VPS checkup

Confirm scope

Obtain the SSH target, required public services and ports, expected workloads, and whether passwordless sudo is available. Treat the audit as read-only. apt update changes package indexes and requires explicit approval even during a read-only checkup.

Do not request or expose private keys, tokens, environment values, or container secrets. Redact public output that includes credentials or sensitive hostnames.

Collect evidence

1. Record host identity, UTC/local time, uptime, OS, kernel, virtualization, load, memory, disk space, inode use, mounts, and failed services.
2. Inspect critical journal entries within a bounded time window; do not dump entire logs.
3. Inspect effective SSH configuration and listening sockets.
4. Detect the active firewall rather than assuming UFW: check UFW, nftables, then iptables as available. Compare exposure with the required port list.
5. Check fail2ban only if installed and report missing tooling as not installed, not as failure.
6. Inspect time synchronization, unattended upgrades, pending packages from current indexes, and reboot-required state. Label package results stale when apt update was not approved.
7. If Docker exists, inspect daemon/rootless mode, containers, health/restarts, resource snapshot, disk use, logging growth, image age, and Compose projects. Skip Docker sections when absent.
8. Record whether backups exist and their last successful evidence when discoverable; do not trigger a backup or restore test without approval.