Documentation

What BHIM KVH does

BHIM KVH is a local Linux security monitor and evidence recorder. It observes SSH activity, HTTP access logs, processes, sockets, and protected files. Optional capabilities add service-scoped firewall response, kernel telemetry, malware signatures, and pinned offline vulnerability scans.

Local SQLite evidence and category-specific JSONL logs.
CLI commands for health, metrics, incidents, timelines, exports, and explicit recovery.
DoS mitigation through configured host blocking and native ingress rate limits.
Optional AWS WAF IP-set synchronisation through a separate reviewed-plan adapter.

Licensed binary distribution

The customer distribution is a signed .tgz containing the compiled executable, default configuration, systemd units, and notices. Activate one key per machine before protection starts. The licensing API runs separately from the static website and agent operational CLI.

Install and activate Understand offline validity

Choose your guide

Install a Linux host Operate protection safely CLI and JSON integration Every configuration setting Architecture and boundaries

Binary names and configuration

The executable produced by Cargo and installed by the split installer is bhim-protection. Its help banner uses the name bhimkvh. The legacy installer creates a bhimkvh symlink; the split installer does not. These docs use bhim-protection so both installation profiles have an unambiguous executable.

bhim-protection --version
bhim-protection --help
bhim-protection --config /etc/bhim-protection/config.toml health

The operator workflow

Build a native Linux release from an approved source checkout.
Start with a monitoring-only TOML configuration and the split service profile.
Verify the daemon heartbeat, source access, integrity baseline, and evidence output.
Add management allowlist entries and review traffic topology before enabling response.
Monitor degradation, retained evidence, resource budgets, and false positives.

Monitoring-first installation steps

Daily checks

For the split profile, run routine evidence queries as the bhim service user to avoid creating root-owned files in the service-owned state directory.

sudo systemctl status bhim-response.service bhim-agent.service
sudo -u bhim bhim-protection health --strict
sudo -u bhim bhim-protection metrics
sudo -u bhim bhim-protection incidents --limit 20
sudo -u bhim bhim-protection export --format json --limit 100

Installed paths

Path / unit	Purpose
/usr/local/bin/bhim-protection	Native executable
/etc/bhim-protection/config.toml	Protected TOML policy
/var/lib/bhim-protection	SQLite, collector state, spool, snapshots
/var/log/bhim-protection	JSONL category logs
/run/bhim-protection/response.sock	Local privileged executor socket
bhim-agent.service	Unprivileged monitor
bhim-response.service	Policy-limited root executor
bhim-kernel.service	Optional privileged BCC collector

Know the protection boundary

The core agent does not expose a REST API or a dashboard. HTTP log detection occurs after the request has been logged; native server controls handle inline rate enforcement. Host nftables rules cover INPUT traffic, not an ALB edge or Kubernetes FORWARD path. The optional AWS WAF adapter is not a general request-body inspection engine and is not run automatically by the daemon.