03Security assessments
Your server's state, with evidence for every item.
Hardening, vulnerabilities, malware and open ports, read by the agent and shown as they are. Read-only: nothing on the server is changed.
coverage
36/36
passed
34
grade
B
waiting for full coverage
Permissions · 8
- /etc/shadow
- /etc/passwd
- sshd_config
- authorized_keys
- /etc/group
- /etc/gshadow
- /root
- /etc/crontab
SSH · 12
- PermitRootLogin
- PasswordAuthentication
- PermitEmptyPasswords
- X11Forwarding
- StrictModes
- PubkeyAuthentication
- HostbasedAuthentication
- IgnoreRhosts
- PermitUserEnvironment
- MaxAuthTries
- LoginGraceTime
- MaxSessions
Kernel and filesystem · 8
- randomize_va_space
- dmesg_restrict
- kptr_restrict
- ptrace_scope
- suid_dumpable
- protected_hardlinks
- protected_symlinks
- protected_fifos
IPv4 network · 8
- tcp_syncookies
- all.accept_redirects
- all.send_redirects
- all.accept_source_route
- default.accept_redirects
- default.send_redirects
- default.accept_source_route
- log_martians
01Hardening
36 checks. A grade only with full coverage.
Permissions on sensitive files, sshd directives, kernel and IPv4 stack parameters. Each item comes with the evidence that was read. If the agent couldn't check one of them, the A–F grade doesn't appear: a grade with gaps would be a made-up number.
- 8
Permissions and owners
/etc/shadow, /etc/passwd, sshd_config, root's authorized_keys, /etc/crontab…
- 12
SSH
PermitRootLogin, PasswordAuthentication, MaxAuthTries, LoginGraceTime…
- 8
Kernel and filesystem
ASLR, dmesg_restrict, kptr_restrict, ptrace_scope, protected links…
- 8
IPv4 network
SYN cookies, redirects, source routing, martian packet logging.
02Vulnerabilities
A CVE inventory, with context.
The agent lists system packages (Ubuntu, Debian, Alpine) and npm and PyPI manifests. Matching is done against OSV; when available, each CVE gets NVD's CVSS score, CISA's KEV catalog flag and EPSS's exploitation probability.
| Package | Version | CVE | CVSS | EPSS | KEV |
|---|---|---|---|---|---|
| openssh-server | 1:9.6p1-3ubuntu13 | CVE-2024-6387 | 8.1 | — | — |
| libxml2 | 2.9.14+dfsg-1.3 | CVE-2024-25062 | 7.5 | — | — |
| lodash (npm) | 4.17.20 | CVE-2021-23337 | 7.2 | — | — |
Sample rows. OSV · NVD · CISA KEV · FIRST EPSS.
03Malware · Pro
Weekly scan. No file leaves the server.
The dashboard distributes the YARA engine, YARA-Forge rules and recent MalwareBazaar hashes. The scan runs on the server once a week, and you can also start one on demand. Quarantine and restore are manual.
- YARA rules from 15 repositories
- 2,917
- hashes of recent samples, up to
- 65,536
- hours between hash updates
- 6 h
Weekly scan
0 findings/var/www18,204 files read
/home/*/public_html6,912 files read
/tmp · /var/tmp · /dev/shm341 files read
no file content leaves the server
04Exposed services
What is listening, and for whom.
The list of listening TCP ports, with process and address. A database listening on all interfaces gets flagged.
- 22sshd · 0.0.0.0
- 80nginx · 0.0.0.0
- 443nginx · 0.0.0.0
- 3306mysqld · 0.0.0.0exposed
- 6379redis-server · 127.0.0.1local
- 5432postgres · 127.0.0.1local
Founders program
Use atalince from the start.
Pro features for up to 3 servers, free of charge, for 12 months. Every application is reviewed by the team.