What you probably want to know.

Sentinel is server management as software for Linux servers running Ubuntu or Debian: security updates, protection for SSH access, and a rollback path before every update. It checks every server every ten minutes, installs security updates, blocks attackers at the SSH login, reports unknown keys, and records every step in a checksum-chained audit log. The AI explains and reports, but executes nothing. Built by LimeByte GmbH in Cologne.

With a service provider, server management means that someone keeps your servers up to date, checks them, steps in when something goes wrong, and writes down what they did, usually for a flat rate per server per month. Sentinel takes over the part of this that can be put into rules, as software: installing security updates, checking before and after, rolling back on errors, blocking attackers, maintaining the exposure report, and logging every step. This runs around the clock, at a fixed price per server. What a human has to decide stays with you or your service provider: approvals for reboots and release upgrades, outages outside maintenance, projects.

For companies that run their own Linux servers and have no administrator for the night shift: IT managers and executives at mid-sized companies, agencies with customer servers and WordPress, IT service providers that maintain servers for many customers. From one server to a fleet.

Sentinel only monitors Rocky Linux, AlmaLinux and RHEL, and Windows not at all. Sentinel does not detect malware or attacks on web applications; it does not cover workstations, email or the network. For that, there are security assessments and penetration tests by LimeByte.

No, Sentinel works without an agent. It signs in over SSH with its own user and key. Sentinel installs nothing.

Yes. The control center runs with us or as a small virtual machine at your site. In that case, data, audit log and credentials stay in your organization, and you can add your own AI key if you wish.

Yes. On Hetzner Cloud, Sentinel takes a snapshot of the whole machine before major changes. Sentinel maintains servers at other providers and your own hardware just the same; there, the rollback path runs via the recorded package state and the backed-up configuration.

A fixed price per server per month, net: Observe €14, Maintain €37, Fleet from 25 servers €29, from 100 servers €22, from 500 servers €4. Observe and Maintain can be canceled monthly. The cost calculator works out the comparison with an in-house administrator, an IT service provider or a managed server.

10 companies get Sentinel free of charge for 6 months for up to 5 servers on the Maintain plan and then pay €18.50 instead of €37 per server per month, permanently. In return, we would like 45 minutes of joint setup, two 30-minute conversations and, after 60 days, one sentence that we may quote. Apply by 30 November 2026 via the contact form, topic “Pilot place”. All terms: pilot program.

Those two install updates and block guessing attempts. Sentinel also checks before and after every change and rolls back on an error. It tells you for each server whether it is affected by an actively exploited vulnerability, detects unknown SSH keys, and reboots only with a machine image or with your approval. All servers are in one place, with a morning report and an audit log. The point-by-point comparison is in Compared with built-in tools.

Sentinel detects an active unattended-upgrades and shows it. Whether the system’s updater keeps running or Sentinel takes over the updates is your decision.

For every update run, it writes in plain language what is pending and why; you find this in the maintenance report. It cross-checks the plan, writes the morning report and, if you wish, looks at your website after the update. It does not decide and does not act; the automation does that according to your rules. Its objection is recorded in the audit log but does not stop the run.

Server names, titles and results of maintenance runs, titles of incidents and notifications with truncated IPv4 addresses, and counts of findings. It does not get credentials, nor entire logs or package lists; for serious cases it gets a filtered excerpt of at most 80 journal lines about the trigger, plus running processes, connections, listening ports, the most recent sign-ins, accounts, sudo rules, newly created file paths and the most recent package operations; all limited in lines and characters. A filter removes recognizable keys and passwords from every text. Only if you turn on the website view are screenshots of your site sent to Anthropic: before and after every maintenance run and regularly during monitoring, and for checks with sign-in also from the signed-in area.

On the server, it detects guessing attempts at the SSH login and checks every ten minutes against seven rules: unknown SSH keys, new accounts, sudo rules, scheduled jobs or services, listening ports, changed files under /etc, and a different host key. On top of that come decoy files with made-up keys and the AI agent watch. The exposure report shows which actively exploited vulnerabilities from the CISA catalog and which Ubuntu security notices affect your servers. What it does not detect is listed under “Who is Sentinel not suitable for?”.

Its own user on each server with its own key and one sudo rule. This rule gives Sentinel full administrator rights. The limits are set in the control center: it sends only predefined commands from a catalog of 67 actions and fixed checks, and it checks each one against a deny list. There is no free command line. If you remove the rule, Sentinel can no longer do anything there. That is the hard off switch.

The control center is the most valuable part, because it has administrator rights on all connected servers. For your own control center, we therefore recommend a small VM just for Sentinel. Secrets are stored encrypted, a second factor can be made mandatory for administrators, and every action is recorded in the audit log.

Sentinel checks before and after every change and rolls back whatever is newly red: first it restarts services, then it returns packages and configuration to the previous state. If neither works, it pauses the automation for that server and alerts you, even at night. Reboots and release upgrades cannot be rolled back; that is why Sentinel asks first in those cases by default.

Security updates usually within one hour, as far as the risk class allows, even during blackout periods. Anything larger only in the maintenance window, by default from 03:00 to 05:00, not on weekends and not on public holidays in North Rhine-Westphalia (NRW). You set windows and blackout periods per server.

Not by default. At the “Full” level, Sentinel asks for approval, one click in the application is enough, and the approval is valid for 24 hours. At the levels below, Sentinel only reminds you, and you reboot yourself. If you allow it at the “Full” level, Sentinel reboots on its own, provided an image of the whole machine was created successfully beforehand. Without an image, only if you explicitly accept the risk in the server’s settings.

The “Full” level, the WordPress switch turned on, and WP-CLI on the server. Sentinel does not touch the core, and it cannot roll back a plugin’s database changes.

Debian and Ubuntu; in operation so far Ubuntu 18.04 to 26.04. Everything else is covered under “Who is Sentinel not suitable for?”.

What the trial requires is listed on the contact page under “What happens next”; in short: an Ubuntu or Debian server that our control center can reach over SSH, and a dedicated user with a sudo rule.

Sentinel gets its own user with a key and a sudo rule, in other words administrator rights. This is limited as described under “What permissions does Sentinel get?”: a catalog of 67 actions, a deny list, no free command line. In addition, every server starts in read-only mode, the emergency stop pauses the automation, and every action is recorded in the checksum-chained audit log.

Per server, one user, one key and one sudo rule; the setup wizard generates the key. For the first server we plan 45 minutes together, and you set up the others yourself. Sentinel installs nothing, migrates nothing and rebuilds nothing. What you have today stays.

Monitoring watches and alerts. Sentinel acts: it installs security updates, checks before and after, rolls back on errors and blocks attackers. The two run side by side. Sentinel does not replace monitoring of your applications or analysis of metrics. Its notifications also go into your existing system via webhook.

Sentinel starts at one server. For five servers on the Maintain plan you pay €185 per month, net, cancelable monthly. In return, the night shift for security updates goes away, and you have an exposure report and an audit log for every server. The cost calculator shows whether it pays off, using your numbers.

With a managed server, the hosting provider maintains its machine by its own rules. With a service provider, a person does the management, for a flat rate of €100 to €150 per server per month. With Sentinel, your server stays where it is and remains yours: you set maintenance windows, level and approvals, read every audit log, and can revoke access at any time. Sentinel takes over the routine around the clock for €37 per server per month: security updates, maintenance windows, rollback, blocks, exposure report and reporting. It does not fully replace a service provider; what a human has to decide stays with you or with them. A service provider or IT service provider can run Sentinel on the Fleet plan for its customers, see For agencies.

Ubuntu Pro is a subscription from Canonical for Ubuntu: ten years of security updates instead of five, Livepatch for the kernel, and Landscape as a management tool. It delivers updates, but it does not check whether your website still runs afterward, rolls nothing back, blocks no attackers and does not support Debian servers. Sentinel detects Ubuntu Pro with extended coverage and Livepatch and works together with it: Ubuntu Pro extends the life of your system, Sentinel manages it.

Tools such as Automox, NinjaOne or Action1 install an agent on every server that fetches and reports updates, and they are built for mixed fleets with Windows. Sentinel installs nothing. It signs in over SSH, works only with Ubuntu and Debian, and does what counts on Linux servers: checks before and after the update, rollback path, SSH protection, unknown keys, exposure report. An agent stays until someone uninstalls it; Sentinel leaves nothing behind that would have to be uninstalled.

No. Sentinel by LimeByte, available at sentinel-shield.de and therefore also called “Sentinel Shield”, is an independent product of LimeByte GmbH from Cologne for the maintenance and security of Linux servers. Microsoft Sentinel (a SIEM platform) and SentinelOne (an endpoint protection product) are products of other vendors; there is no connection.

That depends on where the control center is located. If it is at your site, we have no access unless you give it to us. Email notifications, however, currently go through LimeByte’s mail delivery. If you do not want that, use Google Chat, Slack or Teams. Webhook and Telegram can be added per notification type. In the free trial, your server is connected to our control center so that we see what Sentinel sees. Afterward, we move the control center to you if you want.

You remain the operator of your servers. The trial is governed by the trial agreement, and afterward by the contract with its liability provisions. If an update fails, Sentinel rolls back and notifies you. The audit log shows at any time what Sentinel did and what it did not do. You receive the draft contract with the quote, or earlier on request.

Yes. Because Sentinel accesses your servers, we process data on your behalf in doing so. We conclude the data processing agreement under the GDPR at the latest when the trial is set up. If you do not want to use the AI in the USA, switch it off. Sentinel then maintains your servers just the same.

If the control center runs at your site, it keeps running. There is no license server, data and audit log are in your database, and only updates and support are missing. If you want to get rid of Sentinel entirely, remove the user and the sudo rule on every server. The folders with backups and evidence remain, and blocks that were set disappear with the next reboot.

Observe and Maintain monthly, Fleet after 12 months, from 500 servers after 24 months. An email is enough. Your data stays with you.