[opensourcedex]

vps-audit is a free, open source orchestration & scheduling project written in Shell and released under MIT. It has 3,120 GitHub stars, 305 forks and 12 open issues, and was last pushed 1 months ago. On this registry it ranks #38 of 64 tracked projects in Orchestration & Scheduling, with 5 head-to-head comparisons available. It gained 6 stars over the last 3 tracked days.

What is vps-audit?

What it is

vps-audit is a lightweight, dependency-free bash script for security, performance auditing and infrastructure monitoring of Linux servers. It lives in the Linux server administration and DevOps ecosystem, and its topics include bash, debian, devops, ec2, infrastructure, linux, monitoring, performance-monitoring, security, and ci-cd. The project is distributed as a Shell script under the MIT license, and the repository is described as a Nuver Labs project.

The concrete problem it solves is the need to inspect a VPS for common configuration and resource issues using a Bash script. The script checks SSH settings, firewall state, intrusion-prevention configuration, failed logins, updates, services, open ports, sudo logging, password policy, SUID files, disk, memory, CPU, and active internet connections. It then prints color-coded results and writes a timestamped report file with recommendations. The checks run on Ubuntu/Debian systems with root or sudo privileges.

Key capabilities

  • It audits SSH root login status, password authentication, and non-default port usage.
  • It checks firewall status for UFW, firewalld, iptables, and nftables, and intrusion-prevention configuration for Fail2ban and CrowdSec.
  • It detects failed login attempts, open ports, running services, SUID files, and sudo logging configuration.
  • It evaluates password policy enforcement through pwquality.conf, including a minimum length threshold.
  • It monitors disk space, memory usage, CPU usage, and active internet connections.
  • It generates a detailed report file named vps-audit-report-[TIMESTAMP].txt with results, recommendations, resource statistics, and an audit timestamp.
  • It exposes configuration variables for thresholds, report directory, report ownership, and chown behavior.

Who uses it and how

  • Administrators run it manually on an Ubuntu/Debian VPS with sudo ./vps-audit.sh to review the console output in real time.
  • Operators use the generated report file as a record of the audit, with failed checks accompanied by specific recommendations.
  • The topic list includes ci-cd and ec2, which places the project in automated pipeline and cloud virtual machine contexts, although the README does not provide a pipeline example.
  • DevOps users can adjust thresholds such as RESOURCE_WARN, RESOURCE_FAIL, SERVICES_WARN, LOGINS_WARN, and OPEN_PORTS_WARN before running the script.

Getting started

Download the script with wget or curl, make it executable with chmod +x vps-audit.sh, and run it with sudo ./vps-audit.sh.

When to use it — and when not to

Use it when a Linux VPS needs a script-based audit and report, and when the operator already has Ubuntu/Debian, root or sudo access, and basic packages such as ufw, systemd, netstat or ss, grep, and awk. Do not expect a database, SMTP integration, dashboard, or continuous monitoring service, because the README describes an on-demand script and report file, not a running monitoring platform. The script is also limited by its stated platform requirements and by the absence of a documented hosted option or CI/CD example.

project readme (upstream, from github) — read inline

VPS Security Audit Script

A comprehensive Bash script for auditing the security and performance of your VPS (Virtual Private Server). This tool performs various security checks and provides a detailed report with recommendations for improvements.

nuverlabs.com/vps-audit · a Nuver Labs project

Sample Output

Features

Security Checks

  • SSH Configuration   - Root login status   - Password authentication   - Non-default port usage
  • Firewall Status (UFW/firewalld/iptables/nftables)
  • Intrusion Prevention (Fail2ban/CrowdSec) Configuration
    • Fail2ban SSH jail port alignment (catches bans that silently do nothing)
  • Failed Login Attempts
  • System Updates Status
  • Running Services Analysis
  • Open Ports Detection
  • Sudo Logging Configuration
  • Password Policy Enforcement (via pwquality.conf)
  • SUID Files Detection

Performance Monitoring

  • Disk Space Usage
  • Memory Usage
  • CPU Usage
  • Active Internet Connections

Requirements

  • Ubuntu/Debian-based Linux system
  • Root access or sudo privileges
  • Basic packages (most are pre-installed):
    • ufw
    • systemd
    • netstat/ss
    • grep
    • awk

Installation

  1. Download the script:
wget https://raw.githubusercontent.com/Nuver-Labs/vps-audit/main/vps-audit.sh
# or
curl -O https://raw.githubusercontent.com/Nuver-Labs/vps-audit/main/vps-audit.sh
  1. Make the script executable:
chmod +x vps-audit.sh

Usage

Run the script with sudo privileges:

sudo ./vps-audit.sh

The script will:

  1. Perform all security checks
  2. Display results in real-time with color coding:
    • 🟢 [PASS] - Check passed successfully
    • 🟡 [WARN] - Potential issues detected
    • 🔴 [FAIL] - Critical issues found
  3. Generate a detailed report file: vps-audit-report-[TIMESTAMP].txt

Output Format

The script provides two types of output:

  1. Real-time console output with color coding:
[PASS] SSH Root Login - Root login is properly disabled in SSH configuration
[WARN] SSH Port - Using default port 22 - consider changing to a non-standard port
[FAIL] Firewall Status - UFW firewall is not active - your system is exposed
  1. A detailed report file containing:
    • All check results
    • Specific recommendations for failed checks
    • System resource usage statistics
    • Timestamp of the audit

Customization

The script's behavior, file paths, and scoring limits are fully controlled by variables defined in the Configuration section at the top of the script file.

1. Dynamic Thresholds for PASS/WARN/FAIL Status

These variables define the numerical limits that trigger a WARN or FAIL status.

Variable Default Value Check Description
RESOURCE_WARN 50 Resource Usage WARN if Disk/Memory/CPU usage is between 50-80%.
RESOURCE_FAIL 80 Resource Usage FAIL if Disk/Memory/CPU usage is more than 80%.
SERVICES_WARN 20 Running Services WARN if between 20-40 services are running.
SERVICES_FAIL 40 Running Services FAIL if more than 40 services are running.
LOGINS_WARN 10 Failed Logins WARN if between 10-50 failed login attempts are detected.
LOGINS_FAIL 50 Failed Logins FAIL if more than 50 failed login attempts are detected.
OPEN_PORTS_WARN 10 Open Ports WARN if between 10-20 listening ports are found.
OPEN_PORTS_FAIL 20 Open Ports FAIL if more than 20 listening ports are found.
PASSWORD_MINLEN 12 Password Policy PASS if minlen in pwquality.conf is at least this value.

2. Report Output and Ownership

These variables control where the report is saved and the file permissions.

Variable Default Value Description
DEFAULT_REPORT_DIR . (The current directory) The directory where the report file will be saved.
ENABLE_CHOWN false If true, sets ownership of the report file and (if newly created) the report directory to REPORT_CHOWN_OWNER.
REPORT_CHOWN_OWNER ${SUDO_USER:-$(id -un)}: The target user:group for chown. Defaults to the user who invoked sudo, so reports are not left owned by root.
REPORT_FILENAME vps-audit-report-$(TIMESTAMP).txt The template name for the generated report file.

3. Security Check File Paths

You can adjust the paths the script uses to check critical configuration files:

Variable Default Value Description
OS_RELEASE_FILE /etc/os-release Path to the Operating System release file.
REBOOT_REQUIRED_FILE /var/run/reboot-required File indicating a system restart is needed.
SSH_CONFIG_FILE /etc/ssh/sshd_config Main SSH daemon configuration file.
AUTH_LOG_FILE /var/log/auth.log Log file checked for failed login attempts.
SUDOERS_FILE /etc/sudoers File checked for sudo logging configuration.
PASSWORD_QUALITY_CONF /etc/security/pwquality.conf Password complexity policy configuration file.
FAIL2BAN_CONFIG_DIR /etc/fail2ban Fail2ban config directory, read to verify the SSH jail port.

Best Practices

  1. Run the audit regularly (e.g., weekly) to maintain security
  2. Review the generated report thoroughly
  3. Address any FAIL status immediately
  4. Investigate WARN status during maintenance
  5. Keep the script updated with your security policies

Limitations

  • Designed for Debian/Ubuntu-based systems
  • Requires root/sudo access
  • Some checks may need customization for specific environments
  • Not a replacement for professional security audit

Contributing

Feel free to submit issues and enhancement requests!

License

This project is licensed under the MIT License - see the LICENSE file for details.

About

vps-audit is built and maintained by Nuver Labs.

Security Notice

While this script helps identify common security issues, it should not be your only security measure. Always:

  • Keep your system updated
  • Monitor logs regularly
  • Follow security best practices
  • Consider professional security audits for critical systems

Support

For support, please:

  1. Check the existing issues
  2. Create a new issue with detailed information
  3. Provide the output of the script and your system information

Stay secure! 🔒

Frequently asked questions

Is vps-audit free to use?

vps-audit is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does vps-audit do?

lightweight, dependency-free bash script for security, performance auditing and infrastructure monitoring of Linux servers.

What is vps-audit written in?

vps-audit is primarily written in Shell. Its source is publicly available at https://github.com/nuver-labs/vps-audit, and it has 3,120 GitHub stars.