Unicorn Shield
Every security surface
in your fleet, in one tab
Shield aggregates firewall bans, malware findings, attack traffic, audit failures, pending CVEs, file integrity changes and threat intelligence across every server you run. You look in one place, and you act once: ban an address everywhere, accept a file change across five hosts, fix a failed check without opening a terminal.
Included on every tier, including the free one. Nothing to install, nothing to subscribe to separately.
Why it exists
The aggregation is the product
Running one server, every panel can show you a ban list. Running five, the work is not seeing the list: it is seeing five lists, noticing the same address in three of them, and then running the same unban three times over SSH.
One view, every host
Open a tab and the primary panel asks every server at once, then fills the page in as answers arrive. One slow host never holds up the rest, and each tab tells you how many have reported.
One action, every host
Ban, unban, quarantine, auto-fix, accept, investigate. Each one fans back out to the servers it applies to, so you decide once rather than repeating yourself per box.
Grouped the way you think
File integrity changes group by file, threats by destination, pending upgrades by package, attacks by country or address. The same data, through whichever lens matches the question.
Firewall
Every ban in the fleet, in one list
Shield is the ban daemon, not a wrapper around fail2ban. It watches logs with inotify, matches them against its jails, and writes offenders straight into nftables sets. No Python interpreter, no per-tenant monitors, and the kernel expires each ban itself when its timeout is up.
- A card per host, with its ban count broken down by jail
- Six jails out of the box: SSH, WordPress login, mail, panel sign-in, admin-tool probing, and one fed by the WAF tab
- Every row names the address, the jail that caught it, and when it expires
- Lift a ban on one host or on all of them, in a click
- Thresholds and durations tunable per host or fleet-wide
# the ban list, as the kernel actually holds it $ nft list set inet shield blocklist_v4 set blocklist_v4 { type ipv4_addr flags timeout elements = { 203.0.113.7 timeout 1h expires 54m12s, ; ssh 198.51.100.22 timeout 24h expires 19h03m, ; wp-login 192.0.2.144 timeout 24h expires 23h41m ; waf } }
Malware
Scan tenant files across every server
ClamAV with a YARA rule set tuned for the things that actually turn up in shared hosting: PHP shells, obfuscated encoders, cryptominer droppers and WordPress backdoors.
- Trigger a scan where you need one, on a single host or across the fleet
- Hero tiles carry the last scan time, the infected count and how many files are already quarantined
- Every finding names the file, the container it belongs to and the signature that matched, so it arrives already answering whose site it is
- Quarantine moves the file to a per-tenant locked location owned by root with no permissions, and logs the move. Only root can release it
- A toggle hides WordPress core files, which sometimes match generic signatures, so the list stays worth reading
Web Application Firewall Beta
See who is attacking, then decide
Shield classifies the probes hitting your proxy and keeps thirty days of history. It is a triage surface rather than an auto-blocker: you choose who gets banned, and a ban made here expires after twenty four hours so a mistake recovers on its own.
What it recognises
SQL injection and XSS payloads, path traversal, SSRF, probing for .env and wp-config.php, xmlrpc and wp-admin abuse, shell uploads, Log4Shell JNDI strings, and scanner user agents including Nikto, sqlmap, nuclei and zgrab.
Where it is coming from
A world map of attacker countries, a stacked timeline of events per hour by category, and tables by address or by country. Switch the window between twenty four hours, seven days and thirty days.
Ban narrowly or everywhere
Each address offers both: ban it on the servers that actually saw the attack, or ban it across the whole fleet. Click through any address to see every individual hit behind the count.
Cheap to keep running
Each host reads only the part of its proxy logs added since the last run, so a daily tick stays fast no matter how large the logs get. A seven-day backfill runs once when it is first installed.
Beta. It works and it is in use, but the layout and the defaults are still moving in response to operator feedback.
Audit
CIS-style checks, with the fix attached
Every finding explains what is wrong, shows the output that triggered it, and says what to change. The simple ones carry a button that changes it for you.
What it checks
SSH configuration, kernel hardening toggles, SUID and SGID inventory with change detection, world-writable files, sudoers entries, nftables integrity, listening ports against the expected set, package index age, certificate expiry and whether critical daemons are running.
Findings you can act on
A status chip, a severity, a category tag, the evidence line that caused it, and an explanation of the fix. Where it is safe to automate, file permissions, kernel toggles and clock sync fix themselves on a click.
By server, or by check
Pick a host to see how it scores, or pick a check to see which hosts pass it. The second one is how a question like "where is root login still allowed" gets answered in one screen rather than one SSH session per box.
Clock skew, taken seriously
Shield carries its own small SNTP client, falling back to a second time source if outbound time queries are blocked. Under two seconds passes, under thirty warns because two-factor codes start to fail, and beyond that it fails because certificate verification breaks outright.
Vulnerabilities
Pending upgrades, and the CVEs they close
Shield reads what apk has waiting on each host and cross-references it against Alpine’s security database and OSV, so you can tell a routine version bump from one that closes a filed advisory.
- Rows carrying CVEs list them, link each one to the upstream advisory, and show a severity dot
- Unmarked rows are ordinary updates with no filed security impact, which is just as useful to know
- Narrow by severity, or search for a specific CVE id
- CSV export respects the active filters, so what you hand to someone else matches what you were looking at
- See what one host needs, or flip it around and see which hosts still need a particular package
- The scan only ever looks. Nothing is installed and nothing is changed
File Integrity Monitor Beta
Know when the things that should not change, change
Baseline hashes over panel code, system binaries and security configuration. Tenant files are the Malware tab’s job, so this stays focused on the parts of the machine that should be stable. If the same new SUID bit appears on three servers, that is one row with three hosts behind it, not three things to read.
- Panel code, service configuration, the SSH daemon config and its drop-ins, sudoers, local binaries, and anything carrying a SUID or SGID bit
- The path list is a plain text file you can edit
- Accept endorses a change as the new baseline. Investigate clears it without endorsing it, so the next scan raises it again
- Incremental every hour, with a full re-hash once a day to catch silent corruption
- Stop monitoring a path and its pending events clear themselves
# one change, three hosts, one row to resolve $ unicorn shield fim-scan --verify CRITICAL /usr/bin/pkexec SUID bit added web-01, web-03, mail-01 WARN /etc/ssh/sshd_config modified web-02 2 pending, 0 resolved, 7 of 7 hosts reporting
Beta. In use and working, with its defaults still settling.
Threats Beta
Block known-bad infrastructure, both directions
Seven threat-intelligence feeds at the firewall, plus detection for the process shapes that show up after a server has already been broken into.
| Feed | Ships | Default scope | What it blocks |
|---|---|---|---|
| Spamhaus DROP | On | Both | Hijacked and non-routable IPv4 allocations. No legitimate traffic comes from these ranges. |
| Spamhaus DROPv6 | On | Both | The same list for IPv6. |
| Feodo Tracker IPBL | On | Both | Emotet, Dridex, Qakbot, TrickBot and BazarLoader command-and-control IPs. Dedicated malware infrastructure. |
| ThreatFox | On | Both | Active malware C2 from the abuse.ch reporter pool: Cobalt Strike beacons, Remcos, AsyncRAT, Havoc panels, Mirai and Aisuru botnet C2. Updated continuously. |
| SANS DShield Top-20 | Off | Outbound | The 20 networks generating the loudest active scanning right now. Updated daily. |
| Blocklist.de | Off | Outbound | Aggregated abuse reports from thousands of operators. Residential IP rotation means a moderate false-positive risk, so it ships off. |
| Tor exits | Off | Outbound | The official Tor Project exit list. A policy choice rather than a security verdict: blocking inbound Tor cuts off anonymous visitors to customer sites. |
Every feed has an enable toggle and a scope selector, so you choose whether it filters outbound traffic, inbound traffic, or both. A feed that is switched off still shows how many entries it would contribute, so you can see the cost of turning it on before you do.
Your own servers come first
Fleet addresses are allow-listed ahead of any feed or ban rule, refreshed every few minutes. Some providers hand out IPv6 ranges that sit inside published block lists, and without this that would quietly break your own hosts talking to each other.
Post-exploit shapes
Shield watches for a shell holding a network socket after being spawned by a web server or cron, outbound connections to mining-pool ports, and download-and-execute pipelines in process arguments. These are the shapes a compromise takes once the initial break-in has already happened.
Outbound is the loud one
A connection leaving your server for a known malware endpoint is recorded as a critical event, because it points at a local process worth killing. Inbound hits from the same lists are dropped and counted rather than listed, since recording every scanner that knocks adds noise and no action.
Grouped by destination
One row per address your fleet tried to reach, expandable to show which hosts tried. Accept or investigate works across the fleet in one go, the same as file integrity events.
Beta. The feed catalogue and the defaults are still being tuned.
How it is built
One binary, one ruleset, no daemons
Shield is not a collection of tools behind a shared interface. Every tab is a subcommand of the same static C binary, writing into the same nftables ruleset, scheduled from the same cron file.
- One static binary, with a subcommand per surface. Nothing is interpreted at runtime.
- One nftables ruleset, included by the system firewall configuration rather than replacing it.
- One OpenRC service, and no per-tenant daemons.
- No fail2ban, no Python monitors, and nothing else resident in memory waiting for work.
- One cron file holding every schedule, from the two-minute log ingest to the nightly prune.
Questions
Frequently asked
Does Unicorn Shield replace fail2ban?
Yes, completely. Shield is the ban daemon rather than a wrapper around one. It tails logs with inotify, matches them against its jail patterns, and adds the offender straight to an nftables set. There is no fail2ban on the box, and no Python interpreter sitting in memory waiting for one.
Does it cost extra?
No. Shield is part of Unicorn Panel, on every tier including the free one. There are no plugins to install, no separate security add-on, and no tier that unlocks it.
What does it add to the server?
One static C binary and one OpenRC service. No per-tenant daemons, no Python monitors, no extra services beyond the Shield loop itself. The rules live in a single nftables file that the base config includes.
What happens if one server in the fleet is slow or offline?
Nothing stalls. Every tab dispatches its requests to all hosts in parallel and renders results as they arrive, so a slow server fills in late rather than holding up the page. Tabs show how many hosts have reported.
Can Shield lock me out?
Your own servers are allow-listed in the firewall before any threat-intel or ban rule can fire, so fleet traffic cannot be dropped by a feed. This is not theoretical: some providers hand out IPv6 allocations that fall inside Spamhaus DROPv6 ranges, which would otherwise break sync between your own hosts.
Is the WAF blocking attacks automatically?
No, and that is deliberate. The WAF tab classifies and shows you attack traffic, and you decide who gets banned. Bans made from it land in a jail that expires after 24 hours, so an address banned by mistake recovers on its own.
Which parts are beta?
Threats, FIM and WAF are labelled beta: they work and they are in use, but their layout and defaults are still moving in response to operator feedback. Firewall, Malware, Audit and Vulnerabilities are stable.
Does the Vulnerabilities tab install anything?
No. It refreshes the apk index if it is stale and reads the list of pending upgrades. Nothing is installed or changed by the scan. Applying the upgrades is a separate, deliberate action.
Security that comes with the panel.
Seven security surfaces across your whole fleet, on every tier including the free one. No plugins, no add-ons, no separate pricing.