DEV Community

Hive80-lab
Hive80-lab

Posted on

The 5-Minute Security Audit: What I Check on Every New Server

#security #devops #python #smallbusiness

The 5-Minute Security Audit: What I Check on Every New Server

You don't need a 50-page compliance document to secure a server. You need 5 minutes and a checklist.

After managing infrastructure for 8 years, I've whittled my initial security audit down to 7 checks that catch 90% of common vulnerabilities. Here's exactly what I run on every new server before it goes live.

The 7-Check Audit

Check 1: SSH Key-Only Authentication (30 seconds) 

# Verify password auth is disabled
grep -E '^PasswordAuthentication' /etc/ssh/sshd_config
# Should show: PasswordAuthentication no

# Verify root login is disabled
grep -E '^PermitRootLogin' /etc/ssh/sshd_config
# Should show: PermitRootLogin no
Enter fullscreen mode Exit fullscreen mode

If either is set to yes, you're one brute-force attack away from a breach. Fix it immediately:

sudo sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

Check 2: Firewall Status (30 seconds) 

# Check if firewall is active
sudo ufw status
# Or for firewalld:
sudo firewall-cmd --state
Enter fullscreen mode Exit fullscreen mode

If no firewall is running, you're exposing every service to the internet. Minimum rules:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH
sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

Check 3: Unnecessary Services (60 seconds) 

# List all listening services
sudo ss -tlnp
Enter fullscreen mode Exit fullscreen mode

Look for anything you don't recognize. Common offenders:

  • rpcbind (NFS — disable if not needed)
  • avahi-daemon (mDNS — disable on servers)
  • cups (printing — disable on servers) 
sudo systemctl disable --now rpcbind avahi-daemon cups 2>/dev/null
Enter fullscreen mode Exit fullscreen mode

Check 4: Automatic Updates (30 seconds) 

# Check if unattended-upgrades is configured
cat /etc/apt/apt.conf.d/50unattended-upgrades | grep -A5 'Allowed-Origins'
Enter fullscreen mode Exit fullscreen mode

If not configured:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades
Enter fullscreen mode Exit fullscreen mode

Security patches that install themselves while you sleep are worth their weight in gold.

Check 5: Fail2Ban or Equivalent (30 seconds) 

sudo fail2ban-client status
Enter fullscreen mode Exit fullscreen mode

If not installed:

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
Enter fullscreen mode Exit fullscreen mode

Fail2Ban blocks IPs after repeated failed login attempts. It's the single most effective tool against automated attacks.

Check 6: User Accounts and Sudo Access (60 seconds) 

# List all users with shell access
grep -E '/bin/(bash|sh|zsh)' /etc/passwd

# Check sudo group members
getent group sudo
Enter fullscreen mode Exit fullscreen mode

Remove any accounts that shouldn't exist. Audit sudo access — every sudo user is a potential attack vector.

Check 7: Open Ports Scan (60 seconds) 

# Scan from outside (use nmap from another machine)
nmap -sS -p- YOUR_SERVER_IP
Enter fullscreen mode Exit fullscreen mode

Or use an online scanner. Every open port is a door. Close the ones you're not using.

The Audit in One Script 

#!/bin/bash
echo "=== 5-Minute Security Audit ==="
echo ""
echo "1. SSH Config:"
grep -E '^(PasswordAuthentication|PermitRootLogin)' /etc/ssh/sshd_config
echo ""
echo "2. Firewall:"
sudo ufw status 2>/dev/null || sudo firewall-cmd --state 2>/dev/null
echo ""
echo "3. Listening Services:"
sudo ss -tlnp | grep LISTEN
echo ""
echo "4. Unattended Upgrades:"
dpkg -l unattended-upgrades 2>/dev/null | grep -E '^ii'
echo ""
echo "5. Fail2Ban:"
sudo fail2ban-client status 2>/dev/null || echo 'NOT INSTALLED'
echo ""
echo "6. Shell Users:"
grep -E '/bin/(bash|sh|zsh)' /etc/passwd
echo ""
echo "=== Audit Complete ==="
Enter fullscreen mode Exit fullscreen mode

What This Audit Catches

In my experience, this 5-minute audit catches:

  • 60% of servers have password auth enabled on first check
  • 40% of servers have no firewall configured
  • 30% of servers have unnecessary services running
  • 20% of servers have stale user accounts

What It Doesn't Catch

This is a quick audit, not a full security review. It won't find:

  • Application-level vulnerabilities (SQL injection, XSS)
  • Misconfigured TLS certificates
  • Outdated package versions with known CVEs
  • Insider threats or compromised credentials

For those, you need a deeper audit — but that's a separate article.

Want the complete security audit checklist with remediation scripts? I've compiled everything into a Security Audit Toolkit — includes the 5-minute audit, a full 50-point checklist, and automated remediation scripts.

What's the first thing you check on a new server?

Top comments (0)