92 lines
3.6 KiB
Markdown
92 lines
3.6 KiB
Markdown
# Watchman
|
|
## Detect and Act on unauthorized access of any kind from any source
|
|
|
|
### Detect and Act on;
|
|
- an increase of USB devices
|
|
- network issues or network failure
|
|
- filesystem changes
|
|
- ssh "burn file"
|
|
|
|
#### Observed memory usage <100MB to ~1GB
|
|
|
|
### Install
|
|
```shell
|
|
# Install the binary from crates.io
|
|
cargo install watchman
|
|
|
|
# Configure as a system service (optional; requires root)
|
|
# Linux (systemd) / macOS (launchd)
|
|
watchman --service install --webhook-url https://discord.com/api/webhooks/XXXXXXXX/XXXXXXXX
|
|
```
|
|
|
|
# Setup
|
|
### Configuration
|
|
The first run will create a default settings file if missing. Default locations:
|
|
- Linux: ~/.config/watchman/config/settings.toml
|
|
- macOS: /Users/<user>/Library/Application Support/com.helloimalemur.watchman/config/settings.toml
|
|
- Windows: %APPDATA%\Watchman\config\settings.toml
|
|
|
|
Or create it manually:
|
|
```shell
|
|
## General settings
|
|
tick_delay_seconds = "5"
|
|
fs_tick_delay_seconds = "60"
|
|
|
|
### File System Integrity
|
|
fs_mon_enabled = "true"
|
|
fs_mon_dir = ["/etc", "/bin", "$PATH"]
|
|
fs_mon_hash_type = "blake3"
|
|
|
|
### USB Monitor
|
|
usb_mon_enabled = "true"
|
|
reboot_on_increase_of_usb_devices = "false"
|
|
notify_on_increase_of_usb_devices = "true"
|
|
unmount_crypt_on_increase_of_usb_devices = "true"
|
|
|
|
### Burn File Monitor
|
|
burn_file_mon_enabled = "false"
|
|
unmount_crypt_on_file_burn = "true"
|
|
ssh_check_burn_host = "hostname"
|
|
ssh_check_burn_user = "root"
|
|
ssh_check_burn_key = "/home/user/.ssh/id_rsa"
|
|
ssh_check_burn_path = "/root/.config/burn"
|
|
ssh_check_burn_check_interval = "30"
|
|
burn_path_1 = "/root/test/"
|
|
|
|
### Network Monitor
|
|
net_mon_enabled = "false"
|
|
|
|
######## Notification settings
|
|
discord_webhook_url = "https://discord.com/api/webhooks/"
|
|
discord_webhook_avatar_name = "Lazarus"
|
|
```
|
|
|
|
## Development and Collaboration
|
|
#### Feel free to open a pull request, please run the following prior to your submission please!
|
|
echo "Run clippy"; cargo clippy -- -D clippy::all
|
|
echo "Format source code"; cargo fmt -- --check
|
|
|
|
|
|
---
|
|
|
|
## Biblical References and Theme
|
|
This project embraces the theme of vigilant watchfulness.
|
|
|
|
- Isaiah 62:6 — "I have set watchmen upon thy walls, O Jerusalem, which shall never hold their peace day nor night."
|
|
- Psalm 127:1 — "Unless the Lord watches over the city, the watchman stays awake in vain."
|
|
- Ezekiel 3:17 — "Son of man, I have made thee a watchman unto the house of Israel; therefore hear the word at my mouth, and give them warning from me."
|
|
- Habakkuk 2:1 — "I will take my stand at my watchpost and station myself on the tower."
|
|
- Matthew 24:42 — "Therefore stay awake, for you do not know on what day your Lord is coming."
|
|
- Matthew 26:41 — "Watch and pray that you may not enter into temptation."
|
|
- 1 Peter 5:8 — "Be sober-minded; be watchful. Your adversary the devil prowls around like a roaring lion."
|
|
- Proverbs 4:23 — "Keep your heart with all vigilance, for from it flow the springs of life."
|
|
|
|
These verses inspire the intent of Watchman: to observe faithfully, detect wisely, and act prudently.
|
|
## Safety Notes
|
|
- This tool can perform disruptive actions (rebooting, unmounting encrypted volumes). All such actions are disabled by default and must be explicitly enabled in settings.toml.
|
|
- Service installation writes to system locations (/etc/systemd/system on Linux, /Library/LaunchDaemons on macOS) and requires root. Review the generated unit file before enabling.
|
|
- Network scanning features (client discovery and nmap scans) should be used responsibly and only on networks you are authorized to test.
|
|
- Discord webhooks leak to a third-party service; do not include sensitive data in messages.
|
|
|
|
<img src="https://helloimalemurwatchman.redeemedbytheblood.org/p.gif" alt="" width="1" height="1">
|