SysWarden
Linux defense. Your host. Your rules.
Host-local Linux defense with auditable, fail-closed enforcement.
Website | Documentation | Build from source | Roadmap
SysWarden is an open-source Linux security orchestrator that combines an authoritative nftables policy, host telemetry, threat-intelligence lists, out-of-band WAAP log analysis, authenticated high availability and a native terminal dashboard. It is designed for operators who want one reviewable host defense layer without placing another proxy in the application data path.
SysWarden is not an inline HTTP proxy, a traffic sanitizer or a regulatory certification product.
Current source version: v4.10.4.
The latest stable release is v4.10.4, validated under IVV (Integration, Verification and Validation).
Use the installation guide,
historical recovery and removal guide
and release verification record.
Intermediate releases follow IVV; Upgrade generations require full IVVQ.
Later source builds do not inherit a published release verdict.
Observe, decide, enforce
SysWarden observes host signals, evaluates operator policy and applies validated actions through nftables. Logs and release evidence help operators review what was observed and exercised. This illustration summarizes the defense model; individual capabilities remain subject to their documented version and scope.
Features
- Authoritative nftables enforcement with bounded firewalld and UFW
- Persistent blocklists, whitelists and SSH exceptions with canonical IP,
- Host telemetry and out-of-band WAAP log analysis for local detection and
- Bounded threat-intelligence feeds with last-known-good publication behavior.
- Native local terminal dashboard with no browser service or listening port.
- Authenticated HA synchronization over TLS 1.3 with explicit ownership and
- Optional BunkerWeb integration with authenticated HA and provenance-aware
- Native DEB, RPM and APK packaging for supported amd64 Linux hosts.
Capabilities
| Area | What SysWarden provides | | --- | --- | | HIDS | Host-local telemetry, security-log analysis and alert visibility | | HIPS | Validated policy decisions enforced through authoritative nftables rules | | WAAP | Out-of-band analysis of logs written by a supported upstream service | | Threat intelligence | Canonical local lists and bounded external feed updates | | High availability | TLS 1.3, bearer authentication and peer-scoped synchronization | | Operations | Local CLI and TUI, modular configuration, audit and lifecycle controls | | Supply chain | Checksummed Linux packages, signed update metadata and release evidence |
BunkerWeb integration plugin
Use the optional BunkerWeb integration plugin to connect supported BunkerWeb security events to SysWarden host enforcement through the authenticated HTTPS API. The integration guide covers configuration and compatibility. Follow the version-specific prerequisites before enabling synchronization or HA v2.
Release inventory and verification
The stable v4.10.4 release publishes a machine-readable SPDX software bill of materials, syswarden-sbom.spdx.json, for dependency review. An SBOM is an inventory, not a vulnerability-free claim.
SHA256SUMS.txt checks package integrity against the downloaded inventory.
Authenticate the Ed25519-signed update manifest with an independently trusted
release key before installing a manually downloaded package. The
operator guidance
explains the existing verifier, its trust prerequisites and the distinction
between package authentication and the SBOM inventory.
Intelligence Sources
| Source | Use and trust boundary | | --- | --- | | Data-Shield | Official maintainer-curated IPv4 feed for the standard and critical profiles; SysWarden accepts it locally only after canonical validation and quorum controls | | IPverse country IP blocks | Pinned CC0-1.0 RIR allocation snapshot embedded in the release-bound CLI; allocation country is not physical or current operational geolocation | | WiredAlter IP Service (source) | Best-effort cached country, ASN, organization and threat labels for Top Attackers / OSINT History display only; responses never influence severity or firewall decisions | | CINS Score and blocklist.de | Only exact entries found at both independent origins are published | | Spamhaus and RADB | Signals may be operator-provisioned; neither source is accepted as firewall authority by itself | | Custom HTTPS feed | Choice 3 requires an HTTPS URL and its exact SHA-256 digest for each configured address family |
Why Choose SysWarden
- Host-local by design. Security decisions stay close to the protected
- Fail-closed boundaries. Ambiguous configuration, identity, feed or HA
- Operator control. Existing firewall service ownership is preserved, and
- Auditable delivery. Source, package, security, compliance and release
- Open source. The implementation and its operational boundaries can be
Documentation
Operational procedures are centralized in the SysWarden documentation. The former wiki pages are preserved there with search, copyable commands and explicit version badges. Historical v4.04.3 procedures retain their original scope; use the current getting-started page for the v4.10.4 release.
| Goal | Documentation | | --- | --- | | Verify and install v4.10.4 | Get started with the signed release | | Build from an exact reviewed source revision | Build and install from source | | Diagnose SSH detection, RHEL CLI paths and HA trust | Version-aware operator guidance | | Configure BunkerWeb log inputs | BunkerWeb log configuration | | Upgrade from historical v4.02.8 to v4.03.2 | Migration procedure | | Review the historical configuration layout | Configuration guide | | Integrate SysWarden into RHEL 9+ images | RHEL 9+ image integration | | Review the historical command and lifecycle contract | Command and lifecycle reference | | Review bounded deployment scenarios | Use cases | | Configure the BunkerWeb integration | BunkerWeb integration |
Community
Join the official SysWarden Discord for practical exchanges, project updates and community support in French and English. The official invitation does not expire.
New members complete Discord verification, accept the rules and wait ten minutes
before channels open. Choose one or more roles in roles: users, testers
and funders. News and funding channels are read-only, with reactions enabled;
the private testing discussion requires the testers role.
Use help-fr or help-en to open a focused support post with the exact version,
reproduction steps and anonymised logs. Never post credentials or confidential
data. Report vulnerabilities privately through the security policy.
Project
Security policy | Contributing | Releases | License
Developing and maintaining SysWarden requires infrastructure, testing and ongoing security work. Community support helps sustain the project.
