Open source · Linux server security
Audit your server in one command.
vps-audit is a bash script that checks a Linux VPS for the misconfigurations that actually get servers taken: root SSH left open, no firewall, security updates nobody applied. It grades every check and prints the fix for each failure. Nothing to install, nothing to sign up for, no agent left running afterwards.
Run it on your server
curl -O https://raw.githubusercontent.com/nuver-labs/vps-audit/main/vps-audit.sh && chmod +x vps-audit.sh && sudo ./vps-audit.shMIT licensed · No dependencies · 2.4k stars on GitHub
What it looks at
18 graded checks
SSH and access
- Root login disabled in sshd_config
- Password authentication off, key-based auth only
- SSH listening somewhere other than port 22, and above the unprivileged range
- Sudo commands written to an audit log
- A password policy that rejects weak passwords
Network exposure
- A firewall that is installed and actually active: UFW, firewalld, iptables or nftables
- How many ports are open, and which of them are reachable from the internet rather than localhost
- Active internet connections at the time of the run
Patching
- Security updates waiting to be installed
- Unattended upgrades configured, so the next batch lands without you
- A restart pending from updates already applied
Intrusion signals
- Fail2ban or CrowdSec installed and running, on the host or in Docker
- Failed SSH login attempts in the last 24 hours
- SUID binaries sitting outside the standard system locations
Resource health
- Disk usage, with used and available space alongside the percentage
- Memory usage, same breakdown
- CPU usage, idle time, load average and core count
- How many services are running, because every one is attack surface
System snapshot
- Reported, not graded: hostname, OS, kernel and uptime
- CPU model and core count, total memory, total disk
- Public IP and load average
Findings you can act on
Sample run
sudo ./vps-audit.sh
- [PASS]SSH Root LoginRoot login is properly disabled in SSH configuration
- [PASS]SSH Password AuthPassword authentication is disabled, key-based auth only
- [WARN]SSH PortUsing default port 22 - consider changing to a non-standard port
- [FAIL]Firewall Status (UFW)UFW firewall is not active - your system is exposed to network attacks
- [FAIL]Unattended UpgradesAutomatic security updates are not configured - system may miss critical updates
- [WARN]Failed Logins34 failed login attempts detected - might indicate breach attempts
- [WARN]Running Services27 services running - consider reducing attack surface
- [PASS]Disk UsageHealthy disk space available (23% used - Used: 9.1G of 40G, Available: 29G)
Every run also writes vps-audit-report-<timestamp>.txt next to the script, with the same results plus the specific remediation for each failure.
How it grades
Thresholds
| Signal | Pass | Warn | Fail |
|---|---|---|---|
| Disk, memory and CPU | under 50% | 50 to 80% | over 80% |
| Failed logins, last 24h | under 10 | 10 to 50 | over 50 |
| Running services | under 20 | 20 to 40 | over 40 |
| Open ports | under 10 | 10 to 20 | over 20 |
These are plain variables at the top of the script. A build server that sits at 70% memory by design should not be told about it every week, so edit them to match your baseline rather than learning to ignore the output.
What it needs
Requirements
Ubuntu or Debian
Written against the Debian family, which is what most VPS images are. Other distributions mostly work, but some checks will not find what they are looking for.
Root or sudo
sshd_config, the auth log, firewall state and the SUID sweep are all privileged reads. Without them the audit is guessing.
Nothing to install
It shells out to ufw, systemd, ss or netstat, grep and awk. On a stock server every one of those is already there.
What it is not
Scope
This finds the common misconfigurations, which is most of what gets a server taken. It is not a penetration test and it is not a substitute for one. Alongside it:
- Keep the system updated, and let unattended upgrades do it for you.
- Read your logs on a schedule, not after an incident.
- Treat every WARN as a decision you have made, not one you have deferred.
- Get a real audit for anything holding customer data or money.
Ran it, and the report is longer than you hoped?
We build and run infrastructure for a living, and the fixes for most of these are an afternoon. Send us the report, or open an issue if the tool itself got something wrong.
Built and maintained by Nuver Labs · MIT licensed