Watchman

Detect and Act on unauthorized access of any kind from any source

Detect and Act on;

- an increase of USB devices
- network issues or network failure
- filesystem changes
- ssh "burn file"

Observed memory usage <100MB to ~1GB

Install

# Install the binary from crates.io
cargo install watchman

# Configure as a system service (optional; requires root)
# Linux (systemd) / macOS (launchd)
watchman --service install --webhook-url https://discord.com/api/webhooks/XXXXXXXX/XXXXXXXX

Setup

Configuration

The first run will create a default settings file if missing. Default locations:

Linux: ~/.config/watchman/config/settings.toml
macOS: /Users//Library/Application Support/com.helloimalemur.watchman/config/settings.toml
Windows: %APPDATA%\Watchman\config\settings.toml

Or create it manually:

## General settings
tick_delay_seconds = "5"
fs_tick_delay_seconds = "60"

### File System Integrity
fs_mon_enabled = "true"
fs_mon_dir = ["/etc", "/bin", "$PATH"]
fs_mon_hash_type = "blake3"

### USB Monitor
usb_mon_enabled = "true"
reboot_on_increase_of_usb_devices = "false"
notify_on_increase_of_usb_devices = "true"
unmount_crypt_on_increase_of_usb_devices = "true"

### Burn File Monitor
burn_file_mon_enabled = "false"
unmount_crypt_on_file_burn = "true"
ssh_check_burn_host = "hostname"
ssh_check_burn_user = "root"
ssh_check_burn_key = "/home/user/.ssh/id_rsa"
ssh_check_burn_path = "/root/.config/burn"
ssh_check_burn_check_interval = "30"
burn_path_1 = "/root/test/"

### Network Monitor
net_mon_enabled = "false"

######## Notification settings
discord_webhook_url = "https://discord.com/api/webhooks/"
discord_webhook_avatar_name = "Lazarus"

Development and Collaboration

Feel free to open a pull request, please run the following prior to your submission please!

echo "Run clippy"; cargo clippy -- -D clippy::all
echo "Format source code"; cargo fmt -- --check

Biblical References and Theme

This project embraces the theme of vigilant watchfulness.

Isaiah 62:6 — "I have set watchmen upon thy walls, O Jerusalem, which shall never hold their peace day nor night."
Psalm 127:1 — "Unless the Lord watches over the city, the watchman stays awake in vain."
Ezekiel 3:17 — "Son of man, I have made thee a watchman unto the house of Israel; therefore hear the word at my mouth, and give them warning from me."
Habakkuk 2:1 — "I will take my stand at my watchpost and station myself on the tower."
Matthew 24:42 — "Therefore stay awake, for you do not know on what day your Lord is coming."
Matthew 26:41 — "Watch and pray that you may not enter into temptation."
1 Peter 5:8 — "Be sober-minded; be watchful. Your adversary the devil prowls around like a roaring lion."
Proverbs 4:23 — "Keep your heart with all vigilance, for from it flow the springs of life."

These verses inspire the intent of Watchman: to observe faithfully, detect wisely, and act prudently.

Safety Notes

This tool can perform disruptive actions (rebooting, unmounting encrypted volumes). All such actions are disabled by default and must be explicitly enabled in settings.toml.
Service installation writes to system locations (/etc/systemd/system on Linux, /Library/LaunchDaemons on macOS) and requires root. Review the generated unit file before enabling.
Network scanning features (client discovery and nmap scans) should be used responsibly and only on networks you are authorized to test.
Discord webhooks leak to a third-party service; do not include sensitive data in messages.

3.6 KiB Raw Permalink Blame History