Detect repeated abuse
Use supported service logs and plugin reports to identify login attacks and suspicious requests. Keep the events that explain the detection.
Witen Warden for Linux
Block login attacks and suspicious traffic on Linux.
Warden detects repeated SSH login failures and abuse in supported web-server logs. It can block the source IP through your firewall, record the reason, and remove the block when it expires.
Version 0.1.19. Requires administrator access to the host. Free downloads; hosted plans are optional.
Packages for Debian, Ubuntu, RPM-based distributions, and Alpine. Portable glibc and musl builds are available for Gentoo and other Linux systems.
Choosing a server security tool? Compare Warden with Fail2Ban.
Know what triggered a block
Manage blocks on the host
Inspect active blocks, allow trusted addresses, and remove a block locally. You keep access to these controls if the Witen website is unavailable.
Set temporary blocks
Choose thresholds and ban durations for your services. Blocks expire automatically instead of accumulating indefinitely.
Add shared IP intelligence
Connect your account for blocklist updates and reports across enrolled systems. WordPress and Matomo plugins can also send application events through Warden’s local socket.
Review detections before enabling blocking
The supplied configuration uses nftables. To evaluate without changing firewall rules, set backend = "null" in the [jail] section before starting Warden. Check the detected services and trusted addresses before switching to nftables.
- Choose the package for your distribution and architecture.
- Review the service configuration, jail backend, and trusted addresses.
- Run
warden validate --config /etc/witen/warden.toml. - Check the detections, then enable firewall blocking when the rules fit your host.
Questions about Warden
Can I use Warden on shared hosting?
Warden needs administrator access to Linux so it can read service logs and manage the firewall. For shared WordPress hosting, use the WordPress plugin.
Does Warden need a paid account to block traffic?
No. Configured local detection and firewall rules run on the host. Connect a free or paid hosted plan when you want shared intelligence and reports in your Witen account.
Which firewall does Warden use?
nftables is the default. Review the setup guide before enabling firewall rules, especially if another tool already manages them. XDP is available for testing on supported Linux hosts, but remains optional and experimental.
Can a package manager download Warden?
Yes. Warden has a public release manifest, a plain-text version endpoint, and artifact URLs that do not need a browser session. The setup guide lists the formats and checksums.