NuajProtect · Linux
One binary under systemd that blocks malicious traffic on the server itself, with the same threat intelligence and detection as every NuajProtect edge, on x86-64 and arm64, and no proxy in the way.
At a glance
| What it is | A host-based edge filter, backed by a global threat-intelligence feed |
|---|---|
| Form | One static binary, no runtime dependencies, run by systemd |
| Architectures | x86_64 and aarch64 |
| Distributions | Any Linux with systemd — Debian, Ubuntu, RHEL, Rocky, Alma, Fedora and derivatives |
| Enforcement | Accelerated where supported, standard otherwise. The agent chooses at start-up; nothing to configure |
| Placement | Sentry — protects the host it runs on. Relay — protects what is behind it, directly or over GRE, WireGuard or IPsec |
| Addressing | IPv4 and IPv6, both enforced |
| Paths | /opt/nuajprotect for the binary and its configuration, /var/log/nuajprotect for logs |
| Service | nuajprotect-agent under systemd; CLI on your PATH as nuajprotect |
| Local interface | A break-glass console and API bound to 127.0.0.1, reachable when the control plane is not |
| Control plane | Managed SaaS over mutual TLS, or a self-hosted control plane you run yourself |
| Price | Free through the beta |
Enforcement
The agent picks its mode when it starts. You don’t need to know which one your server supports, and an older box is still fully protected.
First choice
Drops hostile traffic at the earliest point, before the server spends any work on it.
Where acceleration is unavailable
The same lists, matched later in the path. Still blocked before your applications, and nothing is proxied.
Older Linux versions
The same lists and the same policy on an older Linux version. Full protection, by design.
The mode changes the method, never the decision. The blocklist, flood thresholds learned from your own link, scanner strikes and repeat-offender escalation work the same wherever the agent runs, so a fleet with mixed Linux versions enforces one policy. The dashboard shows which mode each endpoint chose.
Placement
Sentry
Protection runs on the machine it defends, and software on that host can hand the agent an attacker it spots. The default for a public-facing server or VM, and the fastest to try: one install, no routing changes.
Relay
A forwarding gateway cleans traffic for services that never see the raw internet — directly behind it, or at the far end of a GRE, WireGuard or IPsec tunnel, so their addresses stay hidden. One relay covers appliances, embedded systems and anything else that can’t run an agent.
Same binary, same account. Combinations that aren’t possible are shown as unavailable, never offered and then rejected at setup. To cover a whole network with nothing installed on any of it, the NuajBridge appliance is coming soon.
Install
Your account gives you the exact command for the endpoint you’re adding. The installer is a shell script served over TLS, and it needs root — so download it, read it, then run it.
# fetch, read, then run — never pipe a script you have not seen into a shell
curl -fsSL <the installer URL from your account> -o nuajprotect-install.sh
less nuajprotect-install.sh
sudo bash nuajprotect-install.sh
systemctl status nuajprotect-agent journalctl -u nuajprotect-agent -f nuajprotect status
Each endpoint authenticates to the control plane with mutual TLS — a certificate, not a shared secret in a config file — and is enrolled from your NuajProtect account. Run it watching before you run it blocking: monitor mode, the allowlist and the per-endpoint activity view are there because any filter can misjudge unusual but legitimate traffic, and the time to find out is before it drops any.
Application reporting
Credential stuffing inside valid sessions, a bot filling in your contact form, an API key walked one identifier at a time: none of it looks wrong on the wire, and all of it is obvious to the application.
So the application says what failed, in its own words — a login that did not match, a form a bot filled in, a page that never existed. One call to the agent on the same server, over a local interface bound to 127.0.0.1 that nothing off the machine can reach, carrying the application’s own token from your dashboard so no other process on the box can report in its name:
# the contact form caught a bot: say what failed, nothing else
curl -H "X-NuajProtect-App-Token: $TOKEN" \
"http://127.0.0.1:6825/event/203.0.113.45?failure=form+spam&source=website"
No log files to parse and no patterns to write. No thresholds or severity to set either: the agent decides how many failures add up to an attacker and how long a block lasts, from what it sees on this server and what your other endpoints report. Report a success too, and it cancels the failures that were building against that address.
A new application starts out learning. Its reports are scored and shown in your dashboard, and on their own they block only addresses your other endpoints have reported too. Once its reports prove accurate, it blocks on its own word — and if operators keep overturning its blocks, it goes back to learning by itself.
The same local interface is the break-glass path. If the control plane is unreachable, the agent keeps enforcing what it already knows, and you can still see and change what it is doing from the console on the loopback address.
Behind a CDN
Behind a CDN, every visitor reaches your server from the CDN’s addresses. A firewall on the server cannot tell them apart: blocking one takes a share of your visitors down with it, and the attacker behind it is never touched.
The NuajProtect gate fixes that for sites served by nginx. Your CDN proves itself with one header carrying a secret from your dashboard, and nginx asks the agent about every request before serving it:
It works with any CDN or proxy that can add a request header — Cloudflare, Fastly, Amazon CloudFront, Akamai, Azure Front Door, Google Cloud, Bunny, or your own nginx, HAProxy or Caddy. If the agent is stopped, nginx keeps serving: the gate never takes a site down.
Upgrades
The agent upgrades itself when the control plane offers a newer build, and every release is signed. The signature is verified before anything is replaced; if it does not check out, the upgrade is refused and the running build stays.
Upgrades also wait while a configuration change is settling, so no box restarts into a new build and a new policy at the same moment — and when something changes, you know which one did it.
Questions
MikroTik routers join the same account — see NuajProtect on RouterOS. Every deployment, agent, router or appliance, is a sensor as much as an enforcement point.
Get started
Free during the beta. Start with one exposed server; everything you protect lives in one account.