A security audit compares how your server is actually configured with how it should be. Servers drift: a firewall rule added during an incident and never removed, a test user left behind, a service installed for an afternoon and forgotten. This guide gives you an automated scan with Lynis, a manual checklist for the things a scanner cannot judge, and a schedule so the audit keeps happening.
Step 1 — Run an Automated Audit with Lynis
Lynis is a free, open-source auditing tool that runs hundreds of checks and prints prioritised suggestions.
# Ubuntu / Debian
sudo apt install lynis -y
# AlmaLinux / Rocky Linux
sudo dnf install epel-release -y && sudo dnf install lynis -y
sudo lynis audit systemAt the end you get a hardening index and two lists: warnings (fix these first) and suggestions. The full report is saved to /var/log/lynis-report.dat.
Not every suggestion fits every server. A test that assumes a desktop, a mail server or a compliance regime you do not have can be skipped — the aim is a server you understand, not a perfect score.
Step 2 — Who Can Get In
sudo grep -E '^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf
awk -F: '$3 >= 1000 {print $1}' /etc/passwd
getent group sudo wheel
sudo last -n 20- SSH keys only, password login off, direct root login off or key-only — see How to Harden a Fresh Linux VPS.
- Every human account belongs to someone who still needs it.
- Sudo or wheel membership limited to the people who administer the server.
- Recent logins match who you expect.
Step 3 — What Is Listening
sudo ss -tulpn
sudo ufw status verbose # Ubuntu / Debian
sudo firewall-cmd --list-all # AlmaLinux / Rocky- A firewall is active and denies by default.
- Every listening port is one you can explain. Databases, Redis and admin panels should listen on
127.0.0.1or a private address, not on the public IP. - Rules added “temporarily” have been removed.
Your VPS has its own dedicated public IPv4 address, so anything listening on it is reachable from the whole internet unless the firewall says otherwise.
Step 4 — Is It Up to Date
apt list --upgradable 2>/dev/null | tail -n +2 # Ubuntu / Debian
sudo dnf check-update # AlmaLinux / Rocky
cat /etc/os-release- Pending updates applied, and automatic security updates enabled.
- The distribution release is still supported. An end-of-life release gets no security fixes at all; support dates are on the best Linux for a VPS page.
- Application dependencies (npm, Composer, pip) checked for known vulnerabilities.
Step 5 — Files and Permissions
World-writable files let any process or user on the machine change them. Web roots and application code are where this matters most.
# world-writable files and directories outside /tmp-style locations
sudo find / -xdev \( -type f -o -type d \) -perm -0002 ! -path '/proc/*' ! -path '/tmp/*' ! -path '/var/tmp/*' 2>/dev/null
# files with no valid owner or group (note the brackets)
sudo find / -xdev \( -nouser -o -nogroup \) 2>/dev/null
# set-uid / set-gid binaries, to compare against a known list
sudo find / -xdev -perm /6000 -type f 2>/dev/nullApplication files normally need 644 and directories 755; nothing in a web root needs 666 or 777. Fix in bulk with find /var/www -type f -perm /022 -exec chmod go-w {} + once you have confirmed what the application writes to.
Step 6 — Services and Scheduled Jobs
systemctl list-units --type=service --state=running
sudo crontab -l; ls /etc/cron.d/; systemctl list-timersStop and disable anything this server does not need: sudo systemctl disable --now SERVICE. Unknown cron entries are a classic sign of compromise — check every one.
Step 7 — Detection and Recovery
- Fail2Ban (or an equivalent) is running and banning:
sudo fail2ban-client status. - Logs are kept long enough to investigate an incident, and ideally copied off the server.
- File integrity monitoring is set up — see How to Set Up File Integrity Monitoring with AIDE.
- Backups exist off the server and have been restored at least once. We do not hold backups of customer servers, so this one is entirely yours.
- TLS certificates are valid and renew automatically.
Step 8 — Make It a Habit
Run Lynis monthly and keep the reports, so you can see whether the server is getting better or worse:
sudo crontab -e0 6 1 * * /usr/bin/lynis audit system --cronjob --quiet > /var/log/lynis-$(date +\%Y\%m).log 2>&1Repeat the manual checklist whenever the server changes role, gains a new service, or loses an administrator.
Common Questions
Lynis shows dozens of suggestions on a new server. That is normal for a default install. Work through authentication and network exposure first; those cover most real-world attacks.
Do I need to reach a particular score? No. The score is useful for tracking change over time, not as a target.
What if the audit finds something I did not put there? Treat it as a possible compromise — see How to Recover from a Compromised VPS.
Why This Is Your Job on an Unmanaged VPS
With full root access you control every setting on the server, which also means its security is yours to maintain. We protect the network edge; what runs inside the server is up to you. If you would rather not own that, read what unmanaged means before you order.
Continue Reading
- VPS Security Checklist for Beginners
- How to Scan for Malware with ClamAV
- How to Install and Configure auditd
- DDoS protection on our network
Browse more articles in Advanced Security & Compliance.
