixture permissions --------- Co-authored-by: duggytuxy <[email protected]>
fix(ha): drain prepared writer recovery outbox before explicit rejoin (#263) Co-authored-by: duggytuxy <[email protected]>
fix(ha): preserve explicit empty writer inventory in manifests (#262) Co-authored-by: duggytuxy <[email protected]>
fix(ha): scope peer access and close legacy sync under HA v2 (#261) * fix(ha): scope peer access to the HA port and keep v2 legacy sync closed * docs(security): justify validated HA whitelist subprocess arguments --------- Co-authored-by: duggytuxy <[email protected]>
Fix Linux telemetry reader shutdown (#260) * Fix Linux telemetry reader shutdown on context cancellation * Wait for observed reader exit in shutdown regression --------- Co-authored-by: duggytuxy <[email protected]>
SysWarden Reviews
More Linux Defenses
Clears cache and deletes temporary files very effectively. This frees up disk space, improves performance, but most importantly helps to protect privacy.
Locally checks for signs of a rootkit.
ClamTk is basically a graphical front-end for ClamAV, making it an easy to use, light-weight, on-demand virus scanner for Linux systems.
Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. Written in C, virtually no dependencies, runs on any modern Linux system, with no daemon running in the background, no complicated configuration, and it's super lightweight and super secure, since all actions are implemented by the kernel. It includes security profiles for over 800 common Linux applications. FireJail is recommended for running any app that may potential pose some kind of risk, such as torrenting through Transmission, browsing the web, opening downloaded attachments.
Open source GUI firewall for Linux, allowing you to block internet access for certain applications. Supports both simple and advanced mode, GUI and CLI options, very easy to use, lightweight/ low-overhead, under active maintenance and backed by a strong community. Installable through most package managers, or compile from source.
Open source intrusion prevention system capable of real-time traffic analysis and packet logging.
About the Data: SysWarden
Change History
- Added #779
Edit SysWarden Data
You can edit SysWarden's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access SysWarden's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/syswardenThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share SysWarden
Help your friends compare Linux Defenses, and pick privacy-respecting software and services.
Share SysWarden and Awesome Privacy with your network!