SysWarden

Linux defense. Your host. Your rules.

Host-local Linux defense with auditable, fail-closed enforcement.

Website | Documentation | Build from source | Roadmap

SysWarden is an open-source Linux security orchestrator that combines an authoritative nftables policy, host telemetry, threat-intelligence lists, out-of-band WAAP log analysis, authenticated high availability and a native terminal dashboard. It is designed for operators who want one reviewable host defense layer without placing another proxy in the application data path.

SysWarden is not an inline HTTP proxy, a traffic sanitizer or a regulatory certification product.

Current source version: v4.10.4.

The latest stable release is v4.10.4, validated under IVV (Integration, Verification and Validation).

Use the installation guide, historical recovery and removal guide and release verification record. Intermediate releases follow IVV; Upgrade generations require full IVVQ. Later source builds do not inherit a published release verdict.

Observe, decide, enforce

SysWarden observes host signals, evaluates operator policy and applies validated actions through nftables. Logs and release evidence help operators review what was observed and exercised. This illustration summarizes the defense model; individual capabilities remain subject to their documented version and scope.

Features

• Authoritative nftables enforcement with bounded firewalld and UFW compatibility when exactly one supported frontend is already active.
• Persistent blocklists, whitelists and SSH exceptions with canonical IP, CIDR and service-scoped entries.
• Host telemetry and out-of-band WAAP log analysis for local detection and response workflows.
• Bounded threat-intelligence feeds with last-known-good publication behavior.
• Native local terminal dashboard with no browser service or listening port.
• Authenticated HA synchronization over TLS 1.3 with explicit ownership and migration-fence controls.
• Optional BunkerWeb integration with authenticated HA and provenance-aware cleanup.
• Native DEB, RPM and APK packaging for supported amd64 Linux hosts.

Capabilities

Area	What SysWarden provides
HIDS	Host-local telemetry, security-log analysis and alert visibility
HIPS	Validated policy decisions enforced through authoritative nftables rules
WAAP	Out-of-band analysis of logs written by a supported upstream service
Threat intelligence	Canonical local lists and bounded external feed updates
High availability	TLS 1.3, bearer authentication and peer-scoped synchronization
Operations	Local CLI and TUI, modular configuration, audit and lifecycle controls
Supply chain	Checksummed Linux packages, signed update metadata and release evidence

BunkerWeb integration plugin

Use the optional BunkerWeb integration plugin to connect supported BunkerWeb security events to SysWarden host enforcement through the authenticated HTTPS API. The integration guide covers configuration and compatibility. Follow the version-specific prerequisites before enabling synchronization or HA v2.

Release inventory and verification

The stable v4.10.4 release publishes a machine-readable SPDX software bill of materials, syswarden-sbom.spdx.json, for dependency review. An SBOM is an inventory, not a vulnerability-free claim.

SHA256SUMS.txt checks package integrity against the downloaded inventory. Authenticate the Ed25519-signed update manifest with an independently trusted release key before installing a manually downloaded package. The operator guidance explains the existing verifier, its trust prerequisites and the distinction between package authentication and the SBOM inventory.

Intelligence Sources