Who's here? π β A cross-platform login detection and notification tool
English | δΈζ
- π₯οΈ Cross-platform: macOS, Linux, Windows
- π‘ Multiple notification channels: Webhook, DingTalk, WeCom, Telegram, Slack, Email
- π Detects various login types: SSH, Console/TTY, RDP, VNC
- β‘ Real-time monitoring: Instant notifications when someone logs in
- π‘οΈ Lightweight: Minimal resource usage
# 1. Install (one-line for macOS/Linux)
curl -fsSL https://raw.githubusercontent.com/xsddz/whozere/main/scripts/install.sh | bash
# 2. Configure
sudo cp /usr/local/etc/whozere/config.example.yaml /usr/local/etc/whozere/config.yaml
sudo vim /usr/local/etc/whozere/config.yaml # Edit your notification settings
# 3. Test notification
whozere -config /usr/local/etc/whozere/config.yaml -test
# 4. Install as service (auto-start on boot)
whozere-service install
whozere-service start- Go 1.21+ (for building from source)
- macOS 10.15+ / Linux / Windows 10+
- Network access to notification services
git clone https://github.com/xsddz/whozere.git
cd whozere
go build -o whozere ./cmd/whozere
cp config.example.yaml config.yaml # Then edit config.yaml# Linux
GOOS=linux GOARCH=amd64 go build -o whozere-linux-amd64 ./cmd/whozere
# Windows
GOOS=windows GOARCH=amd64 go build -o whozere-windows-amd64.exe ./cmd/whozere
# macOS
GOOS=darwin GOARCH=arm64 go build -o whozere-darwin-arm64 ./cmd/whozereCopy config.example.yaml to config.yaml:
cp config.example.yaml config.yamlnotifiers:
# Generic Webhook
- type: webhook
name: "My Webhook"
enabled: true
config:
url: "https://example.com/webhook"
# Email
- type: email
enabled: false
config:
smtp_host: "smtp.example.com"
smtp_port: "587"
username: "your@email.com"
password: "your_password"
from: "whozere@example.com"
to: "admin@example.com"
# Event filters - exclude unwanted login events
filters:
ignore_terminals:
- cron # cron job execution
- su # su command
- sudo # sudo commandπ See config.example.yaml for all notification channels and filter options.
./whozere # Run with default config
./whozere -config /path/config.yaml # Specify config file
./whozere -since 1h # Check logins from last 1 hour + watch new
./whozere -test # Send test notification
./whozere -version # Show version
./whozere -help # Show all optionsFull help output
Usage of whozere:
-config string
Path to configuration file (default "config.yaml")
-integrity
Enable log integrity monitoring (detect tampering) (default true)
-since duration
Check login events from this duration ago (e.g., 1h, 30m)
-test
Send a test notification and exit
-version
Show version information
When a login is detected, you'll receive a notification like this:
Text Message:
π Login Alert
User: alice
Host: my-server
Time: 2026-02-07 20:45:30
Zone: CST (UTC+8)
OS: linux
IP: 192.168.1.100
Terminal: ssh
Webhook JSON Payload:
{
"event": "login",
"username": "alice",
"hostname": "my-server",
"ip": "192.168.1.100",
"terminal": "ssh",
"timestamp": "2026-02-07T20:45:30+08:00",
"os": "linux",
"message": "π Login Alert\n\nUser: alice\n..."
}The install script automatically installs whozere-service command.
whozere-service install # Auto-detects macOS/Linux
whozere-service start
whozere-service status
# Other commands
whozere-service stop # Stop service
whozere-service restart # Restart service
whozere-service uninstall # Remove servicemacOS (launchd)
cat > ~/Library/LaunchAgents/com.whozere.agent.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key><string>com.whozere.agent</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/whozere</string>
<string>-config</string>
<string>/usr/local/etc/whozere/config.yaml</string>
</array>
<key>RunAtLoad</key><true/>
<key>KeepAlive</key><true/>
</dict>
</plist>
EOF
launchctl load ~/Library/LaunchAgents/com.whozere.agent.plistLinux (systemd)
sudo tee /etc/systemd/system/whozere.service << 'EOF'
[Unit]
Description=whozere - Login Detection & Notification
After=network.target
[Service]
Type=simple
ExecStart=/usr/local/bin/whozere -config /usr/local/etc/whozere/config.yaml
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl enable --now whozereWindows (NSSM)
Use NSSM:
nssm install whozere C:\whozere\whozere.exe -config C:\whozere\config.yaml
nssm start whozere| Platform | Method | Notes |
|---|---|---|
| macOS | log stream |
Monitors loginwindow, sshd, screensharingd |
| Linux | Log files | /var/log/auth.log or /var/log/secure |
| Windows | Event Log | Security Log, Event ID 4624 |
ββββββββββββ ββββββββββββββββ βββββββββββ ββββββββββββββββ
β Login β βββΆ β System Logs β βββΆ β whozere β βββΆ β Notification β
β Event β β (auth/event) β β watcher β β Channel β
ββββββββββββ ββββββββββββββββ βββββββββββ ββββββββββββββββ
On Linux, whozere monitors the authentication log file for tampering:
- Truncation: Alerts if log file size drops significantly (50%+)
- Deletion: Alerts if log file is removed
- Replacement: Alerts if file inode changes (file replaced)
- Permission change: Alerts if file permissions are modified
This helps detect attempts to erase evidence of unauthorized access.
whozere relies on system logs for detection. It cannot detect:
- Kernel-level rootkits that intercept system calls
- Attackers with root access who disable logging before login
- Attacks that bypass standard authentication (e.g., kernel exploits)
# Quick uninstall (if installed via install script)
whozere-uninstall
# Or one-line uninstall
curl -fsSL https://raw.githubusercontent.com/xsddz/whozere/main/scripts/uninstall.sh | bashgo test ./... # Run tests
make build # Build binary
make build-all # Cross-platform buildContributions are welcome! Please feel free to submit a Pull Request.