README

 _                              
| |__  _ __ __ ___   _____  ___ 
| '_ \| '__/ _` \ \ / / _ \/ __|
| |_) | | | (_| |\ V / (_) \__ \
|_.__/|_|  \__,_| \_/ \___/|___/

Log file security parser.

Features

• Multi process log monitors
• Low resource usage
• Adaptive monitor frequency
• Systemd service
• Firewalld ipset blacklist
• Whitelist log by keywords
• Blacklist by keywords
• Blacklist by regular expressions
• Block CIDR net blocks or individual IP addresses

Supported log formats

• Apache
• Dovecot

Requirements

• PHP 8.0, 8.1, 8.2, 8.3, 8.4, 8.5
• libLoggerPHP
• libSDManagerPHP

Install with RPM packages

You may install bravos via the copr repository, for Alma/Rocky/Oracle Enterprise Linux and Fedora, simply use:

dnf copr enable mksanthi/noumenia
dnf install bravos

Install with Composer

You may install bravos with composer, to get the latest version use the create-project command, the last dot is important because it tells composer to save the files in the current directory.

composer create-project noumenia/bravos .

It is important to note, that bravos must be run as root when installed by composer. Since the RPM package installs two additional files, the sudoers file and the systemd service, these files give the required permissions to run bravos as a normal user.

How to use

If you installed via the RPM packages then a systemd service is already available and bravos can be started with systemctl. By default, bravos will read the configuration file /etc/bravos.ini and monitor log files defined under the logFiles[] array.

systemctl --now enable bravos

If you installed via composer or manually, then the bravos.ini file will be located in the same directory as the bravos executable and can be specified with the --ini=... parameter. Below is the complete list of command-line parameters:

Usage: bravos [OPTION]...

  -V,  --version             display version information only
  -h,  --help                display help about parameters
  -v,  --verbose             enable verbose output to stdout

  -u,  --user=[USER]         Daemon user
  -g,  --group=[GROUP]       Daemon group
  -p,  --pid=[FILE]          PID file
  -l,  --processlimit=[NUM]  Process limit
  -i,  --ini=[FILE]          Configuration file (/etc/bravos.ini)

       --logfiles=[FILE]     Log file(s) to monitor for changes, can be set multiple times

Related projects

• Aetolos - Virtual hosting at your... command line!
• guardian-milter - Multi-purpose security milter.
• bravos - Log file security parser.
• mmDbDaemon is a memory-resident MaxMind Database reader implementation in PHP.
• libMilterPHP is a Postfix/Sendmail Milter library implementation in PHP.
• libSDManagerPHP provides a portable daemon with a Sockets and Streams manager.
• libLoggerPHP is a logging library implementation in PHP.