Antivirus for all your Linux servers

What Shield does

• Virus scans with ClamAV as a quick scan, deep scan or on a schedule, for all servers from one place.
• Real-time watcher that regularly checks new and changed files in typical folders such as /tmp or /home, every 10 minutes by default.
• Quarantine: by default, Shield moves findings to quarantine right away, and that can be undone. If you turn this off, findings wait for your decision.
• Hardening check with Lynis, with the hints in plain words.
• Update center with the pending security updates for each server.
• Intrusion checks: unusual SSH logins and newly opened ports. Since 0.12 you see the addresses Fail2ban has banned on each server, unban them or ban an address by hand. For programs such as a game server, you add port ranges of your own.
• File watcher for important system files.
• Morning briefing with what happened overnight, sent to your phone if you like.
• An optional error analysis for crashed containers using your own Ollama.

What Shield does not promise

No scanner finds everything, ClamAV included. Shield shows you what’s going on on your servers and tells you what you can do. How much of it happens automatically is up to you.

What you need

Linux servers that Nodvard Deck can reach over SSH. With the helper script or sudo rights, Shield sees the most. Without those rights it can only partly read things like the SSH log, Fail2ban and the processes behind open ports. When ClamAV, Lynis or Fail2ban are still missing, Shield installs them with a button. It asks you first.

Findings and warnings end up in the notifications and, if you like, on your phone via ntfy, Telegram, Discord or other channels.