8 releases 8 tags

RSS feed

• v1.5.0 f6e6a79105

  Compare

  netwatch 1.5.0 — Blocklists, fleet bans, pending updates Stable

  david released this 2026-10-31 18:11:07 +01:00 | 30 commits to main since this release

  Blocklists, fleet bans and pending updates.

  • The hub downloads Feodo Tracker (recommended), Spamhaus DROP and the Tor exit list daily.
    Feodo and DROP are blocked in both directions on every server that opts in; Tor exits are
    tagged, never blocked. A server that still tries to reach a listed address raises a crit
    alert: the strongest sign netwatch can give that the server is compromised.
  • An SSH auto-ban on one server is copied to every opted-in server, with one push. Unban
    everywhere lifts it on all of them.
  • Each server card shows pending security updates and "reboot required", read hourly by a
    read-only root helper. netwatch never runs apt update or installs anything.
  • Hub bans are opt-in per server: accept_hub_bans = true under [security] in agent.toml.
    The agent's safelist always wins. Turning it off and restarting removes everything the hub
    sent. The README's threat model describes the new worst case.
  • ban_cap defaults to 5000.

  Upgrade the hub first, then each agent, then opt in. Blocklists are tested on Ubuntu 24.04
  (nftables 1.0.9); Debian 12 (nftables 1.0.6) is expected to work but untested.

  netwatch is not affiliated with or endorsed by The Spamhaus Project.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • SHA256SUMS
    4 downloads · 2026-10-31 18:11:09 +01:00 · 442 B
  • netwatch-agent-1.5.0-aarch64-linux-gnu.tar.gz
    0 downloads · 2026-10-31 18:11:09 +01:00 · 2.4 MiB
  • netwatch-agent-1.5.0-x86_64-linux-gnu.tar.gz
    3 downloads · 2026-10-31 18:11:10 +01:00 · 2.4 MiB
  • netwatch-hub-1.5.0-aarch64-linux-gnu.tar.gz
    0 downloads · 2026-10-31 18:11:10 +01:00 · 5.5 MiB
  • netwatch-hub-1.5.0-x86_64-linux-gnu.tar.gz
    1 download · 2026-10-31 18:11:11 +01:00 · 5.5 MiB