About Watcher
Watcher is a security framework for Linux server systems.
It is designed primarily for so-called 'root servers' but can also be used for regular servers in a DMZ.
Watcher is constructed to run under minimalistic circumstances; i.e. minimalistic server installations. It is based on BASH & Friends (AWK, coreutils, util-linux, and other basic tools) that come with a 'minimal' installation and does not use any 3rd-party programming language(s) like PERL, Python, LUA, and the like. The only exotic tool is SQlite for the exclusive databases of the modules.
The Watcher framework provides the basis for the components:
- Static lists
- Dynloaders (dynamic loaders)
- Modules
Static lists (whitelist, blacklist) are manually maintained list files to be loaded into the firewall.
Dynloaders pick data from external resources (Spamhaus, nixspam, etc.) and turn data files from the specific provider's format into load files for the firewall.
Modules are the real workhorses in the Watcher framework. They constitute the RIDS/RIPS (Realtime Intrusion Detection/Prevention System) and store their data into an exclusive database for retrieval during system starts and reboots.
Loading the firewall from all components (e.g. after a reboot) takes just a few seconds:
[root@vmd123606 ~]# service watcher start [do_start] Starting service watcher with kernel firewall 'iptables' ... WatcherV1 V1.4RC2 ... Running on almalinux 9.5 vmd123606.contaboserver.net Built 20M RAMdisk 'Watcher-ramdisk' on mountpoint Pool Present DynLoaders: geo nixspam spamhaus Present Modules : GeoTrack WatchLG WatchMB WatchMX WatchWB Loading firewall 'iptables' ... » LoadLG ... finished in 447.18 ms » LoadMX ... finished in 338.58 ms » LoadWB ... finished in 303.05 ms » Load-GeoTrack ... finished in 125.87 ms » spamhaus ... finished in 150.03 ms » nixspam ... finished in 573.26 ms » geo ... finished in 1091.23 ms Took 3.6600 seconds for 36098 total firewall DROPs Loadrate 9862 DROPs per second Starting module WatchLG ... Starting module WatchMX ... Starting module WatchWB ... Starting module GeoTrack ... [OK]