Foss Application BastionGuard

FOSS Applications/Projects
, , ,
1

A Complete Open-Source Security Platform for Linux

We are pleased to announce the release of BastionGuard 2.0, a modular security platform designed specifically for GNU/Linux.

This new version brings endpoint protection, network connection control, system backup, data recovery and browser-based administration together in a single integrated suite.

BastionGuard 2.0 is distributed as free and open-source software under the GNU General Public License v3, allowing users, developers, security researchers and Linux distribution maintainers to inspect, build, modify and improve the source code.
One Platform, Five Core Components
BastionGuard Endpoint

BastionGuard Endpoint is the central security application of the suite.

It provides a unified interface for accessing the platform’s main security capabilities, including:

malware scanning;
anti-ransomware protection;
anti-phishing detection;
firewall management;
USB device monitoring;
webcam and microphone privacy controls;
quarantine management;
identity and data-leak checks;
password management;
secure browsing and payment tools;
overall protection status monitoring.

Its purpose is to give Linux users a clear and centralized view of their system security, reducing the need to manage several disconnected tools.
BastionGuard Backup

BastionGuard Backup protects the operating system through incremental snapshots of system files and configuration.

It supports RSYNC-based snapshots and, on compatible systems, native Btrfs snapshots.

Users can configure:

hourly snapshots;
daily snapshots;
weekly snapshots;
monthly snapshots;
boot snapshots;
manual snapshots.

Snapshots can be restored to reverse unwanted changes, recover from failed updates or return the system to a previously working state.

BastionGuard Backup is primarily designed to protect the operating system and its configuration while keeping personal-document management separate.
BastionGuard Secure Connection

BastionGuard Secure Connection is an interactive application firewall for GNU/Linux.

It monitors outgoing network connections and allows users to decide which applications may communicate with external hosts.

Decisions can be applied temporarily or stored as persistent rules.

Its main capabilities include:

real-time connection monitoring;
application and process identification;
destination host, IP address and port visibility;
allow and deny rules;
connection history;
per-application statistics;
configured proxy detection;
nftables and NFQUEUE integration;
a /proc-based fallback when direct packet interception is unavailable.

The daemon and graphical interface communicate through a Unix socket using a lightweight JSON protocol, keeping packet interception separate from user interaction.
BastionGuard Recovery Data

BastionGuard Recovery Data is an advanced data-recovery engine developed in C++20.

It can analyze block devices, partitions and disk images to recover files, directories and, where supported, symbolic links.

Supported filesystems include:

FAT32;
exFAT;
NTFS;
ext4;
Btrfs;
XFS;
HFS+ and HFSX.

The engine can be used in several scenarios:

recovering files from intact volumes;
recovering deleted files;
analyzing filesystems with damaged metadata;
locating lost partitions;
recovering data from disk images;
filesystem-independent file carving.

The carving engine recognizes a broad range of formats, including images, documents, archives, audio files, video files and databases.

Advanced capabilities include:

ext4 journal processing;
NTFS recovery through $LogFile;
$MFTMirr fallback;
$I30 directory-index analysis;
Btrfs zlib, LZO and zstd extent decompression;
Btrfs RAID 5 and RAID 6 reconstruction;
XFS V5 recovery through FINOBT;
HFS+ compressed-file support;
symbolic-link reconstruction;
Unicode filename normalization.

BastionGuard Recovery Data clearly documents both its capabilities and limitations, distinguishing complete, partial and forensic reconstructions.
BastionGuard WebUI Server

BastionGuard WebUI Server extends the platform through a browser-accessible interface.

The WebUI makes it possible to view information, service status, security events and supported management functions without relying exclusively on the desktop application.

This component is designed for:

Linux workstations;
servers;
remotely administered environments;
laboratories;
local networks;
installations with multiple BastionGuard systems.

The WebUI complements the native applications and makes BastionGuard suitable for both desktop use and centralized operational workflows.
Designed for Linux

BastionGuard 2.0 uses established technologies from the Linux ecosystem, including:

systemd;
nftables;
NFQUEUE;
GTK;
CMake;
Meson;
OpenSSL;
YARA;
RSYNC;
Btrfs;
libsystemd;
libudev.

The platform is designed to integrate with major Linux distribution families, including:

Debian and Ubuntu;
Linux Mint and related distributions;
Fedora;
RHEL, AlmaLinux and Rocky Linux;
Arch Linux;
openSUSE.

Build and packaging procedures can adapt individual components to the technical and security requirements of each distribution.
Open Source and Auditable

BastionGuard 2.0 is designed as a transparent and auditable platform.

Its open-source development model allows the community to:

inspect the code;
audit security-sensitive components;
identify and fix issues;
create packages for additional distributions;
develop new integrations;
improve documentation and translations;
propose new features;
adapt the software to specific infrastructures.

The source code is distributed under the GNU GPLv3. The BastionGuard name and the project’s distinctive branding remain protected as trademarks.
A New Starting Point

BastionGuard 2.0 establishes the foundation for the future development of the platform.

The goal is to build a Linux security suite that combines prevention, monitoring, network control, system backup and data recovery through modular and interoperable components.

An open, documented platform built around native GNU/Linux technologies.

Protect the endpoint.
Control the connections.
Restore the system.
Recover the data.
Manage everything from the web.
Welcome to BastionGuard 2.0

2

I checked … it has free downloads to a range of distros … Debian, Fedora, Arch, OpenSUSE, Ubuntu,…
but it does not support non-systemd distros , ie Void, Artix, antiX, Devuan. I wonder how it deals with MX which is both systemd and sysvinit.
So is it systemd dependent?

Would a Debian download work in Debian-derived distros.?

There are no Flatpaks, Snaps , or Appimages.

You fail to say what it is? Does it run as a daemon, a user app, a system app, a kernel module?

How do we know that your download site is a trusted site?

Is any AI used in its programming or operation?

3

Some marketing spiel and you can’t even spell “guard” correctly in the subject?
Monty Python GIFGlobe
Bastion Gourd??? :smiley: :smiley: :smiley:

image

4

Hello and welcome to our community

Normally we do not accept a “sales pitch” based entry as yoirs clearly is. But as some of our users may be interested in testing your product. We will let it pass for now.

5

Hello,

It is an open-source project that has undergone two years of intensive development to ensure the product is mature enough for daily use.

I apologize in advance if I made it appear to be a commercial product; that was not my intention.

I am currently working on bringing it to operating systems that use OpenRC as well.

The software does not use kernel modules at all; instead, it utilizes native Linux features, including eBPF.

Unfortunately, since it is security software, it cannot run in sandboxed environments like Snap, AppImage, or Flatpak.

6

I apologize for the typo, and I have already corrected the name.

7

The site employs both server-side and website-level security measures to prevent tampering. The entire site operates with advanced sandbox protections.

AI was not used on the code itself, though it was utilized—in conjunction with templates I wrote—to generate the extensive documentation available on the site.

I am working on making it compatible with systems that use sysinit; however, it will unfortunately never work with Flatpak, Snap, or AppImage.

The core services—such as the anti-phishing and anti-ransomware modules, as well as the bastionguard-secure-connection and bastionguard-backup daemons—operate at the system root level.

As both a cybersecurity expert and an instructor, I resumed work on this project after discontinuing my previous one, CondresOS, a few years ago.

8

SysVinit is old, it predates systemd, but some popular distros such as MX , Dinit, and antiX still offer it.

OpenRC is a sort of simplified sysVinit.

You should also consider the newer init systems such as dinit and S6, because they are capable of everything systemd does and may one day replace it.

I do not know how dependent your software is on the init system, but it would be worth minimising that dependence , in terms of making it more portable.

While we are talking about portability … have you tried running BastionGuard on BSD?

We appreciate that info.
Your software must run with some privileges, so it is important that people be able to safely source it.

We needed that statement … there are quite a few users who object to AI code.

It is my job to check. We only support FOSS products.
You saw the warning from @callpaul.eu . What we like to see is less sales pitch and more info … possibly leading to someone trying your software and getting a chance to interact with you on technical details.

I understand why. That means you have to do a lot of work making distro-compatable packages. Your 7 distros is a good start.

9

I can try it on Gentoo with OpenRC (in a virtual machine). I think I can write an ebuild for Gentoo using git’s pkgbuild

10

Important Community Notice

We would like to clarify that BastionGuard and our official domain, bastionguard.eu, are not affiliated, connected, or associated in any way with the domain bastionguards.com.

We have not authorized the use of our name, and there is no collaboration, partnership, endorsement, or commercial relationship between us and the operators of that domain.

The domain bastionguards.com has already been reported through the appropriate channels for further investigation.

For official information and communications, please refer exclusively to our official domain:

bastionguard.eu

We encourage our community to remain cautious and always verify the website address before sharing information or interacting with online services.

11

I am working on getting it to work with both OpenRC and SysVinit.

12

Thank you for the clarification. Where possible we encourage users to go to a repository to get software rather than a web site, but not always an option. Too many similar names and products confusion for all

13

Too late - forever in my sphere of “stuff” you’ll be the purveyor of the holy gourd :smiley: …

14

A title of great responsibility. I promise to wield the Holy Gourd wisely. :grinning_face_with_smiling_eyes:

15

when it hits the official Debian repos, I might give it consideration.

16

I am also working on the official repositories for each supported distro. It takes time because the build infrastructure will make the official repositories available, complete with signatures for every package.

17

Fo r those, like me , who have not encounterd eBPF

eBPF (Extended Berkeley Packet Filter) is a revolutionary kernel technology that allows you to safely and dynamically run sandboxed programs directly inside the Linux kernel without changing the kernel source code or loading risk-heavy kernel modules. [1, 2]

I want to read more about this.

18

No ext2/ext3?
Ext2 is often used for sharing files with BSD. … it is the only filesystem that is reliably read/write in Linux and BSD, unless you use NFS.

While we are on multiple systems… how does BastionGuard perform in a multiboot computer?

19
20

Support for ext2, ext3, and apsf is coming. I need to write more than 10,000 lines of code and test it for data recovery. The most complex is apsf, which has a very different structure, even in content management.

I have not encountered any bastionguard issues on multiple systems given the rigorous testing it has undergone and been used in production.