Skip to content

xsddz/whozere

Folders and files

NameName
Last commit message
Last commit date

Latest commit

Β 

History

23 Commits
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 

Repository files navigation

whozere

whozere

Who's here? πŸ”” β€” A cross-platform login detection and notification tool

Release License Go Report Card

English | δΈ­ζ–‡


✨ Features

  • πŸ–₯️ Cross-platform: macOS, Linux, Windows
  • πŸ“‘ Multiple notification channels: Webhook, DingTalk, WeCom, Telegram, Slack, Email
  • πŸ” Detects various login types: SSH, Console/TTY, RDP, VNC
  • ⚑ Real-time monitoring: Instant notifications when someone logs in
  • πŸ›‘οΈ Lightweight: Minimal resource usage

πŸš€ Quick Start

# 1. Install (one-line for macOS/Linux)
curl -fsSL https://raw.githubusercontent.com/xsddz/whozere/main/scripts/install.sh | bash

# 2. Configure
sudo cp /usr/local/etc/whozere/config.example.yaml /usr/local/etc/whozere/config.yaml
sudo vim /usr/local/etc/whozere/config.yaml  # Edit your notification settings

# 3. Test notification
whozere -config /usr/local/etc/whozere/config.yaml -test

# 4. Install as service (auto-start on boot)
whozere-service install
whozere-service start

πŸ“‹ Requirements

  • Go 1.21+ (for building from source)
  • macOS 10.15+ / Linux / Windows 10+
  • Network access to notification services

πŸ“¦ Installation

From Source

git clone https://github.com/xsddz/whozere.git
cd whozere
go build -o whozere ./cmd/whozere
cp config.example.yaml config.yaml  # Then edit config.yaml

Cross-compilation

# Linux
GOOS=linux GOARCH=amd64 go build -o whozere-linux-amd64 ./cmd/whozere

# Windows
GOOS=windows GOARCH=amd64 go build -o whozere-windows-amd64.exe ./cmd/whozere

# macOS
GOOS=darwin GOARCH=arm64 go build -o whozere-darwin-arm64 ./cmd/whozere

βš™οΈ Configuration

Copy config.example.yaml to config.yaml:

cp config.example.yaml config.yaml

Example

notifiers:
  # Generic Webhook
  - type: webhook
    name: "My Webhook"
    enabled: true
    config:
      url: "https://example.com/webhook"

  # Email
  - type: email
    enabled: false
    config:
      smtp_host: "smtp.example.com"
      smtp_port: "587"
      username: "your@email.com"
      password: "your_password"
      from: "whozere@example.com"
      to: "admin@example.com"

# Event filters - exclude unwanted login events
filters:
  ignore_terminals:
    - cron   # cron job execution
    - su     # su command
    - sudo   # sudo command

πŸ“ See config.example.yaml for all notification channels and filter options.

πŸ“– Usage

./whozere                           # Run with default config
./whozere -config /path/config.yaml # Specify config file
./whozere -since 1h                 # Check logins from last 1 hour + watch new
./whozere -test                     # Send test notification
./whozere -version                  # Show version
./whozere -help                     # Show all options
Full help output
Usage of whozere:
  -config string
        Path to configuration file (default "config.yaml")
  -integrity
        Enable log integrity monitoring (detect tampering) (default true)
  -since duration
        Check login events from this duration ago (e.g., 1h, 30m)
  -test
        Send a test notification and exit
  -version
        Show version information

πŸ“¬ Notification Format

When a login is detected, you'll receive a notification like this:

Text Message:

πŸ”” Login Alert

User: alice
Host: my-server
Time: 2026-02-07 20:45:30
Zone: CST (UTC+8)
OS: linux
IP: 192.168.1.100
Terminal: ssh

Webhook JSON Payload:

{
  "event": "login",
  "username": "alice",
  "hostname": "my-server",
  "ip": "192.168.1.100",
  "terminal": "ssh",
  "timestamp": "2026-02-07T20:45:30+08:00",
  "os": "linux",
  "message": "πŸ”” Login Alert\n\nUser: alice\n..."
}

πŸ”§ Running as a Service

The install script automatically installs whozere-service command.

Quick Setup (Recommended)

whozere-service install   # Auto-detects macOS/Linux
whozere-service start
whozere-service status

# Other commands
whozere-service stop      # Stop service
whozere-service restart   # Restart service
whozere-service uninstall # Remove service

Manual Setup

macOS (launchd)
cat > ~/Library/LaunchAgents/com.whozere.agent.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key><string>com.whozere.agent</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/whozere</string>
        <string>-config</string>
        <string>/usr/local/etc/whozere/config.yaml</string>
    </array>
    <key>RunAtLoad</key><true/>
    <key>KeepAlive</key><true/>
</dict>
</plist>
EOF

launchctl load ~/Library/LaunchAgents/com.whozere.agent.plist
Linux (systemd)
sudo tee /etc/systemd/system/whozere.service << 'EOF'
[Unit]
Description=whozere - Login Detection & Notification
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/whozere -config /usr/local/etc/whozere/config.yaml
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now whozere
Windows (NSSM)

Use NSSM:

nssm install whozere C:\whozere\whozere.exe -config C:\whozere\config.yaml
nssm start whozere

πŸ–₯️ Platform Notes

Platform Method Notes
macOS log stream Monitors loginwindow, sshd, screensharingd
Linux Log files /var/log/auth.log or /var/log/secure
Windows Event Log Security Log, Event ID 4624

πŸ” Security & Detection

How Detection Works

β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”     β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”     β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”     β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚  Login   β”‚ ──▢ β”‚ System Logs  β”‚ ──▢ β”‚ whozere β”‚ ──▢ β”‚ Notification β”‚
β”‚  Event   β”‚     β”‚ (auth/event) β”‚     β”‚ watcher β”‚     β”‚   Channel    β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜     β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜     β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜     β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜

Log Integrity Monitoring (Linux)

On Linux, whozere monitors the authentication log file for tampering:

  • Truncation: Alerts if log file size drops significantly (50%+)
  • Deletion: Alerts if log file is removed
  • Replacement: Alerts if file inode changes (file replaced)
  • Permission change: Alerts if file permissions are modified

This helps detect attempts to erase evidence of unauthorized access.

Limitations

whozere relies on system logs for detection. It cannot detect:

  • Kernel-level rootkits that intercept system calls
  • Attackers with root access who disable logging before login
  • Attacks that bypass standard authentication (e.g., kernel exploits)

πŸ—‘οΈ Uninstall

# Quick uninstall (if installed via install script)
whozere-uninstall

# Or one-line uninstall
curl -fsSL https://raw.githubusercontent.com/xsddz/whozere/main/scripts/uninstall.sh | bash

πŸ› οΈ Development

go test ./...        # Run tests
make build           # Build binary
make build-all       # Cross-platform build

πŸ“œ License

MIT License

🀝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

About

πŸ”” Cross-platform login detection with instant notifications

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages