Settings — SvrGuard

Some hosts have no browser that can reach their own console: SSH-only servers, machines deep inside a private network, or installs that were told not to serve a console at all. Those hosts are configured through a file.

There are two things to set: automatic updates, and where attack notifications are sent.

First, find two paths

Every command below needs them.

Installed from	Config file	Binary
deb / rpm	`/etc/svrguard/svrguard.ini`	`svrguard` (on your PATH)
tar.gz	`/opt/svrguard/svrguard.ini`	`/opt/svrguard/svrguard`
Synology DSM	`/var/packages/SvrGuard/var/svrguard.ini`	`/var/packages/SvrGuard/target/svrguard`

The commands below all say svrguard. If it is not on your PATH — it is not, for tar.gz and Synology — use the full path from the table instead.

Confirm you found the right file:

svrguard service -config /etc/svrguard/svrguard.ini status

This actually loads that file. If the path is wrong it says so, instead of quietly running on some other configuration.

Automatic updates

[update]
url = https://svrguard.ofuyuan.com/update/agent
auto = true               ; true or false

Write auto out explicitly, as the value you want. Do not rely on what the default is — different install methods write different values — and a value you wrote yourself holds on every host.

Leaving url empty switches update checking off entirely; it will not even look.

Updating once, by hand

⚠️ Linux and Synology are two different commands. They are not interchangeable.

Platform	Command
Linux (deb / rpm / tar.gz)	`svrguard update -config <config file>`
Synology DSM	`svrguard update-spk -config <config file>`

On Synology there is one more command, which prints the whole log of the last upgrade. When an upgrade fails, this is the only place a host with no console can see why:

svrguard update-spk -log -config /var/packages/SvrGuard/var/svrguard.ini

Attack notifications

Two parts, and the order matters: open the channel first, then fill in the mail settings.

[notify]
channels = email          ; syslog, email; empty = no notifications at all
min_severity = medium     ; high | medium | low
max_per_pass = 30         ; at most this many blocks listed per message
batch_hours = 24          ; 0 = send every detection pass; 1-24 = one digest every N hours
daily_summary_hour = 8    ; hour of the daily digest; -1 = do not send one

[email]
smtp_host =
smtp_port = 587           ; 465 is implicit TLS, anything else uses STARTTLS
username =
password =
from =
to =                      ; several recipients: comma separated

⚠️ Once the password is in, tighten the file's permissions. That file now holds your mail password, and by default anyone with an account on the same host can read it.

sudo chmod 600 /etc/svrguard/svrguard.ini

Three things that stop mail going out

TLS is required. An SMTP server offering no TLS is refused; it will not fall back to plain text.
Put only an address in from, never a name. That value is also the SMTP envelope sender, and a name inside it makes the server reject the whole message. Use the separate from_name key for a display name.
Gmail needs an app password (smtp.gmail.com:587), not the one you sign in with.

Making the change take effect

Editing the file always needs a service restart. SvrGuard has no "reload configuration" function; it reads the file once, at startup.

Platform	Command
Synology DSM	`/usr/syno/bin/synopkg restart SvrGuard`
systemd	`systemctl restart SvrGuard`
init.d	`/etc/init.d/SvrGuard restart`

⚠️ The service is named SvrGuard, spelled exactly like that. svrguard will not be found.

Then confirm it actually took

svrguard notify-test -config /etc/svrguard/svrguard.ini

If the test message arrives, the settings work.

⭐ This command does not test the file you just edited — it tests the configuration the program is really running on. So it answers two questions at once: did I fill this in correctly, and is something else overriding what I filled in.

⚠️ If anyone has ever saved notification settings from this host's console, that copy wins over the file. When that is the case, editing the file has no effect at all, and no screen anywhere says so. A notify-test that fails, or that arrives at an old recipient, is this. Change it from the console instead, or ask someone who can reach one.

There is no equivalent check for automatic updates. Its effective value can currently only be seen on the console — which is exactly what the readers of this page cannot open. So write auto out explicitly in the file: on this host, that is the most certain thing you can do.

⭐ Settings changed from the console need no restart; they apply on the next detection pass at the latest (five minutes by default). Only editing the file directly needs one.

Configuring from a file