Linux server defense / GPL-3.0 / Shipping

Know who is attacking your server.
Then block them.

One small program on your Linux server. It reads the log files you already have, shows you who is knocking, and blocks the ones that are attacking. For the first day it only watches — so you can see what it would have blocked before it blocks anything.

Install 
$ curl -fsSL https://get.breachharbor.com | sh
$ breachharbor agent run

Linux, x86-64 and arm64. Needs nftables or iptables and root. About a minute, start to finish.

root@web-01 — breachharbor agent run 
14:02:11 ready   tailing sshd, nginx, fail2ban
14:02:11 mode    observe · 23h 58m to enforcement
14:04:39 seen    45.148.10.72   sshd  18 fails/60s
14:04:39 would   block 45.148.10.72  (limit 10/60s)
14:06:02 seen    103.75.190.14  nginx 404 sweep ×212
14:06:02 would   block 103.75.190.14 (feed scanner)
14:09:20 seen    82.64.31.9     sshd  key ok · allow
14:11:47 summary 1,284 seen / 6 flagged / 0 blocked
$

In plain termsYour server already writes down every failed login and every odd request. Breach Harbor reads those notes, works out which visitors are trying to break in, and tells your firewall to shut the door on them. Nothing else about your machine changes.

What it does

01

It uses logs you already have

sshd, nginx and fail2ban write these files whether you read them or not. Nothing new to configure, nothing sniffing your traffic, no load you will notice.

02

It watches for a day first

For the first 24 hours it blocks nothing. It just prints what it would have blocked, so you can check it before you trust it.

03

It blocks on your own machine

Rules go straight into your nftables or iptables set. Nothing calls out to a server first, so a bad network never turns into an outage.

04

One command undoes it all

breachharbor agent flush removes every rule it added and touches nothing else you wrote.

Trust

This software runs as root and edits your firewall. Here is exactly what that means.

Open source, GPL-3.0

Every line is on GitHub. Read it before you run it, and keep reading it after.

The install script is short on purpose

Under 100 lines. You can read the whole thing in a minute, and you should.

Nothing leaves your machine by default

Sharing is off until you turn it on. When you do, it sends IP addresses and event types. Never log contents, never hostnames, never credentials.

Signed and checksummed releases

Every binary ships with a signature and a checksum. Verify before you trust.

It will not lock you out

The address of your current SSH session is exempted before the first rule is ever written.

No third-party scripts on this page

No analytics, no cookies, no CDN you did not ask for. A security product should not leak your visit.

How it works

YOUR LOGS BREACH HARBOR YOUR FIREWALL sshd · nginx fail2ban read → score → decide nftables iptables set already on your machine already on your machine
  1. STEP 1

    Read

    It follows your existing log files and picks out the lines that describe someone knocking.

  2. STEP 2

    Score

    Each address gets a score from how it behaved on your machine, plus the shared blocklist if you opt in.

  3. STEP 3

    Show

    For a day it only reports. You read the log, adjust the thresholds, and decide when to arm it.

  4. STEP 4

    Block

    Rules land in a dedicated firewall set, with your own SSH address exempt from the start.

Pricing and licensing

Community
Free forever
  • —The agent, the server and the dashboard
  • —Community blocklist, refreshed continuously
  • —Unlimited machines you own
  • —GPL-3.0, no seat count, no telemetry gate
Get the source
Business license
Pricing on request
  • —Embed, redistribute or run Breach Harbor without GPL obligations
  • —Priority support, direct line to the maintainer
  • —Custom threat feed integrations
  • —Deployment help on your fleet

Open a licensing thread on GitHub and a person answers, usually within a working day.

Ask about licensing

What it runs on

One static binary, no runtime to install and no database to stand up. If your machine writes sshd or nginx logs and has a firewall, it will work.

Bug reports get read the same day. If something breaks, tell me.

SYSTEM
Linux, kernel 4.19 or newer
ARCH
x86-64 and arm64
FIREWALL
nftables or iptables
LOGS
sshd, nginx, fail2ban — journald or files
FOOTPRINT
One binary, no runtime, no database
LICENSE
GPL-3.0, signed and checksummed releases

One command, one minute, and you can see who has been knocking.

Read the source Install it