Linux server security monitoring without another tool

Security tooling for a handful of servers usually means another agent, another dashboard and another set of alerts nobody reads. But the monitoring agent is already on the machine, already lists the packages and processes, and already reads the auth log. Obscenter uses what it collects anyway to answer the questions that matter on a Tuesday: what do I patch first, which machine needs a reboot, and was that login me?

Vulnerability scanning for Linux servers by source package

The host agent reports the installed packages on each machine. Obscenter checks them against OSV.dev, the open vulnerability database, every four hours — together with the npm libraries your Node services load and the client-side libraries your pages load.

Debian and Ubuntu file their advisories under the source package, not under each binary package built from it. So the scanner asks by source package wherever the agent reported one. The kernel alone builds a dozen binaries; one source package is one question, and one answer.

The page then turns findings into actions:

• One action per source package, not one row per advisory. Every advisory a single upgrade closes is one line, with the version that closes all of them and the binary names to give to apt.
• One command per machine to run.
• "No fix yet" said plainly, instead of pretending an upgrade will help.
• Files nothing executes — kernel headers, tools and docs for kernels that are not running — are not counted. They are worth an apt autoremove, not a page at night.

Which CVEs to fix first: KEV and EPSS

Severity scores the damage if something is exploited, not whether anybody is exploiting it. A machine with forty medium advisories has forty rows that look the same. Two free public feeds separate them, and both are joined onto every finding:

• CISA KEV — the list of vulnerabilities known to be exploited in the wild. Not a probability; a fact with a date. A KEV entry on one of your machines opens a critical ticket immediately.
• EPSS from FIRST — the probability that a CVE will be exploited in the next thirty days. Obscenter asks only for the CVEs your install actually holds, a hundred at a time.

If a feed is unreachable, you lose that column and nothing else: the advisory itself came from OSV and is already stored.

Reboot required? Kernels and stale libraries

Upgrading a package is only half a fix if the old code is still running. The security page tracks both halves:

• The kernel. When a newer kernel image is installed than the one running, the machine is marked for a reboot, with both versions shown.
• Libraries still mapped after an upgrade. The agent spots processes that still have a deleted, replaced library file mapped in memory and names the services that need a restart to pick up the fix.

A history chart tracks upgrades waiting, fixes not yet available and restarts due, hour by hour, so you can see the backlog shrink rather than take it on faith. A library list that a machine has stopped reporting is kept but not judged, so a stale inventory does not produce tickets.

SSH login monitoring: new places, brute force and spraying

Thousands of strangers guessing at port 22 is weather. One login that succeeded is the event that matters, and the only question about it is: was that me?

For every successful SSH login, Obscenter records the address, the country and region, and the reverse DNS name — "…nat.pool.telekom.hu" is how you recognise your own phone. It then decides whether the place is usual:

• a login has succeeded before from the same network (/24, or /64 for IPv6), on any of your machines; or
• the address is a dynamic pool of the same provider in the same wider block as an earlier login — mobile carrier NAT moves you between /24s every day.

A hosting provider's name does not count as usual, because an attacker renting a server from the same provider is exactly the case to catch. Anything else is a new place, and a critical ticket that sends mail, written in words: the machine's label, the place, your usual places, the local time.

Failed logins are judged separately, because they are different facts:

Ticket	When
Brute force	One source fails at least ten times across several accounts
Spraying	Many sources, many failures, spread thin
Breach	The same pattern, and a login succeeded in the middle of it — critical with a password, serious with a key

The thresholds ask for breadth, not volume: somebody who mistypes their own password four times and then gets in is not an attack. Windows machines get the same treatment for failed logons and RDP guessing.

Scanners, probes and the 200 that matters

From the nginx access logs the agent collects, the security page maps where the scanning comes from: by country, by hour, and by source. The source is a hash, enough to follow one scanner across the table and too little to identify anybody.

A thousand 404s for /.env are noise. A 200 means the machine handed something out. But single-page apps answer 200 to everything, so a 200 alone proves nothing. Obscenter checks: it fetches that path itself — only from origins your install already knows are yours, never from a URL in a log line — and recognises a git config, a private key or the app's own HTML shell from the first bytes of the response. Requests from your own machine and private ranges are excluded, so the product never reports its own operator as an intruder.

The dashboard's own sign-in book

A monitoring product that watches everyone's door should keep a book about its own. Every sign-in attempt to the dashboard is a row — account tried, address, place, browser, outcome — including attempts on accounts that do not exist, because the names somebody tries tell a word list from somebody who did their homework.

• The brake. A run of failures slows the door down by itself, counted per account from one address, per account from everywhere, and per address over every name. It is counted from the stored rows, so a restart does not reset the clock for whoever is guessing — and a stranger guessing cannot lock the owner out of the places they always sign in from.
• The block. An administrator can block an account with a reason and an end date. While it stands, no password or QR approval opens it, and every session it had is ended on the spot.

A shell without an open SSH port

When you do need to get onto a machine, the dashboard can open a terminal through the agent's existing outbound connection — no inbound port to open, and every session audited. It is a root shell, so it is off unless the machine was installed with --allow-terminal or allowed later with obscenter-agent allow-terminal, and a machine can refuse it entirely with OBSCENTER_NO_TERMINAL=1, whatever the server says.

Check your own servers

Install the agent and the first package scan runs on its own; switch on the auth log to fill in the SSH cards.

Start free or read Getting started.