Free · no sign-up

Audit your VPS security with one command

A read-only script checks SSH, firewall, exposed services, updates and accounts, and gives you a score from 0 to 100 with the fix for each issue. It changes nothing on the server and sends nothing anywhere.

curl -fsSL https://securyblack.com/audit.sh | sudo sh

Rather read it first? It is about 200 lines of sh: download it, review it and run it. View the script

curl -fsSL https://securyblack.com/audit.sh -o audit.sh
less audit.sh
sudo sh audit.sh

What it checks

SSHWhether root can log in, whether it accepts passwords, how many attempts it allows per connection, X11 forwarding and the port.
Firewall and brute forceWhether a firewall is active (UFW, firewalld, nftables or iptables), whether Docker publishes ports bypassing UFW, and whether Fail2ban or CrowdSec block attacks.
Exposed servicesRedis, MongoDB, Elasticsearch, Memcached, MySQL, PostgreSQL, FTP or Telnet listening beyond localhost. Private networks and Tailscale do not count.
UpdatesPending security patches, whether they install automatically and whether a reboot is needed to load them.
Accounts and permissionsOther accounts with UID 0 besides root, and who can read /etc/shadow.

What it looks like

Example on a freshly created Ubuntu 24.04 VPS: no firewall, no Fail2ban and pending patches.

SecuryBlack · Quick VPS audit
my-vps · Ubuntu 24.04.5 LTS · 2026-10-21 18:02

SSH
  ✓           Root cannot log in with a password
  ✗ MEDIUM    SSH accepts passwords
              Once your key works, set PasswordAuthentication no
  ✗ LOW       MaxAuthTries is 6: too many attempts per connection
              Set MaxAuthTries 3
  ✗ LOW       SSH on port 22, the first one bots try
              A high port (Port 2222) cuts the noise; open it in the firewall first

Firewall
  ✗ HIGH      No firewall active on the server
              sudo ufw allow OpenSSH && sudo ufw enable (ignore this if your provider filters traffic)
  ✗ HIGH      Nothing blocks brute-force attacks (no Fail2ban or CrowdSec)
              sudo apt install fail2ban and enable the sshd jail

Services beyond localhost
  ✓           No database or insecure service exposed
              Listening beyond localhost: 22

Updates
  ✗ HIGH      4 security updates pending (12 in total)
              sudo apt update && sudo apt upgrade
  ✓           Security patches install automatically

Accounts and permissions
  ✓           Only root has UID 0
  ✓           /etc/shadow protected

Score: 44/100 (D)   critical: 0 · high: 3 · medium: 1 · low: 2

How the score works

It starts at 100 and each issue subtracts by severity: critical 30, high 15, medium 7 and low 2. An A is 90 and up, a B from 75, a C from 60, a D from 40, and anything below is an F.

The rules and their severity are the ones FerroSentry uses, our open-source agent that runs them every hour on servers connected to SecuryBlack.

Frequently asked questions

Is it safe to run a script with sudo?

This one only reads: it installs no packages, changes no files and opens no network connections. Still, the rule is a good one: never run anything with sudo that you have not read. That is why you can download it and review it first.

Does it work without root?

Yes, but it skips the firewall and reads the SSH configuration from the files instead of the effective one. It tells you how many checks it skipped.

Which distributions does it support?

Any Linux with sh. Updates are checked on Debian and Ubuntu (apt) and on Fedora, RHEL and derivatives (dnf).

This is a snapshot. FerroSentry watches it every hour

Connect your server and FerroSentry repeats these checks every hour, and more: file integrity, persistence, processes and certificates. It alerts you when something changes and you apply the fixes with one click from the panel. Free during the beta.

Connect my server for free See all tools