v1.0.0 Open source · MIT · standalone daemon · no account required

SSH attack alerter that does one thing.

Tails auth.log, recognises brute-force patterns and fail2ban jails, sends a notification before things get interesting. Standalone, MIT-licensed, no HostAtlas account required.

$ curl -fsSL https://tools.hostatlas.app/install.sh | sh -s sentinel copy

Source on GitHub.

MIT

licensed

platform dependency

notification channels

/var/log/auth.log · sentinel

$ sentinel run --config /etc/sentinel.yml
→ tailing auth.log · fail2ban jail loaded · 5 channels armed

14:08:12 · 185.234.219.42 · 142 tries · 12m brute → banned by jail sshd
14:08:12 · alert → slack #infra-sec, ntfy:ops

14:11:47 · 89.248.165.17 · 67 tries · 4m brute → banned by jail sshd
14:11:47 · alert → slack #infra-sec, ntfy:ops

14:14:02 · 192.168.50.4 · login accepted (user sascha · publickey)

summary · today
jail sshd · banned 7
unique offenders 4 IPs · 2 ASNs
successful logins 3 (all known IPs)
last alert 6m ago · waiting for journald _

— Why a dedicated daemon

Lightweight SSH telemetry on the box you already have.

For the hosts where a full agent is overkill or unavailable — bastions, jump-boxes, dev machines, things you SSH into rarely but want to know about when others try too.

auth.log is truth

A daemon that reads auth.log directly is more reliable than yet another log pipeline. Single source, single dependency, no agent required.

fail2ban-aware

Reads jails, bans, recidivism. You get the platform-level picture (offending IPs, repeat offenders) without writing the glue.

notify where you live

Slack, Discord, email, ntfy, plain webhook. Pick one, point Sentinel at it, done. No vendor lock-in.

— What ships in the box

Six features. All on by default.

brute-force detection

Per-IP rate, repeat offenders, dictionary-shape detection. Configurable thresholds; sensible defaults out of the box.

fail2ban integration

Reads jail state, reports bans + unbans, cross-references with attack data.

success-login alert

Opt-in. Notify on every successful login, or only from new countries / new IPs.

multi-channel notify

Slack, Discord, email (SMTP), ntfy, plain webhook. Pick and stack as many as you like.

daily summary

One digest per day if there is anything to report. Quiet days stay quiet — no noise.

HostAtlas bridge

Optional. If the host runs the HostAtlas agent, Sentinel events also land in the platform timeline + audit log.

— Install

Two ways in.

Homebrew

Tap and install. Use this on a workstation or a Mac you keep an eye on the fleet from.

$brew install hostatlas-labs/tap/sentinel

Standalone binary

Single-file binary. Drop in, write a tiny YAML config (channels, thresholds), run from systemd or directly.

$curl -fsSL https://tools.hostatlas.app/install.sh | sh -s sentinel

— Honest answers

Common questions.

Do I need a HostAtlas account?

No. Sentinel is standalone. It uses the same auth-log parsing the platform uses, packaged as a small daemon. An account adds the bridge to the platform timeline; everything else works without one.

Does it ship logs anywhere?

No. By default it sends a notification on threshold and writes a small JSON event log locally. Anything beyond that is opt-in.

Performance hit?

Streams from journald via subscription, not a poll. Idle hosts cost essentially nothing.

License?

MIT. Use commercially, modify, redistribute. Stays MIT.

Discovery & Mapping

For developers