SentinelX runs as root on the host and watches your panel, server volumes, database and SSH continuously. Malware, webshells, brute force and connection floods are caught as they happen — not after a customer opens a ticket.
No Pterodactyl API tokens, no agent image, no cron polling. Every licence unlocks every module — the status badge tells you what the current build actually does, not what a roadmap promises.
Watches every Pterodactyl volume with inotify and inspects each new or modified file against malware, ransomware, reverse-shell, webshell and disk-bomb signatures. Dangerous files are quarantined or deleted; ransomware triggers an immediate server suspend.
Reads file contents (extension-aware) and matches against obfuscated eval chains, assert/shell_exec execution, PHP stream-wrapper bridges such as php-bridge, destructive SQL and pipe-to-shell payloads.
Hashes every panel PHP file at startup, then watches for changes. Unknown new PHP files, modified files, and critical targets like .env and config/database.php are reported immediately.
Detects out-of-band database changes that bypass the panel: admin password resets, unexpected root_admin account creation, and new API keys issued without a matching activity log.
Any SSH session from an IP outside the whitelist is killed. Repeated failures trigger an automatic iptables ban and push the offending IP to the threat-intel feed.
Subscribes to kernel conntrack events for zero-delay flood detection. IPs exceeding the new-connection threshold inside the sliding window are blocked with a configurable TTL.
Sees every process exec as it happens, then reads container CPU/RAM straight from cgroups. Known DDoS tool signatures, cryptominers and ram-bombs are killed and escalated server-side.
Locks the binary as immutable, hashes itself plus critical host files, and alerts whenever the binary, config, authorized_keys or cron is touched.
Owner-only Telegram bot with inline confirm buttons, plus a localhost REST API on 127.0.0.1:7734 for status, SSH whitelist, GeoIP lists, abuse data and emergency lockdown.
Uptime, SSH bans, NetGuard blocks, top attacker countries, abuse totals and disk usage delivered to the owner on a configurable hour.
Resolves the country behind every SSH failure using a local IP2Location database and labels the alert with it. Currently attribution only: the country is reported, not enforced as a block.
Banned SSH brute-force IPs are pushed to peer nodes and their feeds are pulled on an interval. NetGuard-blocked IPs are not shared yet, and a shared IP annotates alerts rather than blocking on the peer.
Score abuse events per server UUID with severity weights for malware, disk, network, CPU and RAM. The scoring engine is compiled in but is not yet called by any module, so counters stay empty for now.
A licence binds to one node at a time. Moving to a new VPS is a single command on the old node, after which the voucher is free again.
You receive a code shaped like SNTX-XXXX-XXXX-XXXX. The ambiguous characters 0, O, 1 and I are never used so it cannot be misread.
Clone the repository and run the installer. It detects your distribution, installs dependencies, compiles the binary to /usr/local/bin/sentinelx and registers the systemd unit.
Enter a Telegram bot token and owner chat ID, your panel URL and the volumes path. Everything is written to /etc/sentinelx.conf and can be reloaded with SIGHUP.
The daemon prints your machine fingerprint and validates the code against this portal. On success it writes an HMAC-signed licence file to /etc/sentinelx.lic with mode 0600.
Every 24 hours the daemon revalidates against this portal. A revoked or expired licence makes the daemon log the reason and shut down after a 60 second countdown.
Volume writes, panel PHP changes and auth-log lines arrive as events. There is no crawl interval to fall behind.
NetGuard subscribes to kernel connection events, so a flood is measured the moment the kernel sees it rather than on the next poll.
ProcGuard receives exec events before a payload gets going, and reads CPU and memory straight from cgroup files instead of spawning docker stats.
The binary is marked immutable, hashed, and watched. Tampering with the config, authorized_keys or cron raises an immediate alert.
rsyslog so
/var/log/auth.log exists, and raise the inotify watch limit
on panels with many servers.
There are no feature tiers to upgrade through. The binary ships every module, so a licence unlocks all 13 of them — you choose the term and how many nodes may hold it at once.
One node at a time by default. The number of simultaneous bindings is configured
per voucher, and the daemon's own model is single-node: to move, release the old
node first with /sentinelx deactivate, then activate on the new one.
The daemon revalidates every 24 hours. If the licence has been revoked or has expired, it logs the reason and shuts down after a 60 second countdown. Protection stops; your binary, config and panel are left untouched.
No. A node that already activated keeps running until its next revalidation, which can be up to 24 hours away, because activation checks the local signed licence file first and does not call the server. If you need an immediate stop, ask the customer to run the deactivate command, or plan revocations with that delay in mind.
The daemon clears its own immutable flag, deletes its binary and exits. Nothing else on the host is touched. Reinstall from the repository to continue — this is why verifying the code here first matters.
Being straight about it: GeoIP currently labels alerts with the attacker's country but does not enforce a country block; the abuse tracker does not record events yet; and threat-intel sharing covers SSH brute-force IPs only, and a shared IP annotates alerts on the peer rather than blocking there. Each is marked 2 partial and 1 in development above.
No. SentinelX reads the panel database and calls the Docker CLI directly. Database
credentials are read from your panel .env, so there is
nothing extra to create and nothing extra to leak.
A machine fingerprint, the requesting IP, the voucher code and the outcome of each activation. No panel contents, no game data, no customer files. The full list is in the Privacy Policy.