Sentinel v1.2.0 — whitelist exemptions

Per-server and per-user whitelist exemptions, scoped per detection or for all:

• Settings → General → Whitelist → "Fully exempt servers & users": pick a server (or a user — all their servers) and optionally the specific detectors to exempt; empty list = exempt from everything.
• Exempt targets are never scanned (volume sweeps and container scans skip them) and their events are dropped before actions, alerts, or recording.
• The panel resolves user exemptions into that node's server UUIDs on every config sync, so ownership changes apply on the next push/pull.
• Distinct from muted servers (existing), which still record events but suppress actions/alerts.

Verified live: full exemption (zero events on blocklisted file drop), miner-only exemption (onaccess still fires), user-level exemption (all owned servers covered), and detection resuming after removal.

Sentinel v1.1.0 — targeted scans + signature expansion

Targeted scans: on any server's Sentinel page, pick files/folders in its volume (checkbox browser with filter, or manual paths) and scan them. Findings are quarantined — the server is not suspended — and every file's outcome (quarantined / would_quarantine in dry-run / failed) is reported in the scan results. Node side is traversal-guarded; a guarded volume-listing endpoint backs the picker.

Signature expansion:

• Container escapes: docker.sock / docker run/exec, unshare, host mounts, ptrace attach (container-only, critical); cgroup release_agent/core_pattern tampering
• Abuse: nezha-agent, rathole, nps/npc, gost, brook, realm, tailscaled, zerotier-one; container-only tools (sshd, web terminals, filebrowser, rclone, aria2, torrents, cron) flagged only inside containers
• Miners: xmrig-proxy, dero-miner, verus-solver, monerod + pool domains; DDoS: mhddos, pyloris, booter/stresser, mirai/qbot/kaiten/tsunami
• Webshells (eval/shell_exec/child_process), miner configs, token/session stealers, xmrig log formats

All flows verified live: picker listing, traversal rejection, dry-run would_quarantine report, enforced quarantine with ledger row, freeroot jar detection on write + process detection.

Sentinel v1.0.2 — freeroot/proot coverage + defaults fix

• Defaults layering fix: the panel's 5-item abuse.known_processes default was masking the comprehensive node list on every node (v2ray, xray, cloudflared, ngrok, tunnels, spam tools were effectively unwatched). The full list now ships, plus proot.
• freeroot coverage (the foxy touxxx proot Ubuntu-userland installer): jar blocklisting via intel, proot process signature, console-log indicators ("Do you want to install Ubuntu?", "Executing proot"), volumescan content patterns (foxytouxxx, freeroot, ubuntu-base-), and a Freeroot_Proot_Installer YARA rule.
• Wider abusive listen ports: 1080, 8388, 9001, 9030, 3128, 8118.

Verified live: jar drop → critical onaccess blocklist event; proot process → high abuse event; config sync + intel persistence intact.

Sentinel v1.0.1 — scenario-test hardening

Hardening release driven by a full scenario-test pass (admin UI, enforcement, deletion, transfer):

Panel

• Config version now bumps on manual hash add/delete and on cross-node hash confirmation, so agents always re-sync their blocklists.

Node agent

• Panel intel (hash blocklist + YARA versions) now persists across agent restarts — a restart no longer leaves the agent blind until the next config change.
• Cooldown dedup is split by enforcement mode: a finding first seen in dry-run no longer suppresses enforcement of the same finding after dry-run is switched off.
• Quarantine restore/delete resolves quarantine_path/original_path from the request body (panel row ids and node registry ids are independent sequences).

Verified live end-to-end: all admin pages and actions, kill/stop/suspend/pause/quarantine/restore/delete enforcement, token reset lifecycle, offline marking, webhook alerts with cooldown, node/server deletion cascades, and server-transfer event attribution.

Sentinel v1.0.0

First release.

Sentinel is a fleet security extension for Pterodactyl: a panel addon (Blueprint or standalone) plus a static Go agent per Wings node.

• 12 detectors: miners, port scans, outbound DDoS, zip bombs, privesc/container escape, abuse tools, on-access malware (hash + YARA), FIM, trivy, container & volume scans
• Graduated enforcement: kill process → pause/stop container → panel-side suspension; global dry-run
• Central hash intel with cross-node confirmation and bulk import (file/URL)
• Panel-managed versioned config pushed to all nodes; offline spool + reconcile
• Admin UI: dashboard, detections, nodes, servers, scans, intel, quarantine, settings

Download Sentinel-v1.0.0.zip and pick either the blueprint/ or standalone/ distribution; node-module/ contains the agent installer. Install guides are inside each folder.