Vigilhold

Every Linux server with a public IP gets attacked within hours. Bots guess passwords, scan ports and drop crypto-miners in /tmp. Most security tools either bury you in raw logs and 3am alerts, or cost a six-figure enterprise contract.

Vigilhold is a small agent that installs in under a minute on Ubuntu, Debian or RHEL, or as one docker run. It only connects outbound, so there are no firewall changes. It watches processes, network connections, file changes and SSH logins, and explains each event in plain words: what happened, why it matters, and what it did about it.

You decide how far it goes. It can ban an attacking IP or stop a known miner on its own, but only for the actions you’ve allowed. Anything disruptive, like stopping a process or locking a server down, waits for your approval in the dashboard, on your phone or in Slack. Every action is recorded in a tamper-evident audit log, and bans, quarantines and lockdowns can be undone. It only alerts you when something needs you.

You can watch our own lab server getting attacked live, no signup needed. Plans start at $39/month for five servers, with 14 days free and no card.