Protect your server. All attacks and changes in one dashboard.

Fail2ban reads service logs and bans addresses that fail authentication. The dashboard shows every jail on a single screen: how many addresses are banned now, how many since the service started, and which jail caught them. A jail that has caught nothing at all is just as visible as a working one — usually it means it's reading the wrong log file.

IPSUM is a daily-updated list of addresses caught attacking other servers. Ipset keeps it in kernel memory, so checking hundreds of thousands of addresses doesn't strain the firewall. The dashboard shows the list size and last update time: this is protection before the first attempt — an address is cut off before it ever reaches a service.

Lynis runs hundreds of configuration checks and outputs a hardening index — a score out of 100. The dashboard parses the report and shows warnings and recommendations along with the test ID, so you can look up what each one means. 100 out of 100 isn't the goal: some recommendations are written for scenarios that don't apply to your server.

ModSecurity with the OWASP CRS ruleset filters HTTP requests inside the web server — after decryption, where the request content is visible. The panel reads the audit log: which request was blocked, which rule triggered, the anomaly score, and where the request came from. People look here mainly for false positives: the same rule catching your own form over and over.

Suricata inspects network traffic against signatures and writes its findings to eve.json. The dashboard reads this file directly on the server and shows the day's alerts grouped by category — without Elasticsearch and Kibana, which on a single VPS weigh more than the machine they watch. A fresh install stays silent until suricata-update runs at least once: it has no rules yet.

CrowdSec parses logs by scenario and makes ban decisions, drawing also on addresses reported by other members of the network — an attacker often arrives already known. The dashboard shows active decisions with their scenario and remaining time, alongside the registered bouncers that enforce them. If the second list is empty, CrowdSec only alerts and blocks nothing.

Falco watches system calls and raises an alert when a process does something it shouldn't: spawns a shell from the web server, writes to the system binaries directory, or opens an unexpected outbound connection. The dashboard shows alerts with their priority, the rule that fired, and the process command line. Kubernetes isn't required — Falco works the same way on a regular server.

Antivirus on Linux protects not its own binaries, but whatever reaches the server from outside: web shells through an upload form, attachments through a mail server, payloads in temporary directories. The dashboard shows the time of the last scan, what it found, and — the most important field — the age of the signature database. ClamAV with week-old signatures creates the appearance of protection and nothing more.

AIDE takes a cryptographic snapshot of the file system and reports what has changed since the last check — answering the question the other tools dodge: what did they touch. The dashboard shows three lists: added, modified and deleted files, along with any diverging attributes. The most common morning report comes down to overnight package updates — cross-check the timing and rebuild the database.

The audit daemon logs exactly the events it was told to: changes to /etc/passwd and /etc/shadow, edits to sshd_config, execution of privilege-escalation binaries. The dashboard shows the rules loaded right now, the paths being watched, and recent events with their process and outcome. Seeing the rules matters as much as the events: an empty rule set is the most common reason auditd looks like it's running yet logs nothing useful.

UFW removes the iptables syntax, but it won't help you make sense of a rule set months later. The panel shows rules with their action, port, protocol and source, and puts the default policies for inbound and outbound traffic up front — those are exactly what people usually forget. A rule set that looks strict means nothing if the default policy is still set to allow.

Someone scanning your ports leaves no failed login attempts behind, so Fail2ban never sees them. PSAD closes that gap: it reads firewall records of dropped traffic and scores what it finds. The dashboard shows flagged addresses, a danger level from 1 to 5, packet counts and ports. Without a logging rule in the firewall, PSAD stays silent — that's the usual reason for a blank page after installation.

Auto-renewal solved most of the problem and created a quieter version of it: certificates renew themselves — until the day they stop, and the visitor is the first to find out. The dashboard lists the certificates the server serves: issuer, expiry date, days remaining. Fewer than thirty days left on an auto-renewing certificate means renewal has been quietly failing for a while.

The map plots addresses your own server has blocked, resolved to countries and scaled by hit count. This is no third-party threat feed: every dot is traffic that reached this machine. The map pays off over time — a cluster from one network usually means a single actor working through a list, while an even scatter is ordinary internet noise.

Logwatch condenses a day's logs into a single report and emails it — where, a couple of weeks later, it lands in a folder nobody ever checks. The problem was never the information; it was the delivery. The dashboard keeps reports on the server and shows them page by page, with an archive of previous days: one day tells you what happened, a week tells you what changed.

Monit watches processes, files, filesystems and hosts, restarting anything it finds broken. The dashboard shows every check with its current state, the monitored object and the number of interventions. The restart counter is the most honest field: a service restarted forty times isn't healthy — it keeps crashing, and the restarts just paper over it.

Sign in to the dashboard with a hardware key, Touch ID, or Face ID instead of a second password. The key confirms the domain at the protocol level, so a copy of the sign-in page on a look-alike address won't work — phishing has nothing to intercept. You can register several keys, each with its own name and last-used time, and revoke any of them individually.

What's reachable from outside on this machine is the most useful security question, yet the ss output has to be re-read by eye every time. The panel shows listening sockets with their port, protocol, bind address and process, and established connections below. Read the bind address first: a service on 127.0.0.1 is reachable only from the machine itself, while the same service on 0.0.0.0 is open to the whole internet.

Top answers a question about the current second, but you usually need to know about last night. Every five minutes the collector appends a row to the database, and the page uses it to chart the last 24 hours: load average, CPU and I/O wait separately, memory and swap, network, disk, TCP connections, file descriptors. Read the graphs in pairs: high I/O wait with an idle CPU means the server is waiting on the disk, and adding more processor cores won't help.

There are two kinds of disk trouble, and they're nothing alike: a drive that's starting to fail, and a filesystem that fills up and drags your services down with it. The dashboard covers both — partition usage, SMART attributes, and temperature. Three attributes foretell a failure: reallocated sectors, pending sectors, and offline uncorrectable sectors. Inodes are shown separately — they run out before free space does and explain writes that fail on a disk that still has room.

Mandatory access control decides what a program is allowed to do, regardless of the rights of the user who launched it. AppArmor ships on most Ubuntu and Debian servers, and on very many it restricts almost nothing. The dashboard shows loaded profiles with their mode, the processes under confinement, and — the more interesting half — the processes with no profile at all. A profile in complain mode only logs what it would have blocked; only enforce actually restricts.