A single binary with zero external dependencies. One command, five minutes.
| Platform | Requirements |
|---|---|
| Linux | x86_64; kernel 3.13+ (native nftables blocking, tested down to kernel 4.4; older systems fall back to ipset automatically); Apache access / error logs (nginx needs its log directory named); SSH brute-force detection needs read access to /var/log/auth.log |
| Synology NAS | DSM 6 and DSM 7 (tested on DSM 6.2.4, 7.2.2 and 7.3); packages for x86_64, armv7 and arm64, one set per DSM generation; blocks are written into DSM's built-in firewall |
| Not supported yet | ARM machines running ordinary Linux (Raspberry Pi, ARM cloud instances); Windows |
Nothing to pre-install: SvrGuard drives nftables straight through the kernel's netlink interface, and only falls back to ipset / iptables on older systems.
# Run as root; installs the service and starts it
curl -fsSL https://svrguard.ofuyuan.com/install.sh | sudo sh
The script works out which package this host wants: a .deb where apt is present, an .rpm where dnf / yum / zypper is, and the tarball when there is neither. It asks nothing — log paths are detected, and the service is registered and started for you.
On a Synology NAS it refuses to run and points you at the .spk instead: DSM records the installed version in the package's own metadata, and a binary put there behind Package Center's back no longer matches it.
Prefer not to pipe a script, or want to answer the setup questions yourself? Download a package and install it by hand — unpack the tarball and run sudo sh install.sh for the interactive setup wizard, which is now the only path that asks anything:
The .deb and .rpm give you exactly what the one-line command does (binary at /usr/bin/svrguard). The tarball does not: it installs under /opt/svrguard, outside any package manager, so dependencies are not resolved for you.
NAS installs from a native .spk — no SSH, and nothing to install alongside it: blocking rules go into DSM's own firewall.
.spk. DSM will warn that the publisher is not certified by Synology — Settings → Trust Level has to allow "Any publisher" to continue.Updates after that are the package's own job: they come through a signed channel that always keeps the previous build, and with no rollback target available the agent declines to update rather than strand you on a broken version.
A host with no subscription receives no supply, so it stays on the version it has until you move it. Do that from the command line over SSH — not from Package Center. Manual Install treats an existing package as a new one and asks you to remove it first, and removing it releases the host's binding to your hub along with the package.
ARCH=armv7 # or arm64 / x86_64 — the one you installed BASE=https://svrguard.ofuyuan.com/update/agent/synology curl -fsSL "$BASE/latest-$ARCH.json" # read "url" and "sha256" from this curl -fsSL -o /tmp/svrguard.spk "$BASE/<the url from the manifest>" sha256sum /tmp/svrguard.spk # must equal the manifest's "sha256" /usr/syno/bin/synopkg install /tmp/svrguard.spk /usr/syno/bin/synopkg start SvrGuard /usr/syno/bin/synopkg status SvrGuard # must say "is started"
Read the version and hash out of the manifest rather than trusting a filename: the /dl links above always keep the same name, whatever version is behind them.
The last two lines are not optional. synopkg install exits 0 with the service stopped. Everything else still looks right — the version is new, the host is still bound, and the firewall rules stay in the kernel and go on blocking — so the only thing that changed is that nothing is watching for new attacks any more, and nothing says so. Confirm with status before you walk away.
Detection and blocking start the moment the install finishes, with nothing to answer — Apache log paths are detected for you. To set them yourself, change them in the console afterwards, or use the tarball's interactive install.
Open http://127.0.0.1:8092 and press "Bind to my account". No browser on this host? Run svrguard pair -device. "Standalone" and "Central" modes are both free.
Depending on exposure, the first automatic block usually arrives within hours. Open the dashboard or wait for the email.
To verify blocking is live (Linux): svrguard blockcheck compares the database against the kernel entry by entry and names any that did not actually take — that is the reliable one. To look at the kernel tables directly, IPv4 is nft list table ip svrguard and IPv6 is nft list table ip6 svrguard (they are separate kernel objects; there is no combined table).
Free: download the latest package from this site and install it over the one you have — configuration and data are preserved. On a Synology NAS this has to be done from the command line, or the host loses its binding: see updating a NAS by hand.
Pro: OTA auto-update — agents upgrade themselves when a release ships, and the threat address database updates continuously online.