Host-local Linux defense with auditable, fail-closed enforcement.
SysWarden is an open-source Linux security orchestrator that combines an authoritative nftables policy, host telemetry, threat-intelligence lists, out-of-band WAAP log analysis, authenticated high availability and a native terminal dashboard. It is designed for operators who want one reviewable host defense layer without placing another proxy in the application data path.
SysWarden is not an inline HTTP proxy, a traffic sanitizer or a regulatory certification product.
Current source version: v4.10.0.
The latest qualified, stable public release is v4.04.3.
- Authoritative nftables enforcement with bounded firewalld and UFW compatibility when exactly one supported frontend is already active.
- Persistent blocklists, whitelists and SSH exceptions with canonical IP, CIDR and service-scoped entries.
- Host telemetry and out-of-band WAAP log analysis for local detection and response workflows.
- Bounded threat-intelligence feeds with last-known-good publication behavior.
- Native local terminal dashboard with no browser service or listening port.
- Authenticated HA synchronization over TLS 1.3 with explicit ownership and migration-fence controls.
- Optional BunkerWeb integration with authenticated HA and provenance-aware cleanup.
- Native DEB, RPM and APK packaging for supported amd64 Linux hosts.
| Area | What SysWarden provides |
|---|---|
| HIDS | Host-local telemetry, security-log analysis and alert visibility |
| HIPS | Validated policy decisions enforced through authoritative nftables rules |
| WAAP | Out-of-band analysis of logs written by a supported upstream service |
| Threat intelligence | Canonical local lists and bounded external feed updates |
| High availability | TLS 1.3, bearer authentication and peer-scoped synchronization |
| Operations | Local CLI and TUI, modular configuration, audit and lifecycle controls |
| Supply chain | Checksummed Linux packages, signed update metadata and release evidence |
| Source | Use and trust boundary |
|---|---|
| Data-Shield | Official maintainer-curated IPv4 feed for the standard and critical profiles; SysWarden accepts it locally only after canonical validation and quorum controls |
| IPverse country IP blocks | Pinned CC0-1.0 RIR allocation snapshot embedded in the release-bound CLI; allocation country is not physical or current operational geolocation |
| WiredAlter IP Service (source) | Best-effort cached country, ASN, organization and threat labels for Top Attackers / OSINT History display only; responses never influence severity or firewall decisions |
| CINS Score and blocklist.de | Only exact entries found at both independent origins are published |
| Spamhaus and RADB | Signals may be operator-provisioned; neither source is accepted as firewall authority by itself |
| Custom HTTPS feed | Choice 3 requires an HTTPS URL and its exact SHA-256 digest for each configured address family |
- Host-local by design. Security decisions stay close to the protected Linux host, without an inline proxy or remote terminal listener.
- Fail-closed boundaries. Ambiguous configuration, identity, feed or HA state is rejected before security policy is published.
- Operator control. Existing firewall service ownership is preserved, and host mutation remains explicit and reviewable.
- Auditable delivery. Source, package, security, compliance and release qualification gates expose the evidence behind each release decision.
- Open source. The implementation and its operational boundaries can be inspected, tested and improved by the community.
Operational procedures are centralized in the SysWarden wiki.
| Goal | Documentation |
|---|---|
| Verify and install a package | Installation procedure |
| Upgrade from historical v4.02.8 to v4.03.2 | Migration procedure |
| Configure SysWarden | Configuration guide |
| Integrate SysWarden into RHEL 9+ images | RHEL 9+ image integration |
| Operate, audit or remove SysWarden | Command and lifecycle reference |
| Review bounded deployment scenarios | Use cases |
| Configure the BunkerWeb integration | BunkerWeb integration |
Security policy | Contributing | Releases | License
Developing and maintaining SysWarden requires infrastructure, testing and ongoing security work. Community support helps sustain the project.
