.

2025-09-17 13:51:49 -04:00
parent 43c9b56674
commit 39f5378c6c
3 changed files with 121 additions and 13 deletions
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,8 +6,13 @@ description = "Detect and Act on unauthorized access of any kind from any source
 authors = ["jkoontsiii@gmail.com"]
 license = "MIT"
 repository = "https://github.com/helloimalemur/watchman"
+homepage = "https://github.com/helloimalemur/watchman"
+documentation = "https://github.com/helloimalemur/watchman#readme"
+rust-version = "1.70"
 keywords = ["file-integrity", "filesystem-integrity", "change-detection", "watchman"]
+categories = ["command-line-utilities", "filesystem", "network-programming"]
 readme = "README.md"
+exclude = ["target/**", "plan/**", "watchman.service", "run.sh", "install.sh"]
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
--- a/README.md
+++ b/README.md
@@ -1,5 +1,4 @@
 # Watchman
-#### (work-in-progress)
 ## Detect and Act on unauthorized access of any kind from any source

 ### Detect and Act on;
@@ -12,14 +11,22 @@

 ### Install
 ```shell
-## install binary
+# Install the binary from crates.io
 cargo install watchman
-## configure service with discord webhook
-watchman install-service webhook=https://discordapp.com/api/webhooks/121946119953658680...
+
+# Configure as a system service (optional; requires root)
+# Linux (systemd) / macOS (launchd)
+watchman --service install --webhook-url https://discord.com/api/webhooks/XXXXXXXX/XXXXXXXX
 ```

 # Setup
-### create config/Settings.toml
+### Configuration
+The first run will create a default settings file if missing. Default locations:
+- Linux: ~/.config/watchman/config/settings.toml
+- macOS: /Users/<user>/Library/Application Support/com.helloimalemur.watchman/config/settings.toml
+- Windows: %APPDATA%\Watchman\config\settings.toml
+
+Or create it manually:
 ```shell
 ## General settings
 tick_delay_seconds = "5"
@@ -74,4 +81,9 @@ This project embraces the theme of vigilant watchfulness.
 - 1 Peter 5:8 — "Be sober-minded; be watchful. Your adversary the devil prowls around like a roaring lion."
 - Proverbs 4:23 — "Keep your heart with all vigilance, for from it flow the springs of life."

-These verses inspire the intent of Watchman: to observe faithfully, detect wisely, and act prudently.
+These verses inspire the intent of Watchman: to observe faithfully, detect wisely, and act prudently.
+## Safety Notes
+- This tool can perform disruptive actions (rebooting, unmounting encrypted volumes). All such actions are disabled by default and must be explicitly enabled in settings.toml.
+- Service installation writes to system locations (/etc/systemd/system on Linux, /Library/LaunchDaemons on macOS) and requires root. Review the generated unit file before enabling.
+- Network scanning features (client discovery and nmap scans) should be used responsibly and only on networks you are authorized to test.
+- Discord webhooks leak to a third-party service; do not include sensitive data in messages.
--- a/src/util/mod.rs
+++ b/src/util/mod.rs
@@ -65,14 +65,14 @@ pub fn get_config_dir() -> String {
            }
        }
        "macos" => {
-            // /var/root/Library/Application\ Support/com.helloimalemur.watchman/
+            // /var/root/Library/Application Support/com.helloimalemur.watchman/
            if cur_user.eq_ignore_ascii_case("root") {
-                let _ = fs::create_dir_all(Path::new("/var/root/Library/Application\\ Support/com.helloimalemur.watchman/config/"));
-                "/var/root/Library/Application\\ Support/com.helloimalemur.watchman/".to_string()
+                let _ = fs::create_dir_all(Path::new("/var/root/Library/Application Support/com.helloimalemur.watchman/config/"));
+                "/var/root/Library/Application Support/com.helloimalemur.watchman/".to_string()
            } else {
-                let create_dir = format!("/Users/{}/Library/Application\\ Support/com.helloimalemur.watchman/config/", cur_user);
+                let create_dir = format!("/Users/{}/Library/Application Support/com.helloimalemur.watchman/config/", cur_user);
                let _ = fs::create_dir_all(Path::new(create_dir.as_str()));
-                format!("/Users/{}/Library/Application\\ Support/com.helloimalemur.watchman/", cur_user)
+                format!("/Users/{}/Library/Application Support/com.helloimalemur.watchman/", cur_user)
            }
        }
        "windows" => {
@@ -169,7 +169,6 @@ discord_webhook_url = "https://discord.com/api/webhooks/"
 discord_webhook_avatar_name = "Lazarus"
 "#
        }
-
        "macos" => {
            r#"
 ## General settings
@@ -212,13 +211,105 @@ findings_critical_ports = ["23", "2323", "3389", "5900"]
 notify_on_findings = "true"
 action_on_findings = "none" # none | reboot

+######## Notification settings
+discord_webhook_url = "https://discord.com/api/webhooks/"
+discord_webhook_avatar_name = "Lazarus"
+"#
+        }
+        "windows" => {
+            r#"
+## General settings
+tick_delay_seconds = "5"
+fs_tick_delay_seconds = "300"
+
+### File System Integrity
+fs_mon_path_variable = false
+fs_mon_enabled = "true"
+fs_mon_dir = ["C:\\Windows\\System32"]
+fs_mon_hash_type = "blake3"
+
+### USB Monitor
+usb_mon_enabled = "false"
+reboot_on_increase_of_usb_devices = "false"
+notify_on_increase_of_usb_devices = "false"
+unmount_crypt_on_increase_of_usb_devices = "false"
+
+### Burn File Monitor
+burn_file_mon_enabled = "false"
+unmount_crypt_on_file_burn = "false"
+ssh_check_burn_host = "hostname"
+ssh_check_burn_user = "Administrator"
+ssh_check_burn_key = "C:\\Users\\user\\.ssh\\id_rsa"
+ssh_check_burn_path = "C:\\Users\\Administrator\\AppData\\Roaming\\burn"
+ssh_check_burn_check_interval = "30"
+burn_path_1 = "C:\\temp\\test\\"
+
+### Network Monitor
+net_mon_enabled = "false"
+
+### Client Discovery & Scan
+client_scan_enabled = "false"
+client_discovery_method = "arp"
+client_scan_exclusions = ["127.0.0.1", "localhost"]
+scan_on_add = "true"
+nmap_path = "nmap"
+nmap_profile = "-sV -T4"
+findings_critical_ports = ["23", "2323", "3389", "5900"]
+notify_on_findings = "false"
+action_on_findings = "none"
+
 ######## Notification settings
 discord_webhook_url = "https://discord.com/api/webhooks/"
 discord_webhook_avatar_name = "Lazarus"
 "#
        }
        _ => {
-            panic!("Unsupported OS: {}", OS);
+            // Fallback to Linux defaults on unknown OS
+            r#"
+## General settings
+tick_delay_seconds = "5"
+fs_tick_delay_seconds = "300"
+
+### File System Integrity
+fs_mon_path_variable = true
+fs_mon_enabled = "true"
+fs_mon_dir = ["/etc", "/bin", "$PATH"]
+fs_mon_hash_type = "blake3"
+
+### USB Monitor
+usb_mon_enabled = "true"
+reboot_on_increase_of_usb_devices = "false"
+notify_on_increase_of_usb_devices = "false"
+unmount_crypt_on_increase_of_usb_devices = "true"
+
+### Burn File Monitor
+burn_file_mon_enabled = "false"
+unmount_crypt_on_file_burn = "true"
+ssh_check_burn_host = "hostname"
+ssh_check_burn_user = "root"
+ssh_check_burn_key = "/home/user/.ssh/id_rsa"
+ssh_check_burn_path = "/root/.config/burn"
+ssh_check_burn_check_interval = "30"
+burn_path_1 = "/root/test/"
+
+### Network Monitor
+net_mon_enabled = "false"
+
+### Client Discovery & Scan
+client_scan_enabled = "false"
+client_discovery_method = "arp" # arp | ping
+client_scan_exclusions = ["127.0.0.1", "localhost"]
+scan_on_add = "true"
+nmap_path = "nmap"
+nmap_profile = "-sV -T4"
+findings_critical_ports = ["23", "2323", "3389", "5900"]
+notify_on_findings = "false"
+action_on_findings = "none" # none | reboot
+
+######## Notification settings
+discord_webhook_url = "https://discord.com/api/webhooks/"
+discord_webhook_avatar_name = "Lazarus"
+"#
        }
    }
 }