SSH daemon · Rust · Discord & Slack

Know who boards your server.

Gabier watches the SSH logins on your VPS and pings you on Discord or Slack within a second. One Rust binary, zero dependencies — and a throttle that keeps a port-22 scan out of your channel.

Install in 2 minutes View the code
Pince, the crab topman in his crow's nest, spyglass aimed at the horizon

What you get

A clean embed you can read from your phone: who, from where, how. Get yourself pinged on accepted logins, and let a thousand refused attempts collapse into a single line.

Gabier APP Today at 19:57

Someone is boarding

SSH login accepted on vps-dedie-01.

User
thibault
From
203.0.113.7
Method
publickey ED25519
Source port
51234
A Discord message from the Gabier app: “Someone is boarding — SSH login accepted on vps-dedie-01”, listing the user, source IP, authentication method and source port.

Small, quiet, always on watch

Gabier does one thing and does it well. No heavy agent, no dashboard to host.

Within a second

Streams journald or tails auth.log through rotations. The moment sshd writes the line, the notification is on its way.

Scan-proof by design

Per-IP burst limits fold a thousand refused attempts into one summary — so the single login that succeeded is still the thing you see.

Hardened by default

A dedicated account with no shell, a read-only system, no capabilities, a 64 MB ceiling and a syscall filter. It reads logs and posts HTTPS.

Discord and Slack

A plain webhook, no bot to invite. Both at once if you like: if one is down, the other still gets through.

One binary, that's it

Rust and rustls, no OpenSSL, no runtime. Debian, Ubuntu, Fedora, Arch, Alma: anywhere sshd runs.

Open source

MIT licensed. Read it, audit it, fork it — the parser is covered by tests against a real auth.log.

The one hard part

A scan must not drown the real login

A VPS with port 22 open takes thousands of attempts a day. Notify all of them and the channel is unreadable, which means you miss the one that matters. Gabier sends the first failures from an IP, then counts the rest and posts one summary per window. Successful logins are never grouped.

How the throttle works

one scanner, five minutes 
🚨 Rafale de tentatives SSH
43 tentatives refusées depuis 185.243.96.107.
Comptes visés  admin, oracle, postgres, test, ubuntu

How it works

  1. 01 · Watch

    journalctl --follow

    Gabier follows the sshd journal, a log file through its rotations, or stdin for a dry run.

  2. 02 · Recognize

    Accepted publickey for…

    sshd lines are parsed into events: user, IP, port, method, key fingerprint.

  3. 03 · Decide

    burst 1 / 300s

    Filters, deduplication, and the per-IP throttle that keeps a scan out of your channel.

  4. 04 · Shout

    POST webhook

    A message lands in Discord or Slack, with retries. Pince did his job; back to what you were doing.

Read the long version

Install in 2 minutes

Build it, run the installer, paste one webhook. The script creates the service account, installs the hardened unit and enables it at boot.

Full install guide

shell 
$ git clone https://github.com/Flottille/gabier
$ cd gabier && cargo build --release
$ sudo ./install.sh                  # account, binary, unit, config
$ sudo nano /etc/gabier/config.toml  # paste your webhook
$ sudo -u gabier gabier check        # validates and reaches the webhook
$ sudo systemctl start gabier