I’ve been running my own web servers for years, and one thing you learn pretty quickly is that the internet is full of people and automated programs poking around where they don’t belong.
Some are looking for passwords. Others are searching for vulnerable websites, exposed configuration files, or anything else they can exploit.
Most of this happens automatically, around the clock.
I wanted something that could keep an eye on my servers without requiring a bunch of expensive software or eating up the limited resources I have available.
That’s where LanternRevere came from.
Keeping Watch
The idea behind LanternRevere is pretty simple. Install a small monitoring application on each server and have them report back to one central dashboard.
Instead of logging into three or four different machines to see what’s happening, I can see suspicious activity across all of them in one place.
LanternRevere watches services like Apache, SSH, and SFTP. Apache handles websites, SSH provides remote command-line access, and SFTP handles secure file transfers.
When somebody starts repeatedly trying passwords, probing for vulnerable files, or behaving suspiciously, LanternRevere takes notice.
Not Every Knock at the Door Is a Burglar
One thing I didn’t want was a security program that immediately blocks somebody because they typed a password wrong.
LanternRevere looks for patterns rather than treating every mistake as an attack.
When suspicious activity crosses a threshold, the server can temporarily block the offending IP address. Repeated trouble can result in longer blocks, progressing from an hour to a day, a week, or eventually permanently.
It also maintains a list of trusted addresses so I don’t accidentally lock myself out of my own equipment.
And importantly, each server can continue protecting itself even if the central dashboard goes offline.
Small Servers Need Small Solutions
Some of my servers run on fairly modest cloud infrastructure. I don’t have unlimited memory or processing power to throw at security software.
LanternRevere uses a lightweight Go application on each server, with a PHP-based central dashboard.
No giant collection of background services, no artificial intelligence trying to decide whether somebody is a criminal, and no unnecessary complexity.
Just straightforward rules, activity monitoring, and information I can actually understand.
It can also recognize when suspicious activity is appearing across multiple servers, which is useful when somebody is probing an entire group of machines rather than just one.
Why the Name?
Paul Revere’s famous midnight warning seemed like a pretty good inspiration.
The idea wasn’t to fight the British army single-handedly. It was to recognize the approaching danger and spread the warning so people could respond.
LanternRevere works on a similar principle.
Watch the perimeter, recognize trouble, and raise the alarm.
I’m not trying to build the world’s most complicated cybersecurity platform. I just want my servers to keep an eye on themselves and let me know when somebody is up to no good.
Sometimes a couple of lanterns are all you need.