MerlinScout

Everything a migration needs to know about a Linux server

MerlinScout connects to Red Hat Enterprise Linux servers over SSH from your Windows PC and documents what the replacement server must reproduce: its mounts and network shares, services and applications, users and scheduled jobs, and, above all, its connections. Every flow in and out is tied to a port, a process, a user and a service, so a network team gets firewall rules and an application owner sees which program depends on what.

One server or a batch. The reports are written to be handed to clients, network teams and application owners as they are.

Read-only, with nothing left on the server

• Nothing is installed, uploaded or written on the servers it scans: no agent, no script, no temporary file. It never uses SCP or SFTP.
• Only commands from a fixed catalog run, one at a time per server, each with a time limit and at low priority where the server has the tools for it. An automated test rejects any catalog command that could change a system.
• What will this do? lists every command the current choices would send, exactly as it is sent, with the ones that need root marked. Save it as a text file or PDF for a security team before you scan.
• The one footprint it cannot avoid is stated in the app and the report: the server records the SSH login, and in a sudo mode sudo logs its commands. MerlinScout runs sudo -K when it finishes.
• Passwords, keys and the sudo password are held in memory for the scan only, never saved or logged, and cleared when it ends. Secrets found on the server (passwords in configs, connection strings, tokens) are redacted in every report.

Is it for you?

It's a good fit if you plan or run server and data center migrations, rebuild applications on new Linux servers, or need firewall rules for a replacement server and want them from evidence rather than interviews.

It's probably not for you if you want continuous monitoring. MerlinScout records a snapshot, or a sampling window you choose; it doesn't watch the server between scans.

Features

Connections and dependencies

• Listening services and live connections, each with its process, executable, user and systemd unit or init script, and whether it's inbound or outbound.
• Optional sampling for 15 minutes to 24 hours, to catch connections that come and go. It reconnects after a dropped connection and notes the gap.
• Evidence from the server's own history: SSH logins and sar performance data, where they exist.
• Dependencies from configuration: DNS, NTP, NFS, SMB and iSCSI storage, syslog, mail relay, LDAP, Active Directory and Kerberos, package repositories and Satellite, monitoring and backup agents, database clients, JDBC URLs and Java settings, and cron jobs that reach other servers.
• An optional deep config scan that finds addresses and URLs in configuration files, marked as unverified.
• Peer names looked up from your PC, never from the server.

For the migration

• A firewall rule matrix: direction, source, destination, port, protocol, process, evidence and first and last seen, with proposed rules for the new server's address and an optional summary by subnet.
• A dependency diagram with peers grouped by role, and an application view of how a batch of servers connect to each other.
• A sizing recommendation for CPU and memory from the sampled and sar history.
• Old against new: compare two servers, or two saved scans, for missing mounts, services, packages, users, ports and settings, each with a severity hint.

The server itself

• Operating system, kernel, platform and virtualization, CPU, memory, disks, LVM, file systems and fstab differences.
• Network configuration, services and processes, detected middleware and databases, containers, Java runtimes, installed packages, users, groups, sudoers, cron jobs and timers, security settings and a summary of recent errors.

Reports

• XLSX, CSV, Word, HTML and PDF from the same content, and JSON that reopens later to make new reports or compare, without scanning again.
• The HTML report is one file that works offline, with sortable tables and the diagram built in.
• Your client's name and logo on the cover, and an option to mask IP addresses consistently for sample reports.

Familiar menus

• A standard Windows menu bar, File, Edit, View, Scan and Help, with each command's keyboard shortcut beside it. Press Alt to use it from the keyboard.
• The buttons on each page stay for one-click access.

Supported Linux

Price

Free. No trial, subscription, account or ads.

Privacy

• Everything it collects is written to the report folder you choose on your PC.
• It connects only to the servers you scan, over SSH. MerlinScout collects no usage data and doesn't check for updates.

Permissions

A normal user account is enough. Items that only root can read, such as other users' processes, the security log and firewall rules, are marked as needing root in the report rather than left blank.

To collect those too, choose a sudo mode: passwordless sudo, or sudo with a password that goes to sudo's input and never onto a command line.

Requirements

Install

1. Download the zip, extract it, and run the setup file inside. Setup and the app are digitally signed by Virtual Merlin, Inc., so Windows shows that name as the publisher. If Windows still shows "Windows protected your PC" while the new signature builds reputation, click More info, check the publisher is Virtual Merlin, Inc., then click Run anyway.
2. Start MerlinScout, enter a server and an account, and choose what to collect.
3. Click Start scan. The reports go to the folder you choose, by default Documents\MerlinScout Reports.

Or use the portable zip: extract it to any folder and run MerlinScout.exe. It writes nothing outside its own folder and the report folders you pick.

SHA-256 of the setup file inside the zip:

44BF64CC3C7FFB1470CA38EA751F708A97D12158C86691BFEB4C6467818C6F3B

SHA-256 of the portable zip:

B239DB5BB1DCBBAF3305564DE88C15B4BAB4C6D84CC9A061C0BBEDF67795F91C

Known limitations

• Linux servers only. Windows servers are not scanned.
• Accounts whose login shell is csh or tcsh are not supported.
• Sampling needs the PC on and connected for the whole window. MerlinScout keeps it from sleeping while it samples.