Loading...
 
Skip to main content

About Watcher 

Watcher is a security framework for Linux server systems.

It is designed primarily for so-called 'root servers' but can also be used for regular servers in a DMZ.

Watcher is constructed to run under minimalistic circumstances; i.e. minimalistic server installations. It is based on BASH & Friends (AWK, coreutils, util-linux, and other basic tools) that come with a 'minimal' installation and does not use any 3rd-party programming language(s) like PERL, Python, LUA, and the like. The only exotic tool is SQlite for the exclusive databases of the modules.

The Watcher framework provides the basis for the components:

  • Static lists
  • Dynloaders (dynamic loaders)
  • Modules

Static lists (whitelist, blacklist) are manually maintained list files to be loaded into the firewall.

Dynloaders pick data from external resources (Spamhaus, nixspam, etc.) and turn data files from the specific provider's format into load files for the firewall.

Modules are the real workhorses in the Watcher framework. They constitute the RIDS/RIPS (Realtime Intrusion Detection/Prevention System) and store their data into an exclusive database for retrieval during system starts and reboots.

Loading the firewall from all components (e.g. after a reboot) takes just a few seconds:

Copy to clipboard
[root@vmd123606 ~]# service watcher start [do_start] Starting service watcher with kernel firewall 'iptables' ... WatcherV1 V1.4RC2 ... Running on almalinux 9.5 vmd123606.contaboserver.net Built 20M RAMdisk 'Watcher-ramdisk' on mountpoint Pool Present DynLoaders: geo nixspam spamhaus Present Modules   : GeoTrack WatchLG WatchMB WatchMX WatchWB Loading firewall 'iptables' ...  » LoadLG           ... finished in   447.18 ms  » LoadMX          ... finished in   338.58 ms  » LoadWB           ... finished in   303.05 ms  » Load-GeoTrack    ... finished in   125.87 ms  » spamhaus        ... finished in   150.03 ms  » nixspam          ... finished in   573.26 ms  » geo              ... finished in  1091.23 ms         Took   3.6600 seconds          for    36098 total firewall DROPs     Loadrate     9862 DROPs per second Starting module WatchLG ... Starting module WatchMX ... Starting module WatchWB ... Starting module GeoTrack ... [OK]