What actually happens when something goes wrong
Eiciel runs two watchers continuously. One reads auditd events for the specific actions that matter: privilege escalation, sudoers edits, kernel module loads, tampering with its own config or scripts. It reacts to a single occurrence, with no threshold. The other watches SSH failures and unexpected inbound connections, with separate short-window, distributed and long-window counters, so a slow or distributed probe doesn't slip under a flat rate limit.
When either one fires, Eiciel drops a root-owned nftables table in front of everything. Inbound and outbound both go to policy drop, with narrow exceptions you configure ahead of time. The box stays reachable from its own console. It does not stay reachable from the network.
Built for one box, not a fleet
Host-based, not a gateway
Eiciel boots as the server's own OS. It doesn't sit in front of a separate machine or forward traffic, and IP forwarding is disabled by design. What it protects is what it runs on.
Two factors, two channels
Getting in needs the SSH key. Getting to root needs a live TOTP code checked against the real secret, with replay protection. Neither substitutes for the other.
Fails closed by default
Leave ADMIN_CIDRS empty at build time and the build itself refuses to produce an ISO, unless you explicitly opt into an open-to-the-internet posture.
Tested against itself
Every detection claim on this site has a corresponding test run against the real code, not just the design doc. See the technical demo and the security page.