Linux servers: a read-only agent today, deeper checks on request

What the agent reads today

• Sign-ins. Successful remote logins with the user, address and method, failed attempts per address and bursts of password guessing.
• Accounts. New or removed local users and changes to administrator groups.
• Changed system files. Changed, added or removed files in key settings, scheduled tasks and services, and in your website's code folder if you choose.
• Ports and processes. New listening ports and programs running from temporary folders.
• Outbound connections. Connections to addresses on your Guardian block list.
• Disk encryption. Whether your volumes sit on encrypted storage.
• Personal data. If you choose, folders of exports, uploads and backups are scanned for personal data and secrets. Counts and paths are sent, never the values.

What is coming, on request

• Remote login hardening. Whether password login is still allowed, whether the administrator account can sign in directly, and other settings that decide how hard the front door is to guess.
• Password-guessing watch. Repeated failed attempts tracked over time and across your servers, not just in one burst.
• File integrity across more paths. Your own list of files and folders, checked for any change.
• Exposed ports. Which services are reachable from the internet, compared with what you expect.
• Containers. Running containers, their images and whether they are out of date.
• Certificates. Certificates on the server and when each one expires.
• Resources. Disk, memory and processor pressure that often shows up before an outage.

What it never does

• It never blocks an address, locks a user, stops a process or edits a file.
• It never accepts commands from Guardian. There is no channel for that.
• It never sends file contents. Hashes are computed on your server and only events, paths and counts leave it.
• It runs as its own limited system user, not as root.

The baseline, in plain words

• Only the people who should be able to sign in can sign in, and only with keys.
• Nobody is guessing passwords unnoticed.
• Key system files have not changed without a reason.
• Only the ports you expect are open to the internet.
• Administrator accounts are the ones you know about.
• Disks are encrypted.
• Certificates are not about to expire.
• Personal data is not sitting in exports and backups that nobody owns.

Install in one line by your administrator

Your administrator creates a one-time enrolment token in the console and runs the single command it shows. The installer checks the agent file before it installs anything and stops if it does not match. Servers that cannot download files can be installed from a copied folder. Each server then appears in the console with its status and findings. Removing it is just as simple.

Fix list and monthly proof

Findings are written for people: a new administrator account, a program running from a temporary folder, a burst of failed sign-ins from one address. When something needs a change, it is queued for your administrator to approve and carry out, and the console records that it was done. The monthly report shows what was found and what was resolved.

Questions

Can Guardian run commands on our servers?

No. The agent is read-only and has no channel for commands. Suggested responses are queued for your administrator, who carries them out.

Which systems are supported?

Linux servers with Node.js 18 or newer, on common distributions. Tell us about other systems when you request protection.

Does the agent send our files to Guardian?

No. It sends security events, file paths and counts, never file contents. Each batch is signed by the server so it cannot be altered on the way.

Are the deeper checks available today?

The agent and the checks listed under what it reads today are available now. The deeper checks are being built and are on request. We do not promise dates.