vps-audit

vps-audit is a single shell script from Nuver Labs that you copy onto a fresh VPS, run as root, and read. It walks a fixed list of security and resource checks, prints each one as [PASS], [WARN] or [FAIL] with a one-line reason, and writes the same results plus recommendations to vps-audit-report-<timestamp>.txt. There is nothing to install and no agent left behind, which is the whole appeal: it answers "did I forget something obvious on this box" in one run.

What it checks

The security half covers the usual first-hour hardening list. For SSH it reads sshd_config for root login, password authentication and whether the port is still 22. It detects whichever firewall is present (UFW, firewalld, iptables or nftables) and whether Fail2ban or CrowdSec is running. It counts failed logins in /var/log/auth.log, looks for pending updates and a reboot-required flag, counts running services and listening ports, checks that sudo logging is configured, reads minlen from pwquality.conf, and lists SUID binaries.

One check is better than the rest: it compares the port in Fail2ban's SSH jail with the port sshd actually listens on. Move SSH off 22 without updating the jail and Fail2ban keeps banning attackers on a port nobody uses, while reporting itself healthy. That failure is silent in normal operation, and a script is a good way to catch it.

The performance half is thinner — disk, memory and CPU usage and a count of active connections — and reads more like a status line than an audit.

How it decides

Every verdict is a threshold compared against a number, and the thresholds are plain variables in a Configuration block at the top of the script. With the defaults the README lists:

RESOURCE_WARN=50      # disk/memory/CPU %
RESOURCE_FAIL=80
SERVICES_WARN=20      # running services
SERVICES_FAIL=40
LOGINS_WARN=10        # failed login attempts
LOGINS_FAIL=50
OPEN_PORTS_WARN=10    # listening ports
OPEN_PORTS_FAIL=20
PASSWORD_MINLEN=12

The same block holds the file paths it reads (SSH_CONFIG_FILE, AUTH_LOG_FILE, FAIL2BAN_CONFIG_DIR and so on) and where the report goes. ENABLE_CHOWN=true hands the report to the user who invoked sudo instead of leaving it owned by root.

That design is honest about what the tool is: a checklist with numbers someone picked. Forty running services is a FAIL on a single-purpose web box and normal on a host running a dozen containers' worth of systemd units. Leaving SSH on port 22 earns a WARN, though moving it is a noise-reduction measure rather than a security control. Treat the verdicts as prompts to look, and edit the thresholds to match the machine before trusting the colours.

Usage

curl -O https://raw.githubusercontent.com/Nuver-Labs/vps-audit/main/vps-audit.sh
chmod +x vps-audit.sh
sudo ./vps-audit.sh

The clipped README lost the chmod and run lines; the two above are the obvious reconstruction. Since the script runs as root, read it before running it — it is one file, which makes that cheap.

Limitations

• Debian and Ubuntu only. Paths like /var/log/auth.log and /var/run/reboot-required are Debian conventions, and the requirements list ufw, even though the firewall check also recognises firewalld and nftables.
• Root is required, because most of what it reads is root-only.
• It checks configuration, not exposure. A listening port count says nothing about whether the port is reachable from outside, and nothing here scans for known vulnerabilities. The README itself says it is no replacement for a professional audit.
• One-shot output. Running it weekly, as the README suggests, is left to cron, and there is no diff between runs.

Related

For the ban side of the checklist, reaction is a lighter Fail2ban-style daemon; the README names only Fail2ban and CrowdSec as the intrusion prevention it looks for. dockerscan is the same shape of tool pointed at container images instead of hosts: a battery of pass/fail checks with a report at the end.

On the watchlist: single distro family, and worth rechecking whether the checks grow beyond Debian and whether the thresholds get less arbitrary.

Repo: nuver-labs/vps-audit, MIT. Star count not recorded.