v0.2.3

v0.2.3 — International usability / 海外与双语使用

English-speaking operators can now configure English alerts throughout Telegram, Discord, Slack, Feishu/Lark, webhooks, email and console. Select notifications.language="en", optionally set notifications.timezone="UTC" or an IANA zone, and override language per channel for mixed teams. Existing configurations retain Chinese/host-local defaults.

Changes / 改进

• init-config -language en -timezone UTC creates native platform paths and safe dry-run defaults. Built-in text is translated; user text and GeoIP database values remain unchanged.
• New installations use the same threshold worldwide, without the old Guangzhou exception. Existing explicit region rules, whitelists and SSH policies remain intact.
• SMTP supports independent username and environment-based password_env. Documentation explains Gmail app credentials, unsupported Outlook OAuth2 and service proxy setup.
• Twenty-two bilingual HTML pages, an English configuration download and English changelog; paired navigation, corrected installation permissions/startup order, checksum-based offline onboarding and platform limits.
• 默认通知支持中英文、渠道覆盖、命名时区及明确 UTC 偏移。旧配置保留原语言和时区；只计密码错误、白名单、成功登录宽限均保留。
• 新安装不再内置广州阈值例外；已有地区配置不改写。补齐海外渠道、SMTP 认证边界、离线部署与中英文文档。

Upgrade / 升级

Use banhack233 update -apply or the previously enabled daily updater. Existing configuration is preserved; edit language settings explicitly, run config-check, then restart. init-config refuses existing files; do not use -force to change only a language.

新语言/时区/SMTP 字段需要 v0.2.3+。手动降级到较旧版本前需删除新字段或恢复兼容配置；已有自动更新部署无需重新注册每日任务。

Only stable release tags trigger Actions; ordinary pushes/PRs do not. Pages updates after all release checks and publication succeed. 没有新增定时或普通 push 工作流。

v0.2.2

v0.2.2 — reliable updates on slow international links

中文

实际部署发现，约 16 KB/s 的国际链路无法在原来的 2 分钟内下载完整安装包。本版为资产正文保留最多 10 分钟，响应头最多等待 30 秒，单次更新总时限 15 分钟，Linux/Windows 调度上限 20 分钟。安装脚本同步调整。下载、校验失败保留旧程序；每日检查频率不变。

同时包含 v0.2.1 的完整改进：

• 密码失败专用规则、IP＋用户名计数、成功登录清零与宽限、公司白名单；旧版 nft 全端口规则启动即迁移为 SSH 端口范围。
• Telegram、Discord、Slack、Feishu/Lark、通用 webhook、TLS 邮箱；独立渠道、消息限长、凭据脱敏、持久重试。
• 日志轮转/半行/多规则游标、Windows 事件游标与本地端口修复、只读巡检与保守的手动进程清理。
• 校验正式 Release、配置和版本，备份旧二进制，重启失败回滚；每日自动安装并重启服务。
• 19 页中英文 HTML、离线文档、六平台二进制及 SHA256SUMS；Go 1.27.2 构建，Linux/macOS/Windows CI 通过后发布。

旧版本慢速下载超时时，先用最新版安装脚本升级，再重新执行 banhack233 auto-update -enable 更新调度时限。现有配置和白名单不会被覆盖。Telegram/Discord 等渠道需要填写本机凭据后启用。

English

Slow international links can exceed the previous two-minute download deadline. Release bodies now have a ten-minute limit, response headers a thirty-second limit, the updater a fifteen-minute overall deadline, and Linux/Windows scheduler jobs a twenty-minute limit. Installers use the same longer download window. Failed downloads leave the installed binary intact; the daily schedule is unchanged.

Includes v0.2.1's password-only SSH rules, successful-login grace, office allowlists, SSH-scoped firewall migration, Telegram/Discord and durable multi-channel delivery, conservative diagnostics, verified automatic updates and rollback backups. Existing configurations remain intact. On slow links, bootstrap older updaters with the current installer, then rerun auto-update -enable to refresh scheduler limits.

中文文档 · English documentation · 通知配置 · 自动更新

v0.2.1

v0.2.1 — safer SSH defense, Telegram and verified daily updates

中文

• 兼容性与升级：正式构建改用 Go 1.27.2，支持 macOS 26 的加载要求；启动即迁移本项目旧版 nft 全端口规则，无需等待新攻击。v0.2.0 被 CI 门禁拦截，未发布资产或更新网站。

• 减少误封：新配置只计明确密码失败，按用户分组；同批成功登录优先处理，默认提供 10 分钟来源 IP 宽限。公司出口仍应加入白名单，公网 SSH 无法通过 MAC 识别内部设备。

• 可靠扫描：Windows 事件游标与去重、文件轮转识别、半行等待、多规则独立偏移、状态写入锁；修复自定义规则意外继承默认字段的问题。

• SSH 端口范围：新增 ssh_ports，默认 [22]；Windows 改用本地目标端口，Linux 支持多端口。没有连接频率丢弃规则。

• 海外通知：新增 Telegram 机器人/话题/静默通知，完善 Discord；保留 Slack、Feishu/Lark、webhook、邮箱。独立渠道、10 秒超时、持久重试、消息限长和凭据脱敏。

• 避免进程误杀：状态查看、doctor、定时巡检只读；手动清理默认关闭，仅限定入侵程序名可处置。临时目录、xmrig、masscan 不单独触发终止。报告碰撞不覆盖。

• 每日自动更新：只选正式 Release，校验 SHA256、版本和现有配置，备份旧二进制，重启失败尝试回滚；保留配置、白名单、凭据和状态。

• 文档与发布：19 页中英文 HTML/离线包，新增通知和更新手册；继续只在正式版本标签触发 Actions，通过检查后发布。

升级

先用安装器升级旧二进制，再执行：

sudo banhack233 safe-ssh -write -config /etc/banhack233/config.json
sudo banhack233 config-check -config /etc/banhack233/config.json
sudo systemctl restart banhack233
sudo banhack233 auto-update -enable -config /etc/banhack233/config.json

旧配置不会静默覆盖。safe-ssh 仅迁移原默认规则；自定义规则需审阅。通知需要本机真实凭据，示例不可直接用于收件。自动更新依赖 GitHub 可达和托管服务；macOS PF 仍需管理员配置过滤规则。

English

Release builds now use Go 1.27.2 for macOS 26 compatibility. Production startup immediately narrows this application's legacy nft all-port rules while preserving blocked addresses. The v0.2.0 candidate failed its release gate; no assets or Pages update were published for it.

Password-only defaults and successful-login grace reduce shared-egress false bans. Telegram joins Discord, Slack, Feishu/Lark, generic webhooks and TLS email, with independent bounded delivery and durable retries. Windows cursor/local-port fixes, configurable SSH ports, file identity, independent rule offsets and process locks improve ingestion and enforcement.

Diagnostics and scheduled audits never kill processes. Explicit manual cleanup remains conservative and disabled by default. Verified daily stable updates preserve configuration/state, keep a previous binary and attempt rollback when the managed daemon fails startup checks.

Existing configurations are preserved. Migrate the named default rule with safe-ssh -write, validate and restart, then opt in with auto-update -enable. Custom rules and live channel credentials need operator review. MAC-based remote-device bans are not supported; macOS PF filters remain administrator-managed.

Assets and documentation

Six native binaries, bilingual HTML archive and SHA256SUMS.txt. Installers/updater verify hashes; verify manual downloads against the same Release manifest. Online documentation: 中文 · English.

v0.1.22

文档与发布流程 / Documentation and releases

• HTML 说明文档：https://neko233-com.github.io/banhack233/ （英文：en.html）。与本版本 README 同源，提供章节检索、代码复制、配置下载和移动端目录。
• 仅正式标签触发：vX.Y.Z 启动一次工作流；main push、PR、普通/预发布标签及 Release 描述编辑均不会触发构建。
• 通过后才发布：Linux/Windows 测试、vet、Linux race、ShellCheck、文档和发布门禁测试通过后构建六个平台资产；上传完草稿资产后发布 Release，再部署 Pages。
• 最新版保护：旧标签重跑不会覆盖最新文档；页面和 version.json 标明实际部署版本。
• 离线文档与校验和：新增 banhack233-docs-v0.1.22.tar.gz 和 SHA256SUMS.txt，原有二进制文件名与安装方式保持兼容。
• 修正文档中“默认只统计密码失败”的过时说明；当前默认覆盖多种认证失败，另提供仅统计密码失败的配置示例。

Upgrade notes

This release adds bilingual GitHub Pages documentation, an offline HTML archive, and SHA-256 checksums. Only stable version tags start Actions; checks and release builds gate publication, and Pages deployment waits for a published Release. Older releases cannot replace newer documentation.

No host configuration migration is required. Existing configuration files are preserved by installation. Per-user counting still enforces bans by source IP; trusted shared office addresses should remain whitelisted.

Installation

curl -fsSL https://raw.githubusercontent.com/neko233-com/banhack233/main/scripts/install.sh | sh

Verify downloads

Download SHA256SUMS.txt alongside the desired assets and run sha256sum --ignore-missing -c SHA256SUMS.txt on Linux. Extract the docs archive and open index.html or en.html for offline reading.

v0.1.21

Support dual-stack bans via HOST macro and skip malformed log lines

v0.1.20

Cover fail2ban normal-mode detections and reset counters on successfu…

v0.1.19

Restrict bans to SSH port and replace Python helpers with Go tools

v0.1.18

Improve ban notification details

v0.1.17

Add rotated file logging for audit and ban events.

Audit findings log only by default with 10MB rotation and 30-day retention; ban events are also recorded.

Co-authored-by: Cursor <cursoragent@cursor.com>

v0.1.16

Disable audit alert notifications by default; notify only on bans.

Hourly doctor findings stay available via banhack233 doctor/status without webhook noise.

Co-authored-by: Cursor <cursoragent@cursor.com>