Security audit
A hardening score per server and for the fleet, the findings ranked by severity, the recipe or the copilot to fix each one, history, an alert when security degrades, and a PDF report.
A server's Security tab runs its configuration through a grid of checks: SSH, accounts, network, updates, system. It turns them into a score out of 100, the list of what is left to fix, and a way to fix each finding.
The audit runs no command: it is computed from the facts the agent already reports. The agent re-reads those settings every 15 minutes — the tab shows when the next reading is due — and right after any successful command run from Servor: a fix made by a recipe or the copilot shows up within seconds.
Reading the result
- The score is the share of checks passed, weighted by severity (critical, high, medium, low). A warning counts for half. A failed critical check caps the score at 40: a Docker API open to the internet is enough to compromise the machine, however tidy the rest.
- The ring shows the split: passed, warnings, failed, not read.
- Coverage is the share of checks that could be read. A check that was not read never counts as passed: it simply stays out of the score.
Why are some checks not read?
Several reads need root (the effective SSH configuration, the sudoers, /etc/shadow). The
agent installed by Servor runs as root; if some checks stay unread, update the agent —
older versions do not report these facts yet.
The checks
| Area | Checks |
|---|---|
| SSH | root login, password logins, empty passwords, attempts per connection, X11 forwarding, brute-force protection (fail2ban or CrowdSec) |
| Accounts | accounts without a password, hidden root accounts (uid 0 under another name), NOPASSWD sudo rules |
| Network | active firewall, exposed Docker API, databases on a public address, unexpected ports open to the network |
| Updates | pending security fixes, automatic updates, pending reboot |
| System | TLS certificates close to expiry, memory randomisation (ASLR), time sync |
| Docker | privileged containers, Docker socket mounted in a container, containers on the host network, published ports that bypass ufw or firewalld |
| Databases | PostgreSQL letting a remote client in without a password (trust), Redis without a password |
| Web server (nginx, Apache) | disclosed version, old TLS versions accepted, missing HSTS header |
The Docker, database and web server checks only appear on machines where that software runs.
Fixing
One finding at a time
Each finding offers a recipe when one exists (harden SSH, install fail2ban, firewall baseline, automatic updates), otherwise the copilot, which opens with the problem already described.
Several at once
Tick the findings you want, then Fix with the copilot: it gets the list and works through it one by one.
Check
Either way, every command takes the usual path: you approve it, your browser signs it, the agent runs it. The audit updates on the next report.
Fixing needs the member role at least; a viewer can read the audit without running anything.
Tracking over time
Below the findings, a chart shows the score day by day over 30, 90 or 365 days: one point per day, the last score computed that day. History is kept for a year.
Getting alerted when security degrades
When a check that used to pass starts failing — the firewall turned off, SSH open to passwords again, a database published to the internet — Servor raises the Security degraded alert. It lands in the bell with the score before and after, and a click opens the server's Security tab or the pre-filled copilot. To get it by email, Slack or another channel too, add the Security degraded trigger to an alert rule.
Only medium-severity checks and above raise the alert. A check read for the first time (after an agent update, for instance) does not: that is not a degradation.
Fleet view
Fleet security, in the server column, brings every machine's audit together: the average score, how servers split between solid, needs work and exposed, the total findings per severity, and the servers ranked from most exposed to most solid. Each row opens that server's Security tab. Each server's score also shows next to its name in the column.
Exporting a PDF
Export PDF opens the report in a new tab and starts printing: choose Save as PDF. The report includes the score, the coverage and every check, passed ones included. It is produced by your browser; nothing is generated or stored on Servor's side.
The audit covers Linux servers for now.