How sdslabs/watchdog works
Watchdog is a single-binary server access manager: SSH public-key authorization is checked against Keyhouse (with a local-cache fallback), while PAM hooks report SSH, sudo, and su activity. The graph preserves the documented user/group update, configuration, and log capabilities. Several handlers and shared modules were not sampled, so their internal calls are omitted; documented command dispatch and PAM integration are shown without assuming additional wiring.
Main entry points: main.rs Command dispatcher · auth.rs SSH authorization · notifier.rs Notification dispatch · config.rs Configuration
Components 17
Entrypoints
- Command dispatcher
src/main.rs
Access control
- SSH authorization
src/auth.rs - Keyhouse access data
src/lib/keyhouse.rs - Local key cache
src/lib/utils.rs - User and group update
src/update.rs
Activity reporting
- SSH PAM handler
src/ssh.rs - Sudo PAM handler
src/sudo.rs - Su PAM handler
src/su.rs - Notification dispatch
src/lib/notifier.rs
Shared services
- Configuration
src/lib/config.rs - Runtime initialization
src/lib/init.rs - Logging and log queries
src/lib/logger.rs - PAM environment
src/lib/environment.rs
Other components
- Administrator
- SSH / PAM
- Slack webhook
- Linux accounts
Connections 29
- Administrator → Command dispatcher: runs commands
- SSH / PAM → Command dispatcher: invokes commands
- Command dispatcher → SSH authorization: dispatches auth
- Command dispatcher → SSH PAM handler: dispatches ssh
- Command dispatcher → Sudo PAM handler: dispatches sudo
- Command dispatcher → Su PAM handler: dispatches su
- Command dispatcher → User and group update: dispatches update
- Command dispatcher → Logging and log queries: queries logs
- Command dispatcher → Configuration: config commands
- SSH authorization → Configuration: reads settings
- SSH authorization → Runtime initialization: initializes
- SSH authorization → Keyhouse access data: validates key
- SSH authorization → Local key cache: checks fallback
- Keyhouse access data → Slack webhook: reads access data
- User and group update → Keyhouse access data: reads access data
- User and group update → Linux accounts: updates accounts
- SSH PAM handler → Configuration: reads settings
- SSH PAM handler → Runtime initialization: initializes
- Sudo PAM handler → Configuration: reads settings
- Sudo PAM handler → Runtime initialization: initializes
- Su PAM handler → Configuration: reads settings
- Su PAM handler → Runtime initialization: initializes
- SSH authorization → Notification dispatch: reports failed login
- SSH PAM handler → Notification dispatch: reports SSH activity
- Sudo PAM handler → Notification dispatch: reports sudo activity
- Su PAM handler → Notification dispatch: reports su activity
- Notification dispatch → Slack webhook: posts summaries
- SSH / PAM → PAM environment: provides PAM context
- Administrator → Logging and log queries: requests logs