Do it yourself
Strong server security is usually built and priced for big companies with their own security teams. But the tools the professionals use are open source and available to anyone running a Linux server. Here is an honest map of what you would reach for, grouped by job, with real projects credited.
Malware and rootkit scan
Finding malware, rootkits, coin-miners, and known-bad files on a Linux server. These scanners are well established and cost nothing to run. The work is installing them, keeping their signatures current, and reading the results across every server you own.
- ClamAV — an open-source antivirus engine that scans files against a large signature database to catch trojans, viruses, and other malicious code. License: GPLv2.
- Rootkit Hunter (rkhunter) — checks a system for rootkits, backdoors, and signs of local tampering by inspecting system binaries and settings. License: GPLv2 or later.
- chkrootkit — a set of scripts that look for the fingerprints of known rootkits installed on a machine. License: a BSD-style open-source license.
- Linux Malware Detect (LMD) — a malware scanner built for shared and web-hosting servers that matches files against malware signatures and can hand scanning off to ClamAV. License: GPLv2.
Exposure scan
Seeing what an attacker can reach from the outside: which network doors are open, which services are listening, and which known weaknesses are exposed. Doing this well means scanning regularly, keeping the vulnerability data current, and understanding which findings actually matter for your setup.
- Nmap — maps which network ports are open on a server and identifies the services and versions listening on them. License: the Nmap Public Source License, based on GPLv2.
- OpenVAS — a full vulnerability scanner (the open-source scanner within Greenbone Community Edition) that tests a server against a large, regularly updated database of known security problems. License: GPLv2.
- Nikto — scans web servers for risky files, outdated software versions, and common misconfigurations. License: GPL.
- Nuclei — runs a large community library of templates to check a server and its web services for known vulnerabilities and exposures. License: MIT.
Break-in watch
Watching sign-in and system logs for brute-force attempts and suspicious logins, and reacting to them. On your own, this means collecting the right logs, tuning the rules so real activity is not drowned out by noise, and keeping an eye on alerts day and night.
- Fail2ban — watches log files for repeated failed logins and other abuse, then temporarily blocks the offending address with firewall rules. License: GPLv2 or later.
- OSSEC — a host-based intrusion detection system that analyses logs, checks file integrity, detects rootkits, and can trigger an automatic response to suspicious activity. License: GPLv2.
- Wazuh — a security monitoring platform grown from OSSEC that collects and analyses logs and system events across many machines and raises alerts. License: GPLv2 (core).
- The Linux Audit daemon (auditd) — records detailed system events such as logins, file access, and command use into an audit log you can review and alert on. License: GPLv2, with its libraries under the LGPL.
Threat intelligence
Blocking or flagging traffic from addresses that are already known for attacks. The hard part is choosing trustworthy sources, keeping the lists fresh, and wiring them into your firewall without accidentally blocking people you want to reach you.
- CrowdSec — spots aggressive behaviour in your logs and both shares and consumes a community list of known-attacker addresses so they can be blocked. License: MIT (engine).
- Suricata — inspects network traffic in real time against rule sets, including threat-intelligence rules, to flag or block known-bad activity. License: GPLv2.
- FireHOL blocklist IPsets — a daily-updated collection of public IP blocklists gathered from many reputable sources, ready to load into a firewall. Each individual list keeps its own usage terms, so check the ones you use.
Or we do it for you
Doing it yourself is a real, honest option. Every tool above is open source, the projects behind them are excellent, and running them yourself costs nothing but your time. If you enjoy this work and have the hours for it, you do not need us.
What you are paying for with us is the time and the correlation. We install these kinds of jobs for you, keep them updated and tuned, run them across all of your servers, and report what they find in plain English instead of raw logs. When something needs fixing, we show you why and apply only the fixes you approve. The price is $1 per server per month from MinakiLabs LLC.
To be straight about where we are today: the malware and rootkit scan is available now. The exposure scan, break-in watch, and threat-intelligence parts are being added one at a time, and each goes live only after it is built and tested. We will not claim a part is doing its job before it is.