HERMIAN, a lightweight intrusion detection daemon for Linux servers

If you run a server exposed to the internet, it’s being probed right now. Most people know this but few people actually see it.

Tools like Wazuh or Falco are powerful, but they can feel heavy for someone running a handful of VPS boxes. I wanted something you install in a minute, that stays quiet when nothing is wrong, and tells you clearly when something is.

HERMIAN runs as a daemon on your Linux server and watches for things that usually mean trouble:

• SSH brute force, with higher severity when the targeted accounts actually exist
• Suspicious process chains, like a web server suddenly spawning a shell
• Persistence, such as new cron entries
• New listening ports

When something triggers, you get a Telegram message with buttons: block the IP for 24h, ignore for 2 hours, or ignore. No dashboard to check. You can also get alerts on mail, ntfy/discord/webhook.

How it works

It’s written in Rust. Detection uses eBPF (via aya) when the kernel allows it, and falls back to /proc polling otherwise, so it still works on more restricted environments. A PAM module adds authentication context. It’s distributed through a signed APT repository.

No telemetry

A security tool that has this level of access to your machine shouldn’t send data anywhere. HERMIAN doesn’t. If you want to help improve detection, you can generate an anonymized report and send it yourself.

A real result

One of the first beta testers installed it and got HIGH alerts within moment on a malware already running on his server, an httpd -> sh chain with cron persistence. He had a cryptominet that has been there before HERMIAN was installed.

HERMIAN is in beta. It works on real servers, but false positives still need tuning, and that’s what we need help with. If you run Linux servers and want to try it, I’d really appreciate your feedback.

GitHub: https://github.com/hermian-security/hermian

Website: https://hermian.me/agent/