Vörwatch is now live — a new open source CLI tool from VEKTOR: lightweight, dependency-free VPS anomaly detection in a single bash script. No daemon, no database, no cloud dashboard. Runs off cron, state lives in flat files.
What it checks:
- File integrity (SHA-256 baseline of sshd_config, shadow, crontab, nginx.conf + more)
- Listening port baselining
- Outbound connection tracking vs. a public threat blocklist
- Process tree anomalies (e.g. nginx spawning a shell)
- SSH auth cross-reference
- nginx request-volume + 404-scanning detection
- Package vulnerability scanning via OSV.dev (no API key needed)
- Rootkit/backdoor scanning (chkrootkit / rkhunter)
- CIS-style hardening spot-checks
- Optional first-seen DNS query anomaly tracking
It’s recommend-only by design — never runs ufw deny, never calls fail2ban-client banip, never touches iptables. Every alert tells you the exact command to run yourself.
Optional AbuseIPDB reputation scoring and Resend email digests (urgent alerts immediately, everything else in a scheduled digest).
npm install -g @vektormemory/vorwatch
sudo vorwatch-install
Apache 2.0. GitHub: GitHub - Vektor-Memory/Vorwatch: Vörwatch - Built by Vektor Memory - A lightweight, dependency-free VPS anomaly detection in a single bash script · GitHub
PII Redaction (MEDIUM)