Qore Sentinel

Live signs of intrusion on your Linux PC — ports, remote access, sessions, logins.

• Linux

Live intrusion-sign watcher for Linux Mint: every port, connection, remote-access tool, hidden display and login session against a learned baseline, with reverse-shell and rootkit shapes, a hardening page that applies fixes, a Raspberry Pi network watcher and a clean-reinstall guide. $24.99 once.

What it does

• Watches the running system every 5 seconds as root: every listening port with its program, every live connection to the internet with its program, remote-access tools running regardless of their settings (SSH, xrdp, VNC, AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, tunnels), and a service that runs although it is 'disabled'.
• Hidden screens and sessions: every X display and Wayland socket on the machine, every login session — the ones you are not looking at are listed, with their owner where it can be found.
• Logins and authentication: SSH logins and password-guessing in the last 24 hours, sudo use, remote-desktop activity, last and failed logins — evidence even after a session has ended.
• Learned baseline: press once on a day you trust the PC; from then on every new port, program, account, admin right, SSH key, service, scheduled job, startup file, kernel module, display or session is an alert until you accept it. Nothing is accepted automatically.
• Reverse-shell and rootkit shapes: a shell or netcat holding a network connection, a kernel module hidden from /proc/modules, a library injected into every program via ld.so.preload — critical alerts.
• Hardening page that fixes, not just reports: mask SSH, remove remote-desktop packages, firewall deny-incoming, disable automatic login — each fix says exactly what it changed and SSH can be unmasked again.
• Tray alarm with sound and desktop notification for critical and high alerts; an append-only alert log.
• Pi station (scripts included): a Raspberry Pi watching the PC's traffic from outside — inbound attempts on remote-access ports, clockwork beacons to unknown addresses, DNS lookups of remote-control services — shown inside Sentinel next to its own alerts.
• Built-in clean-reinstall guide in Arabic and English: the real answer when a critical sign appears.

Runs on

• Linux: Mint 22+ / Ubuntu 24.04+ (64-bit)

• Works offline
• No tracking
• Pay once, no subscription