Auto Secure LoginIntrusion defense that fails into monitoring — never into a lockout.
ASL Aegis is a continuously-running host IDS/IPS for a single Internet-facing Linux server. It correlates nftables and kernel evidence, SSH and nginx logs, host-integrity snapshots, outbound connections, and reputation feeds into explainable detections — then can throttle or ban hostile sources in its own firewall table. It ships monitor-only: installing it starts nothing, and the default config can't block until an operator passes access-safety gates. Its first priority is never to lock the admin out.
The problem
Auto-blocking tools have a habit of banning the admin.
A single VPS or self-hosted box doesn't get a cloud agent, a SIEM subscription, or a security team. And the tools that do run there tend to fail dangerously — an aggressive rule locks out the person who owns the server, right when they need in.
Aegis treats "never lock the admin out" as an architectural guarantee. It defaults to watching, requires you to pass access-safety gates before it can block, and rechecks the allowlist before every single ban.
Privilege separation
- The agent holds no capabilities
- Helpers hold only
CAP_NET_ADMIN/CAP_NET_RAW/CAP_PERFMON - None has
SYS_ADMIN - Every external input is treated as untrusted
Capabilities
Explainable detection, bounded response.
Network detection
Port scans, half-open floods, and rate anomalies correlated from nftables and kernel evidence.
Web/app detection
Traversal, SQLi/NoSQLi, XSS, admin probes, scanner UAs, GraphQL recon, metadata-endpoint targeting, and protocol anomalies.
SSH abuse
Flags real SSH abuse while ignoring benign pre-auth noise, so alerts mean something.
Post-compromise signals
New listeners, users, cron, or SUID files; SHA-256 changes to watched files; unexpected outbound connections.
Opt-in EDR
Raw-syscall metadata detection for reverse shells and process injection — enabled only when you choose.
Bounded active response
Escalating bans in an isolated nftables table, with the allowlist rechecked before every ban and ceilings that independent agents can't exceed.
Anchored integrity baselines
Chained epochs detect rollback of the integrity baseline itself — you can't quietly rewrite history.
HMAC source attribution
HMAC telemetry closes spoofed X-Forwarded-For, so a forged header can't misattribute an attack.
Optional cross-host correlation
Bounded envelopes with no raw IPs, plus an Access Gate mTLS broker and optional egress control.
ADVERSARY-DEFENSE-EVALUATION.md that states plainly it is "not proven to fully defend" and has not been run against a real attacker's live scan. The "fail into monitoring" design and genuine zero-dependency (air-gap) property are the differentiators — claimed, and testable.Watch first. Block only when it's safe.
Real host detection and bounded response for a single Internet-facing server — no cloud agent, no SIEM, no dependency chain, and no risk of banning yourself.