From 39f5378c6cc8bdedbfca7920dc144092590fff11 Mon Sep 17 00:00:00 2001 From: helloimalemur Date: Wed, 17 Sep 2025 13:51:49 -0400 Subject: [PATCH] . --- Cargo.toml | 5 +++ README.md | 24 ++++++++--- src/util/mod.rs | 105 ++++++++++++++++++++++++++++++++++++++++++++---- 3 files changed, 121 insertions(+), 13 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 7f1e770..e38fb71 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -6,8 +6,13 @@ description = "Detect and Act on unauthorized access of any kind from any source authors = ["jkoontsiii@gmail.com"] license = "MIT" repository = "https://github.com/helloimalemur/watchman" +homepage = "https://github.com/helloimalemur/watchman" +documentation = "https://github.com/helloimalemur/watchman#readme" +rust-version = "1.70" keywords = ["file-integrity", "filesystem-integrity", "change-detection", "watchman"] +categories = ["command-line-utilities", "filesystem", "network-programming"] readme = "README.md" +exclude = ["target/**", "plan/**", "watchman.service", "run.sh", "install.sh"] # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [dependencies] diff --git a/README.md b/README.md index 838d42a..dfb0325 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,4 @@ # Watchman -#### (work-in-progress) ## Detect and Act on unauthorized access of any kind from any source ### Detect and Act on; @@ -12,14 +11,22 @@ ### Install ```shell -## install binary +# Install the binary from crates.io cargo install watchman -## configure service with discord webhook -watchman install-service webhook=https://discordapp.com/api/webhooks/121946119953658680... + +# Configure as a system service (optional; requires root) +# Linux (systemd) / macOS (launchd) +watchman --service install --webhook-url https://discord.com/api/webhooks/XXXXXXXX/XXXXXXXX ``` # Setup -### create config/Settings.toml +### Configuration +The first run will create a default settings file if missing. Default locations: +- Linux: ~/.config/watchman/config/settings.toml +- macOS: /Users//Library/Application Support/com.helloimalemur.watchman/config/settings.toml +- Windows: %APPDATA%\Watchman\config\settings.toml + +Or create it manually: ```shell ## General settings tick_delay_seconds = "5" @@ -74,4 +81,9 @@ This project embraces the theme of vigilant watchfulness. - 1 Peter 5:8 — "Be sober-minded; be watchful. Your adversary the devil prowls around like a roaring lion." - Proverbs 4:23 — "Keep your heart with all vigilance, for from it flow the springs of life." -These verses inspire the intent of Watchman: to observe faithfully, detect wisely, and act prudently. \ No newline at end of file +These verses inspire the intent of Watchman: to observe faithfully, detect wisely, and act prudently. +## Safety Notes +- This tool can perform disruptive actions (rebooting, unmounting encrypted volumes). All such actions are disabled by default and must be explicitly enabled in settings.toml. +- Service installation writes to system locations (/etc/systemd/system on Linux, /Library/LaunchDaemons on macOS) and requires root. Review the generated unit file before enabling. +- Network scanning features (client discovery and nmap scans) should be used responsibly and only on networks you are authorized to test. +- Discord webhooks leak to a third-party service; do not include sensitive data in messages. diff --git a/src/util/mod.rs b/src/util/mod.rs index f573bc5..eced8cf 100644 --- a/src/util/mod.rs +++ b/src/util/mod.rs @@ -65,14 +65,14 @@ pub fn get_config_dir() -> String { } } "macos" => { - // /var/root/Library/Application\ Support/com.helloimalemur.watchman/ + // /var/root/Library/Application Support/com.helloimalemur.watchman/ if cur_user.eq_ignore_ascii_case("root") { - let _ = fs::create_dir_all(Path::new("/var/root/Library/Application\\ Support/com.helloimalemur.watchman/config/")); - "/var/root/Library/Application\\ Support/com.helloimalemur.watchman/".to_string() + let _ = fs::create_dir_all(Path::new("/var/root/Library/Application Support/com.helloimalemur.watchman/config/")); + "/var/root/Library/Application Support/com.helloimalemur.watchman/".to_string() } else { - let create_dir = format!("/Users/{}/Library/Application\\ Support/com.helloimalemur.watchman/config/", cur_user); + let create_dir = format!("/Users/{}/Library/Application Support/com.helloimalemur.watchman/config/", cur_user); let _ = fs::create_dir_all(Path::new(create_dir.as_str())); - format!("/Users/{}/Library/Application\\ Support/com.helloimalemur.watchman/", cur_user) + format!("/Users/{}/Library/Application Support/com.helloimalemur.watchman/", cur_user) } } "windows" => { @@ -169,7 +169,6 @@ discord_webhook_url = "https://discord.com/api/webhooks/" discord_webhook_avatar_name = "Lazarus" "# } - "macos" => { r#" ## General settings @@ -212,13 +211,105 @@ findings_critical_ports = ["23", "2323", "3389", "5900"] notify_on_findings = "true" action_on_findings = "none" # none | reboot +######## Notification settings +discord_webhook_url = "https://discord.com/api/webhooks/" +discord_webhook_avatar_name = "Lazarus" +"# + } + "windows" => { + r#" +## General settings +tick_delay_seconds = "5" +fs_tick_delay_seconds = "300" + +### File System Integrity +fs_mon_path_variable = false +fs_mon_enabled = "true" +fs_mon_dir = ["C:\\Windows\\System32"] +fs_mon_hash_type = "blake3" + +### USB Monitor +usb_mon_enabled = "false" +reboot_on_increase_of_usb_devices = "false" +notify_on_increase_of_usb_devices = "false" +unmount_crypt_on_increase_of_usb_devices = "false" + +### Burn File Monitor +burn_file_mon_enabled = "false" +unmount_crypt_on_file_burn = "false" +ssh_check_burn_host = "hostname" +ssh_check_burn_user = "Administrator" +ssh_check_burn_key = "C:\\Users\\user\\.ssh\\id_rsa" +ssh_check_burn_path = "C:\\Users\\Administrator\\AppData\\Roaming\\burn" +ssh_check_burn_check_interval = "30" +burn_path_1 = "C:\\temp\\test\\" + +### Network Monitor +net_mon_enabled = "false" + +### Client Discovery & Scan +client_scan_enabled = "false" +client_discovery_method = "arp" +client_scan_exclusions = ["127.0.0.1", "localhost"] +scan_on_add = "true" +nmap_path = "nmap" +nmap_profile = "-sV -T4" +findings_critical_ports = ["23", "2323", "3389", "5900"] +notify_on_findings = "false" +action_on_findings = "none" + ######## Notification settings discord_webhook_url = "https://discord.com/api/webhooks/" discord_webhook_avatar_name = "Lazarus" "# } _ => { - panic!("Unsupported OS: {}", OS); + // Fallback to Linux defaults on unknown OS + r#" +## General settings +tick_delay_seconds = "5" +fs_tick_delay_seconds = "300" + +### File System Integrity +fs_mon_path_variable = true +fs_mon_enabled = "true" +fs_mon_dir = ["/etc", "/bin", "$PATH"] +fs_mon_hash_type = "blake3" + +### USB Monitor +usb_mon_enabled = "true" +reboot_on_increase_of_usb_devices = "false" +notify_on_increase_of_usb_devices = "false" +unmount_crypt_on_increase_of_usb_devices = "true" + +### Burn File Monitor +burn_file_mon_enabled = "false" +unmount_crypt_on_file_burn = "true" +ssh_check_burn_host = "hostname" +ssh_check_burn_user = "root" +ssh_check_burn_key = "/home/user/.ssh/id_rsa" +ssh_check_burn_path = "/root/.config/burn" +ssh_check_burn_check_interval = "30" +burn_path_1 = "/root/test/" + +### Network Monitor +net_mon_enabled = "false" + +### Client Discovery & Scan +client_scan_enabled = "false" +client_discovery_method = "arp" # arp | ping +client_scan_exclusions = ["127.0.0.1", "localhost"] +scan_on_add = "true" +nmap_path = "nmap" +nmap_profile = "-sV -T4" +findings_critical_ports = ["23", "2323", "3389", "5900"] +notify_on_findings = "false" +action_on_findings = "none" # none | reboot + +######## Notification settings +discord_webhook_url = "https://discord.com/api/webhooks/" +discord_webhook_avatar_name = "Lazarus" +"# } } } \ No newline at end of file