Scantide Linux Local Check

Local Linux script	0.54	Online Linux script	0.54
Minimum recommended Linux script	0.54	Released	2026-06-22
Feed URL	https://www.example.com/helpfiles/ScantideLAN-version.json

Item	Value
url	https://www.example.com/remediation_api.php
http_status	200
status	ok
message	Authenticated remediation guidance loaded.
guidance_items_returned	14
requested	14
returned	14
missing	0
duration_ms	4

Executive Overview

Quick triage summary. Start here, then use Quick Actions and Executive Findings for the practical work.

Findings

Executive findings

Quick Actions

Prioritized remediation steps

Updates

0 security | reboot: Yes

System Overview

Host	linux-host-001	Distro	Ubuntu 24.04.4 LTS
Kernel	6.8.0-124-generic	Architecture	x86_64
Root	Yes	Deep scan	false
Platform	VMware Virtual Machine	Primary role	Likely SaaS / Web Platform (High)
Script version	0.54	Version feed status	Current

Scantide Version Check

The Linux local check reuses the Scantide Auditor version feed. If the shared feed later exposes linuxLocalCheckUrl and a SHA256 value, the Linux runner can use those fields for safe update/download workflows.

Item	Value
status	Current
message	The installed Scantide Auditor Linux script matches the online Linux version feed.
localLinuxScriptVersion	0.54
onlineLinuxScriptVersion	0.54
minimumRecommendedLinuxScriptVersion	0.54
released	2026-06-22
linuxLocalCheckUrl	https://www.example.com/helpfiles/linux-host-001-linux-localcheck.sh
versionFeedUrl	https://www.example.com/helpfiles/ScantideLAN-version.json

Quick Actions

Top actions are generated from high/medium local findings and lifecycle review items. Cards expand with authenticated remediation guidance when available.

UFW is inactive

Priority 3 Remediation ID: FIREWALL_UFW_INACTIVE

Reason

Enable UFW or verify that an upstream firewall intentionally provides filtering.

Practical remediation guidance

Recommendation ID	FIREWALL_UFW_INACTIVE	Difficulty	Moderate
Estimated time	15 minutes	Restart	No reboot
Why it matters	A disabled host firewall increases reliance on upstream network controls.
Recommended fix	Enable UFW/firewalld/nftables or document that filtering is intentionally handled upstream.

Suggested commands to review:

sudo apt-get install ufw
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Verify:

sudo ufw status verbose || sudo firewall-cmd --state || sudo nft list ruleset

References:
https://help.ubuntu.com/community/UFW
https://firewalld.org/documentation/

iptables INPUT policy is ACCEPT

Priority 3 Remediation ID: FIREWALL_INPUT_ACCEPT

Reason

Use explicit firewall policy or document external firewall dependency.

Practical remediation guidance

Recommendation ID	FIREWALL_INPUT_ACCEPT	Difficulty	Moderate
Estimated time	20 minutes	Restart	No reboot
Why it matters	Default ACCEPT policy may allow unexpected inbound traffic if no other filtering exists.
Recommended fix	Use explicit allow rules and default deny where practical, or document upstream firewall dependency.

Suggested commands to review:

sudo iptables -S
sudo nft list ruleset
# Apply changes carefully; avoid locking yourself out.

Verify:

sudo iptables -L -n -v
sudo nft list ruleset

References:
https://wiki.nftables.org/

SSH root login is enabled

Priority 2 Remediation ID: SSH_ROOT_LOGIN

Reason

Set PermitRootLogin no and use named admin accounts with sudo.

Practical remediation guidance

Recommendation ID	SSH_ROOT_LOGIN	Difficulty	Easy
Estimated time	5 minutes	Restart	Restart SSH
Why it matters	Direct root SSH login increases the impact of stolen or guessed credentials because the attacker immediately lands as root.
Recommended fix	Set PermitRootLogin no and use named administrator accounts with sudo.

Suggested commands to review:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

Verify:

sudo sshd -T | grep permitrootlogin

References:
https://man.openbsd.org/sshd_config

SSH password authentication is enabled

Priority 3 Remediation ID: SSH_PASSWORD_AUTH

Reason

Prefer SSH keys and set PasswordAuthentication no where practical.

Practical remediation guidance

Recommendation ID	SSH_PASSWORD_AUTH	Difficulty	Moderate
Estimated time	15 minutes	Restart	Restart SSH
Why it matters	Password authentication increases exposure to brute force and credential reuse attacks.
Recommended fix	Deploy SSH keys first, then set PasswordAuthentication no.

Suggested commands to review:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

Verify:

sudo sshd -T | grep passwordauthentication

References:
https://man.openbsd.org/sshd_config

Redis protected-mode is not clearly enabled

Priority 2 Remediation ID: REDIS_PROTECTED_MODE

Reason

Enable protected-mode and restrict bind/listen addresses.

Practical remediation guidance

Recommendation ID	REDIS_PROTECTED_MODE	Difficulty	Moderate
Estimated time	15 minutes	Restart	Restart Redis
Why it matters	Redis exposed without protected mode can lead to data exposure or remote abuse.
Recommended fix	Enable protected-mode and bind Redis only to required addresses.

Suggested commands to review:

sudo cp /etc/redis/redis.conf /etc/redis/redis.conf.bak
sudo sed -i 's/^protected-mode .*/protected-mode yes/' /etc/redis/redis.conf
sudo systemctl restart redis-server || sudo systemctl restart redis

Verify:

redis-cli CONFIG GET protected-mode
ss -ltnp | grep 6379

References:
https://redis.io/docs/latest/operate/oss_and_stack/management/security/

Redis authentication is not clearly configured

Priority 3 Remediation ID: REDIS_AUTH

Reason

Configure Redis ACLs/authentication and limit network exposure.

Practical remediation guidance

Recommendation ID	REDIS_AUTH	Difficulty	Moderate
Estimated time	20 minutes	Restart	Restart Redis
Why it matters	Redis without authentication relies entirely on network isolation.
Recommended fix	Use Redis ACLs/authentication and restrict network exposure.

Suggested commands to review:

# Prefer ACLs for Redis 6+
sudo grep -E '^(requirepass|aclfile|user )' /etc/redis/redis.conf
# Configure ACLs carefully before restart

Verify:

redis-cli ACL LIST
redis-cli CONFIG GET requirepass

References:
https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/

Root account password appears enabled

Priority 3 Remediation ID: ACCOUNTS_ROOT_PASSWORD_ENABLED

Reason

Prefer locked root password and sudo-based administration where practical.

Practical remediation guidance

Recommendation ID	ACCOUNTS_ROOT_PASSWORD_ENABLED	Difficulty	Moderate
Estimated time	10 minutes	Restart	No reboot
Why it matters	An enabled root password can increase brute-force and shared-secret risk.
Recommended fix	Prefer sudo-based administration and lock the root password where operationally safe.

Suggested commands to review:

sudo passwd -S root
sudo passwd -l root

Verify:

sudo passwd -S root

References:
https://ubuntu.com/server/docs/user-management

Passwordless sudo entries found

Priority 3 Remediation ID: SUDO_NOPASSWD

Reason

Review lifecycle for VMware Tools 13.0.0.0

Priority 4 Remediation ID: VMWARE_TOOLS_UPDATE

Reason

Keep VMware Tools/open-vm-tools updated through VMware/Broadcom packages or the Linux distribution package channel. Treat guest tools as platform support software, not as the server's primary role.

Review lifecycle for Perl 5.38.2

Priority 4 Remediation ID: LIFECYCLE_REVIEW

Reason

Review vendor release notes and update policy before upgrading. Community latest observed is a signal, not vendor proof.

Likely Server Role Detection

Roles are inferred from detected application/network services and boosted by listening-port evidence. Virtualization/guest tools are shown as platform context, not as the server's primary business role.

Likely role	Confidence	Evidence
Likely SaaS / Web Platform	High	Combined application stack detected: web server + PHP + supporting service such as Redis/HAProxy/Postfix.
Proxy / Cache / Load Balancer	High	Detected proxy/load-balancer components: Squid; HAProxy; Ports: TCP/80 listening; TCP/443 listening; TCP/3128 listening;
Web / Application Server	High	Detected web/runtime components: Apache HTTP Server; PHP; Ports: TCP/80 listening; TCP/443 listening;
Database / Cache Server	High	Detected data services: Redis; Ports: TCP/6379 listening;
DNS / DHCP Server	High	Detected DNS/DHCP components: dnsmasq; Ports: TCP/53 listening;
Mail Server	High	Detected mail components: Postfix; Ports: TCP/25 listening;
VPN Server	Medium	Detected VPN components: OpenVPN;

Platform / Virtualization

Shows whether this appears to be a physical server, VM, container or guest system. VMware Tools/open-vm-tools is also included in software inventory when detected.

platform_label	VMware Virtual Machine
virtualization	vmware
evidence	systemd-detect-virt=vmware; VMware Tools/open-vm-tools detected: 13.0.0.0 (build-24696409)

Services Summary

Summarizes detected service categories so the report quickly explains what the server appears to do.

Category	Count	Meaning
Web/Application	2	Web servers, PHP/runtime or web admin apps.
Mail	1	SMTP/IMAP/POP components.
Database/Cache	1	Databases, caches and message/search services.
Proxy/Load Balancer	2	Proxy, cache or load-balancing components.
DNS/DHCP	1	Network name/addressing services.
VPN	1	VPN/tunnel components.
Security/Monitoring	2	Security agents and local monitoring components.
Containers	0	Container runtime/orchestration components.
Admin/Monitoring UI	0	Web or agent-based admin/monitoring tools.
Virtualization/Guest Tools	1	Hypervisor, virtualization or guest-agent tooling.

Top Risks and Strengths

A short executive view before the technical evidence.

Top Risks

Redis protected-mode is not clearly enabled
Redis Hardening
SSH root login is enabled
SSH Hardening
Apache directory listing may be enabled
Web Stack
auditd not active
Audit/logging
CUPS listener detected
Dangerous Services

Top Strengths

Scanner is current
Local script matches Linux version feed
No EOL lifecycle items returned
Lifecycle API did not report end-of-support items
Some sensitive services are loopback-only
At least one listener is bound to loopback
Fail2ban detected
fail2ban-client present

What To Verify Manually

Items that need human confirmation because Linux distro backports, upstream firewalls and operational context can change the meaning.

Scantide Linux Security Score

The score is category-capped and explainable. See Security Score Categories for the full breakdown and caveats.

Scoring disclaimer: The Scantide Linux score is a triage indicator, not a compliance grade, breach prediction, or proof of vulnerability. The model is intentionally capped by category so one noisy area cannot force every server to zero. Always review the evidence, compensating controls, distro backports and business role before deciding remediation priority.

Overall score	35	Band	Poor

Category	Score	Penalty	Cap	Reason	Important caveat
SSH	10	18	20	SSH authentication and daemon hardening findings.	SSH risk depends on exposure, MFA, bastions, key policy and upstream firewalling.
Firewall / Exposure	10	18	20	Host firewall findings and listener exposure classification.	Local listener state does not prove internet exposure. Upstream firewalls, cloud security groups and routing must be verified.
Identity / Sudo	20	12	15	Root, service-account and sudo posture findings.	Administrative exceptions may be intentional; review against documented operating procedure.
Updates / Reboot	60	6	15	Pending update, security update and reboot-required posture.	Package update counts are distro-tool output and can be affected by stale repositories or pinned packages.
Kernel / sysctl	0	15	15	Kernel, network and sysctl hardening findings.	Some sysctl values are role-dependent; routers, VPN gateways and appliances can need different settings.
Audit / Logging / LSM	20	12	15	auditd, logging, AppArmor/SELinux and integrity-monitoring posture.	Tool absence is not proof of missing control if another logging or EDR platform provides equivalent coverage.
Web / Services	0	15	15	Web, Redis, websites and service-specific hardening findings.	Service checks are config-pattern based and should be confirmed against active runtime configuration.
CVE Review	100	0	15	CVE candidates returned by the Scantide CVE API.	Linux distributions commonly backport fixes. CVE candidates are review leads, not confirmed vulnerable proof.
Lifecycle	100	0	15	Lifecycle and update-available findings for OS, kernel and major services.	Lifecycle latest-version data can differ between vendor, distro and community-observed sources.

Score bands: 85-100 Excellent, 70-84 Good, 50-69 Needs attention, 30-49 Poor, below 30 Critical. These bands are advisory and should not replace judgement or formal compliance tooling.

System Information

CPU information

Architecture:                            x86_64
CPU op-mode(s):                          32-bit, 64-bit
Address sizes:                           45 bits physical, 48 bits virtual
Byte Order:                              Little Endian
CPU(s):                                  8
On-line CPU(s) list:                     0-7
Vendor ID:                               GenuineIntel
BIOS Vendor ID:                          GenuineIntel
Model name:                              Intel(R) Xeon(R) Silver 4110 CPU @ 2.10GHz
BIOS Model name:                         Intel(R) Xeon(R) Silver 4110 CPU @ 2.10GHz  CPU @ 2.1GHz
BIOS CPU family:                         2
CPU family:                              6
Model:                                   79
Thread(s) per core:                      1
Core(s) per socket:                      1
Socket(s):                               8
Stepping:                                0
BogoMIPS:                                4190.15
Flags:                                   fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon nopl xtopology tsc_reliable nonstop_tsc cpuid tsc_known_freq pni pclmulqdq vmx ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch cpuid_fault pti ssbd ibrs ibpb stibp tpr_shadow ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 invpcid rdseed adx smap xsaveopt arat vnmi md_clear flush_l1d arch_capabilities
Virtualization:                          VT-x
Hypervisor vendor:                       VMware
Virtualization type:                     full
L1d cache:                               256 KiB (8 instances)
L1i cache:                               256 KiB (8 instances)
L2 cache:                                8 MiB (8 instances)
L3 cache:                                88 MiB (8 instances)
NUMA node(s):                            1
NUMA node0 CPU(s):                       0-7
Vulnerability Gather data sampling:      Not affected
Vulnerability Indirect target selection: Mitigation; Aligned branch/return thunks
Vulnerability Itlb multihit:             KVM: Mitigation: VMX disabled
Vulnerability L1tf:                      Mitigation; PTE Inversion; VMX flush not necessary, SMT disabled
Vulnerability Mds:                       Mitigation; Clear CPU buffers; SMT Host state unknown
Vulnerability Meltdown:                  Mitigation; PTI
Vulnerability Mmio stale data:           Mitigation; Clear CPU buffers; SMT Host state unknown
Vulnerability Reg file data sampling:    Not affected
Vulnerability Retbleed:                  Mitigation; IBRS
Vulnerability Spec rstack overflow:      Not affected
Vulnerability Spec store bypass:         Mitigation; Speculative Store Bypass disabled via prctl
Vulnerability Spectre v1:                Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2:                Mitigation; IBRS; IBPB conditional; STIBP disabled; RSB filling; PBRSB-eIBRS Not affected; BHI SW loop, KVM SW loop
Vulnerability Srbds:                     Not affected
Vulnerability Tsa:                       Not affected
Vulnerability Tsx async abort:           Not affected
Vulnerability Vmscape:                   Not affected

Memory information

               total        used        free      shared  buff/cache   available
Mem:            31Gi       1.7Gi        23Gi        25Mi       6.2Gi        29Gi
Swap:          3.8Gi          0B       3.8Gi

Disk usage

Filesystem      Size  Used Avail Use% Mounted on
tmpfs           3.2G  2.9M  3.2G   1% /run
/dev/sda2       196G   23G  164G  12% /
tmpfs            16G  2.1M   16G   1% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           3.2G   96K  3.2G   1% /run/user/130
tmpfs           3.2G   80K  3.2G   1% /run/user/0

Executive Findings

Each finding is shown as a card with evidence, recommendation and authenticated remediation guidance when available.

area	item	reason
CVE	Confirm review-only CVE candidates against distro advisories	Linux distributions backport fixes and product-version matching can be noisy
Firewall	Verify upstream/cloud/firewall policy	Local firewall state alone does not prove external exposure
Backups	Verify restore tests	Tool presence or cron clues do not prove recoverability
Secrets	Review possible secret matches manually	Pattern matching can produce false positives

UFW is inactive

MediumFirewall Remediation ID: FIREWALL_UFW_INACTIVE

Evidence

Host firewall is not active according to ufw.

Recommendation

Enable UFW or verify that an upstream firewall intentionally provides filtering.

Practical remediation guidance

Recommendation ID	FIREWALL_UFW_INACTIVE	Difficulty	Moderate
Estimated time	15 minutes	Restart	No reboot
Why it matters	A disabled host firewall increases reliance on upstream network controls.
Recommended fix	Enable UFW/firewalld/nftables or document that filtering is intentionally handled upstream.

Suggested commands to review:

sudo apt-get install ufw
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Verify:

sudo ufw status verbose || sudo firewall-cmd --state || sudo nft list ruleset

References:
https://help.ubuntu.com/community/UFW
https://firewalld.org/documentation/

iptables INPUT policy is ACCEPT

MediumFirewall Remediation ID: FIREWALL_INPUT_ACCEPT

Evidence

Default INPUT policy accepts traffic.

Recommendation

Use explicit firewall policy or document external firewall dependency.

Practical remediation guidance

Recommendation ID	FIREWALL_INPUT_ACCEPT	Difficulty	Moderate
Estimated time	20 minutes	Restart	No reboot
Why it matters	Default ACCEPT policy may allow unexpected inbound traffic if no other filtering exists.
Recommended fix	Use explicit allow rules and default deny where practical, or document upstream firewall dependency.

Suggested commands to review:

sudo iptables -S
sudo nft list ruleset
# Apply changes carefully; avoid locking yourself out.

Verify:

sudo iptables -L -n -v
sudo nft list ruleset

References:
https://wiki.nftables.org/

SSH root login is enabled

HighSSH Hardening Remediation ID: SSH_ROOT_LOGIN

Evidence

PermitRootLogin yes

Recommendation

Set PermitRootLogin no and use named admin accounts with sudo.

Practical remediation guidance

Recommendation ID	SSH_ROOT_LOGIN	Difficulty	Easy
Estimated time	5 minutes	Restart	Restart SSH
Why it matters	Direct root SSH login increases the impact of stolen or guessed credentials because the attacker immediately lands as root.
Recommended fix	Set PermitRootLogin no and use named administrator accounts with sudo.

Suggested commands to review:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

Verify:

sudo sshd -T | grep permitrootlogin

References:
https://man.openbsd.org/sshd_config

SSH password authentication is enabled

MediumSSH Hardening Remediation ID: SSH_PASSWORD_AUTH

Evidence

PasswordAuthentication yes

Recommendation

Prefer SSH keys and set PasswordAuthentication no where practical.

Practical remediation guidance

Recommendation ID	SSH_PASSWORD_AUTH	Difficulty	Moderate
Estimated time	15 minutes	Restart	Restart SSH
Why it matters	Password authentication increases exposure to brute force and credential reuse attacks.
Recommended fix	Deploy SSH keys first, then set PasswordAuthentication no.

Suggested commands to review:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

Verify:

sudo sshd -T | grep passwordauthentication

References:
https://man.openbsd.org/sshd_config

Redis protected-mode is not clearly enabled

HighRedis Hardening Remediation ID: REDIS_PROTECTED_MODE

Evidence

protected-mode yes was not found.

Recommendation

Enable protected-mode and restrict bind/listen addresses.

Practical remediation guidance

Recommendation ID	REDIS_PROTECTED_MODE	Difficulty	Moderate
Estimated time	15 minutes	Restart	Restart Redis
Why it matters	Redis exposed without protected mode can lead to data exposure or remote abuse.
Recommended fix	Enable protected-mode and bind Redis only to required addresses.

Suggested commands to review:

sudo cp /etc/redis/redis.conf /etc/redis/redis.conf.bak
sudo sed -i 's/^protected-mode .*/protected-mode yes/' /etc/redis/redis.conf
sudo systemctl restart redis-server || sudo systemctl restart redis

Verify:

redis-cli CONFIG GET protected-mode
ss -ltnp | grep 6379

References:
https://redis.io/docs/latest/operate/oss_and_stack/management/security/

Redis authentication is not clearly configured

MediumRedis Hardening Remediation ID: REDIS_AUTH

Evidence

No requirepass or aclfile setting found in redis.conf highlights.

Recommendation

Configure Redis ACLs/authentication and limit network exposure.

Practical remediation guidance

Recommendation ID	REDIS_AUTH	Difficulty	Moderate
Estimated time	20 minutes	Restart	Restart Redis
Why it matters	Redis without authentication relies entirely on network isolation.
Recommended fix	Use Redis ACLs/authentication and restrict network exposure.

Suggested commands to review:

# Prefer ACLs for Redis 6+
sudo grep -E '^(requirepass|aclfile|user )' /etc/redis/redis.conf
# Configure ACLs carefully before restart

Verify:

redis-cli ACL LIST
redis-cli CONFIG GET requirepass

References:
https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/

Root account password appears enabled

MediumAccounts Remediation ID: ACCOUNTS_ROOT_PASSWORD_ENABLED

Evidence

passwd -S root reports password set

Recommendation

Prefer locked root password and sudo-based administration where practical.

Practical remediation guidance

Recommendation ID	ACCOUNTS_ROOT_PASSWORD_ENABLED	Difficulty	Moderate
Estimated time	10 minutes	Restart	No reboot
Why it matters	An enabled root password can increase brute-force and shared-secret risk.
Recommended fix	Prefer sudo-based administration and lock the root password where operationally safe.

Suggested commands to review:

sudo passwd -S root
sudo passwd -l root

Verify:

sudo passwd -S root

References:
https://ubuntu.com/server/docs/user-management

Passwordless sudo entries found

MediumSudo Remediation ID: SUDO_NOPASSWD

Evidence

/etc/sudoers.d/app-service:1:app-service ALL=(root) NOPASSWD: /opt/app-service/bin/reload.sh, /opt/app-service/bin/restart.sh, /opt/app-service/bin/cluster.sh, /opt/app-ui/bin/certmgr.py, /opt/app-ui/bin/cachemgr.py, /usr/bin/tail, /opt/app-ui/bin/timezone.py, /opt/app-ui/bin/hostname.py, /opt/app-ui/bin/resolve.py, /opt/app-ui/bin/netmgr.py, /opt/app-ui/bin/fsmgr.py, /opt/app-ui/bin/cronmgr.py, /opt/app-ui/bin/logrotatemgr.py, /opt/app-ui/bin/confmgr.py

Recommendation

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

net.ipv4.conf.default.accept_source_route is not hardened

MediumKernel/sysctl Remediation ID: SYSCTL_SOURCE_ROUTE

Evidence

Actual=1 Expected=0

Recommendation

Disable source-routed packets by default.

Practical remediation guidance

Recommendation ID	SYSCTL_SOURCE_ROUTE	Difficulty	Easy
Estimated time	5 minutes	Restart	No reboot
Why it matters	Source routing can be abused to bypass expected routing controls.
Recommended fix	Set accept_source_route to 0 for all/default interfaces.

Suggested commands to review:

printf '\nnet.ipv4.conf.all.accept_source_route=0\nnet.ipv4.conf.default.accept_source_route=0\n' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Verify:

sysctl net.ipv4.conf.all.accept_source_route net.ipv4.conf.default.accept_source_route

References:
https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html

net.ipv4.conf.all.accept_redirects is not hardened

MediumKernel/sysctl Remediation ID: SYSCTL_REDIRECTS

Evidence

Actual=1 Expected=0

Recommendation

Disable ICMP redirects.

Practical remediation guidance

Recommendation ID	SYSCTL_REDIRECTS	Difficulty	Easy
Estimated time	5 minutes	Restart	No reboot
Why it matters	ICMP redirects can alter host routing behavior unexpectedly.
Recommended fix	Disable accept_redirects and send_redirects unless explicitly needed.

Suggested commands to review:

printf '\nnet.ipv4.conf.all.accept_redirects=0\nnet.ipv4.conf.default.accept_redirects=0\nnet.ipv4.conf.all.send_redirects=0\nnet.ipv4.conf.default.send_redirects=0\n' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Verify:

sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.send_redirects

References:
https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html

net.ipv4.conf.default.accept_redirects is not hardened

MediumKernel/sysctl Remediation ID: SYSCTL_REDIRECTS

Evidence

Actual=1 Expected=0

Recommendation

Disable ICMP redirects by default.

Practical remediation guidance

Recommendation ID	SYSCTL_REDIRECTS	Difficulty	Easy
Estimated time	5 minutes	Restart	No reboot
Why it matters	ICMP redirects can alter host routing behavior unexpectedly.
Recommended fix	Disable accept_redirects and send_redirects unless explicitly needed.

Suggested commands to review:

printf '\nnet.ipv4.conf.all.accept_redirects=0\nnet.ipv4.conf.default.accept_redirects=0\nnet.ipv4.conf.all.send_redirects=0\nnet.ipv4.conf.default.send_redirects=0\n' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Verify:

sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.send_redirects

References:
https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html

net.ipv4.conf.all.send_redirects is not hardened

MediumKernel/sysctl Remediation ID: SYSCTL_REDIRECTS

Evidence

Actual=1 Expected=0

Recommendation

Disable sending redirects.

Practical remediation guidance

Recommendation ID	SYSCTL_REDIRECTS	Difficulty	Easy
Estimated time	5 minutes	Restart	No reboot
Why it matters	ICMP redirects can alter host routing behavior unexpectedly.
Recommended fix	Disable accept_redirects and send_redirects unless explicitly needed.

Suggested commands to review:

printf '\nnet.ipv4.conf.all.accept_redirects=0\nnet.ipv4.conf.default.accept_redirects=0\nnet.ipv4.conf.all.send_redirects=0\nnet.ipv4.conf.default.send_redirects=0\n' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Verify:

sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.send_redirects

References:
https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html

net.ipv4.conf.default.send_redirects is not hardened

MediumKernel/sysctl Remediation ID: SYSCTL_REDIRECTS

Evidence

Actual=1 Expected=0

Recommendation

Disable sending redirects by default.

Practical remediation guidance

Recommendation ID	SYSCTL_REDIRECTS	Difficulty	Easy
Estimated time	5 minutes	Restart	No reboot
Why it matters	ICMP redirects can alter host routing behavior unexpectedly.
Recommended fix	Disable accept_redirects and send_redirects unless explicitly needed.

Suggested commands to review:

printf '\nnet.ipv4.conf.all.accept_redirects=0\nnet.ipv4.conf.default.accept_redirects=0\nnet.ipv4.conf.all.send_redirects=0\nnet.ipv4.conf.default.send_redirects=0\n' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Verify:

sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.send_redirects

References:
https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html

fs.suid_dumpable is not hardened

MediumKernel/sysctl No remediation ID mapped

Evidence

Actual=2 Expected=0

Recommendation

Disable core dumps for SUID programs.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

kernel.sysrq is not hardened

LowKernel/sysctl Remediation ID: SYSCTL_SYSRQ

Evidence

Actual=176 Expected=0

Recommendation

Disable SysRq unless operationally required.

Practical remediation guidance

Recommendation ID	SYSCTL_SYSRQ	Difficulty	Easy
Estimated time	5 minutes	Restart	No reboot
Why it matters	Magic SysRq can trigger powerful kernel actions.
Recommended fix	Set kernel.sysrq=0 unless there is a documented support need.

Suggested commands to review:

echo 'kernel.sysrq=0' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Verify:

sysctl kernel.sysrq

References:
https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html

auditd not active

MediumAudit/logging Remediation ID: AUDITD_INACTIVE

Evidence

not-found/inactive

Recommendation

Enable auditd where local audit trail requirements apply.

Practical remediation guidance

Recommendation ID	AUDITD_INACTIVE	Difficulty	Moderate
Estimated time	20 minutes	Restart	Start service
Why it matters	auditd provides detailed local security event auditing.
Recommended fix	Install and enable auditd on servers requiring local audit trail coverage.

Suggested commands to review:

sudo apt-get install auditd audispd-plugins
sudo systemctl enable --now auditd

Verify:

systemctl status auditd
sudo auditctl -s

References:
https://linux.die.net/man/8/auditd

Reboot required

MediumUpdates Remediation ID: REBOOT_REQUIRED

Evidence

/var/run/reboot-required exists

Recommendation

Reboot during a maintenance window to activate pending kernel/library updates.

Practical remediation guidance

Recommendation ID	REBOOT_REQUIRED	Difficulty	Moderate
Estimated time	20 minutes	Restart	Reboot
Why it matters	Kernel and library updates often require a reboot or service restart to take effect.
Recommended fix	Schedule a maintenance window and reboot.

Suggested commands to review:

test -f /var/run/reboot-required && cat /var/run/reboot-required
sudo reboot

Verify:

test -f /var/run/reboot-required && echo reboot-required || echo no-reboot-required
uname -r

References:
https://ubuntu.com/server/docs/package-management

systemd failed units detected

MediumOperations Remediation ID: SYSTEMD_FAILED_UNITS

Evidence

4 failed unit(s): clamav-daemon.service,wsicapd.service wsmond.service,clamav-daemon.socket

Recommendation

Review failed units with systemctl --failed and journalctl -u <unit>.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Kernel lockdown mode is not active

LowKernel Security Remediation ID: KERNEL_LOCKDOWN

Evidence

[none] integrity confidentiality

Recommendation

Consider kernel lockdown on Secure Boot capable systems where compatible.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

CUPS listener detected

MediumDangerous Services Remediation ID: DANGEROUS_SERVICE

Evidence

port=631 listening

Recommendation

Disable if unused, or restrict exposure to trusted networks.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Avahi/mDNS service active

LowDangerous Services Remediation ID: DANGEROUS_SERVICE

Evidence

avahi-daemon active

Recommendation

Disable on servers unless service discovery is required.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Database/search service listens on all interfaces

MediumDatabase Security Remediation ID: EXPOSURE_ALL_INTERFACES

Evidence

port=6379 all-interface listener

Recommendation

Restrict bind address and firewall exposure.

Practical remediation guidance

Recommendation ID	EXPOSURE_ALL_INTERFACES	Difficulty	Moderate
Estimated time	20 minutes	Restart	Depends on service
Why it matters	Services bound to 0.0.0.0 or :: may be reachable from more networks than intended.
Recommended fix	Restrict service bind addresses or enforce firewall rules.

Suggested commands to review:

ss -ltnup
sudo nft list ruleset || sudo iptables -L -n -v

Verify:

ss -ltnup

References:
https://wiki.nftables.org/

PHP expose_php is enabled

LowWeb Application Remediation ID: WEB_APP_SECURITY_HEADERS

Evidence

expose_php=On

Recommendation

Set expose_php=Off.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

HSTS header not detected locally

LowWeb Application Remediation ID: WEB_APP_SECURITY_HEADERS

Evidence

port=80

Recommendation

Add HSTS where HTTPS is enforced and compatible.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

X-Frame-Options header not detected locally

LowWeb Application Remediation ID: WEB_APP_SECURITY_HEADERS

Evidence

port=80

Recommendation

Add X-Frame-Options or CSP frame-ancestors.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Enabled services not currently running

LowStartup Services Remediation ID: STARTUP_SERVICE_REVIEW

Evidence

anacron.service,bluetooth.service clamav-daemon.service,dmesg.service e2scrub_reap.service,getty@.service gpu-manager.service,grub-common.service grub-initrd-fallback.service,NetworkManager-dispatcher.service open-iscsi.service,pollinate.service rsync.service,secureboot-db.service snap.lxd.activate.service,snapd.autoimport.service snapd.core-fixup.service,snapd.recovery-chooser-trigger.service snapd.system-shutdown.service,ssl-cert.service

Recommendation

Review whether enabled services should be running or disabled.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Recent failed login records detected

LowLogin Activity Remediation ID: LOGIN_FAILURE_REVIEW

Evidence

7 recent lastb rows

Recommendation

Review authentication logs and brute-force controls.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/letsencrypt/archive/www.example.com/cert2.pem days_remaining=-101

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/letsencrypt/archive/www.example.com/cert1.pem days_remaining=-161

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/letsencrypt/archive/www.example.com/cert3.pem days_remaining=-41

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/letsencrypt/archive/www.example.com/fullchain1.pem days_remaining=-161

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/letsencrypt/archive/www.example.com/fullchain3.pem days_remaining=-41

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file expires soon

LowCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/letsencrypt/archive/www.example.com/fullchain4.pem days_remaining=18

Recommendation

Renew if the certificate is still in use.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file expires soon

LowCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/letsencrypt/archive/www.example.com/cert4.pem days_remaining=18

Recommendation

Renew if the certificate is still in use.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/letsencrypt/archive/www.example.com/fullchain2.pem days_remaining=-101

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/certs/SSLBackups/file.nokey.pem days_remaining=-552

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/certs/SSLBackups/file.withkey.pem days_remaining=-552

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/certs/SSLBackups/rCloud_HAproxy2024-12-17-New.pem days_remaining=-552

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/certs/SSLBackups/file.withkey-2021.pem days_remaining=-1251

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/certs/SSLBackups/rCloud.withkey.pem days_remaining=-1357

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/certs/SSLBackups/rCloud_HAproxy-2024-12-17.pem days_remaining=-552

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/certs/SSLBackups/rCloud.nokey.pem days_remaining=-1357

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/certs/rCloud_HAproxy.pem days_remaining=-187

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/etc/ssl/private/rCloud.crt days_remaining=-1357

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Local certificate file is expired

MediumCertificates Remediation ID: LOCAL_CERTIFICATE_REVIEW

Evidence

/opt/app-ui/var/temp/app-service_backup/etc/license.pem days_remaining=-1686

Recommendation

Renew or remove expired certificate file if unused.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Apache directory listing may be enabled

MediumWeb Stack Remediation ID: WEB_DIRECTORY_LISTING

Evidence

Options Indexes found

Recommendation

Disable Indexes unless intentionally required.

Practical remediation guidance

Recommendation ID	WEB_DIRECTORY_LISTING	Difficulty	Moderate
Estimated time	15 minutes	Restart	Reload web server
Why it matters	Directory listing can expose files that were not meant to be browsed.
Recommended fix	Remove Apache Options Indexes or nginx autoindex on unless intentionally required.

Suggested commands to review:

sudo grep -RInE 'Options .*Indexes|autoindex[[:space:]]+on' /etc/apache2 /etc/httpd /etc/nginx
# Edit matching vhost/location config, then reload web server.

Verify:

curl -I http://localhost/

References:
https://httpd.apache.org/docs/2.4/mod/core.html#options
https://nginx.org/en/docs/http/ngx_http_autoindex_module.html

Website is not clearly bound to SSL/TLS

MediumWeb Sites Remediation ID: WEB_SSL_MISSING

Evidence

apache site start.example.com config=/etc/apache2/sites-enabled/start.conf

Recommendation

Bind the site to HTTPS/443 and redirect HTTP to HTTPS where appropriate.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Website is not clearly bound to SSL/TLS

MediumWeb Sites Remediation ID: WEB_SSL_MISSING

Evidence

apache site default/unknown config=/etc/apache2/sites-enabled/app-service.conf

Recommendation

Bind the site to HTTPS/443 and redirect HTTP to HTTPS where appropriate.

Practical remediation guidance

No authenticated remediation guidance was returned for this finding yet. Basic recommendation is shown above.

Product	Version	Source
Linux kernel	6.8.0	uname -r
Apache HTTP Server	2.4.68	apache2 -v
PHP	8.3.6	php -v
OpenSSL	3.0.13	openssl version
OpenSSH	9.6	ssh -V
Postfix	3.8.6	postconf mail_version
Redis	8.8.0	redis-server --version
dnsmasq	2.90	dnsmasq --version
HAProxy	2.9.15	haproxy -v
Squid	6.14	squid -v
VMware Tools	13.0.0.0	vmware-toolbox-cmd -v
Python	3.12.3	python3 --version
Perl	5.38.2	perl version
OpenVPN	2.6.19	openvpn --version
Fail2ban	1.0.2	fail2ban-client version
ClamAV	1.4.4	clamscan --version

Product	Installed	Latest / observed latest	Status	Latest source	Confidence	Detail / note
Apache HTTP Server	2.4.68	2.4.68	current	Scantide community latest observed	medium	current
ClamAV	1.4.4	1.4.4	current	Scantide community latest observed	medium	current
dnsmasq	2.90	2.90	current	Scantide community latest observed	medium	current
Fail2ban	1.0.2	1.0.2	current	Scantide community latest observed	medium	current
Go	1.22.2	unknown	unknown	go version/runtime	local	Detected locally; no latest version returned or parsed.
HAProxy	2.9.15-1ppa1~focal	unknown	unknown	haproxy -v/service-runtime	local	Detected locally; no latest version returned or parsed.
HAProxy	2.9.15	2.9.15	current	Scantide community latest observed	medium	current
Linux kernel	6.8.0	6.8.0	current	Scantide community latest observed	medium	current
OpenSSH	9.6	9.6	current	Scantide community latest observed	medium	current
OpenSSL	3.0.13	3.0.13	current	Scantide community latest observed	medium	current
OpenVPN	2.6.19	2.6.19	current	Scantide community latest observed	medium	current
Perl	5.38.2	5.40.5	update_available	Scantide community latest observed	low	update_available
PHP	8.3.6	8.3.6	current	Scantide community latest observed	medium	current
pip	24.0	unknown	unknown	pip3 --version/runtime	local	Detected locally; no latest version returned or parsed.
Postfix	3.8.6	3.8.6	current	Scantide community latest observed	medium	current
Python	3.12.3	3.12.3	current	Scantide community latest observed	medium	current
Redis	8.8.0	8.8.0	current	Scantide community latest observed	medium	current
Squid	6.14	6.14	current	Scantide community latest observed	medium	current
Ubuntu	24.04	24.04	current	Scantide community latest observed	medium	current
VMware Tools	13.0.0.0	13.1.0	update_available	Broadcom VMware Tools build numbers and versions	high	update_available

Name	Version	Source	Type
Python	3.12.3	python3 --version	runtime
pip	24.0	pip3 --version	runtime
pip	24.0	pip --version	runtime
pip	24.0	python3 -m pip --version	runtime
PHP	8.3.6	php version	runtime
Go	1.22.2	go version	runtime
Apache HTTP Server	2.4.68	apache2 -v	service-runtime
Squid	6.14	squid -v	service-runtime
HAProxy	2.9.15-1ppa1~focal	haproxy -v	service-runtime
Redis	8.8.0	redis-server --version	service-runtime

Product	Version	CVE Review	Evidence status	Highest risk	Top CVEs / candidates	Scantide CVE
Linux kernel	6.8.0	UNKNOWN	Unmapped product: no reliable CVE product mapping was found for this banner. It may be proprietary, renamed, embedded, or device-specific. match_status=no_version_match	LOW 0	None	Review
Apache HTTP Server	2.4.68	REVIEW	Product recognized, but no confirmed CVE range/exact-version match was found for version 2.4.68. Other versions have 20 documented CVEs, so treat this as a review item rather than clean. match_status=no_version_match	LOW 0	None	Review
PHP	8.3.6	REVIEW	Product recognized, but version 8.3.6 was not listed in the CVE source and no reliable affected-version match was found. This is a data gap, not a clean result. match_status=no_version_match	LOW 0	None	Review
OpenSSL	3.0.13	REVIEW	Product recognized, but version 3.0.13 was not listed in the CVE source and no reliable affected-version match was found. This is a data gap, not a clean result. match_status=no_version_match	LOW 0	None	Review
OpenSSH	9.6	Review-only candidate (2)	Review only: service/version match needs distro advisory confirmation match_status=product_range_match	HIGH 8.1	CVE-2024-6387 (HIGH 8.1) CVE-2025-26466 (HIGH 7.5)	Review
Postfix	3.8.6	REVIEW	Product recognized, but version 3.8.6 was not listed in the CVE source and no reliable affected-version match was found. This is a data gap, not a clean result. match_status=no_version_match	LOW 0	None	Review
Redis	8.8.0	REVIEW	Product recognized, but version 8.8.0 was not listed in the CVE source and no reliable affected-version match was found. This is a data gap, not a clean result. match_status=no_version_match	LOW 0	None	Review
dnsmasq	2.90	Review-only candidate (1)	Review only: service/version match needs distro advisory confirmation match_status=product_range_match	CRITICAL 9.8	CVE-2017-14491 (CRITICAL 9.8)	Review
HAProxy	2.9.15	HIGH	Legacy/version review: exact version 2.9.15 was not matched, but this recognized product has 20 documented CVEs in other versions. Verify manually before treating as clean. match_status=no_version_match	LOW 0	None	Review
Squid	6.14	UNKNOWN	Unmapped product: no reliable CVE product mapping was found for this banner. It may be proprietary, renamed, embedded, or device-specific. match_status=no_version_match	LOW 0	None	Review
VMware Tools	13.0.0.0	UNKNOWN	Unmapped product: no reliable CVE product mapping was found for this banner. It may be proprietary, renamed, embedded, or device-specific. match_status=no_version_match	LOW 0	None	Review
Python	3.12.3	Review-only candidate (2)	Review only: service/version match needs distro advisory confirmation match_status=product_range_match	HIGH 7.5	CVE-2005-2491 (HIGH 7.5) CVE-2006-4980 (HIGH 7.5)	Review
Perl	5.38.2	Review-only candidate (2)	Review only: service/version match needs distro advisory confirmation match_status=exact_or_range_match	CRITICAL 10	CVE-1999-0509 (CRITICAL 10) CVE-1999-0150 (HIGH 7.5)	Review
OpenVPN	2.6.19	UNKNOWN	Unmapped product: no reliable CVE product mapping was found for this banner. It may be proprietary, renamed, embedded, or device-specific. match_status=no_version_match	LOW 0	None	Review
Fail2ban	1.0.2	UNKNOWN	Unmapped product: no reliable CVE product mapping was found for this banner. It may be proprietary, renamed, embedded, or device-specific. match_status=no_version_match	LOW 0	None	Review
ClamAV	1.4.4	UNKNOWN	Unmapped product: no reliable CVE product mapping was found for this banner. It may be proprietary, renamed, embedded, or device-specific. match_status=no_version_match	LOW 0	None	Review

Product	Installed	Matched product	Category	Status	Severity	Latest / EOL	Latest source	Evidence	Recommendation
Ubuntu	24.04	Ubuntu	Operating system	Current / no lifecycle finding current	Info	Latest: 24.04	Ubuntu matched the lifecycle catalog and no outdated/EOL condition was detected.	Run a supported Ubuntu LTS release or enable Ubuntu Pro/ESM where appropriate.	Scantide community latest observed medium confidence
Linux kernel	6.8.0	Linux kernel	Kernel	Current / no lifecycle finding current	Info	Latest: 6.8.0	Linux kernel matched the lifecycle catalog and no outdated/EOL condition was detected.	Evaluate kernel support against the Linux distribution first. Upstream kernel EOL is a review signal, not final proof for distro kernels.	Scantide community latest observed medium confidence
Apache HTTP Server	2.4.68	Apache HTTP Server	Web server	Current / no lifecycle finding current	Info	Latest: 2.4.68	Apache HTTP Server matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep Apache updated via distro/vendor packages; validate backported security fixes before judging by upstream version.	Scantide community latest observed medium confidence
PHP	8.3.6	PHP	Runtime	Current / no lifecycle finding current	Info	Latest: 8.3.6	PHP matched the lifecycle catalog and no outdated/EOL condition was detected.	Use a supported PHP branch. PHP 7.x and older should be treated as unsupported unless vendor extended support exists.	Scantide community latest observed medium confidence
OpenSSL	3.0.13	OpenSSL	TLS/Crypto	Current / no lifecycle finding current	Info	Latest: 3.0.13	OpenSSL matched the lifecycle catalog and no outdated/EOL condition was detected.	OpenSSL should be evaluated by distro/vendor package status; OpenSSL 1.1.1 and older require review.	Scantide community latest observed medium confidence
OpenSSH	9.6	OpenSSH	Remote admin	Current / no lifecycle finding current	Info	Latest: 9.6	OpenSSH matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep OpenSSH updated through OS packages; older major versions should be reviewed for distro backports.	Scantide community latest observed medium confidence
Postfix	3.8.6	Postfix	Mail/SMTP	Current / no lifecycle finding current	Info	Latest: 3.8.6	Postfix matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep Postfix updated via distro/vendor packages.	Scantide community latest observed medium confidence
Redis	8.8.0	Redis	Database/Cache	Current / no lifecycle finding current	Info	Latest: 8.8.0	Redis matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep Redis updated; restrict network exposure and require authentication.	Scantide community latest observed medium confidence
dnsmasq	2.90	dnsmasq	DNS/DHCP	Current / no lifecycle finding current	Info	Latest: 2.90	dnsmasq matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep dnsmasq updated.	Scantide community latest observed medium confidence
HAProxy	2.9.15	HAProxy	Proxy/Load balancer	Current / no lifecycle finding current	Info	Latest: 2.9.15	HAProxy matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep HAProxy on a supported branch, preferably distro/vendor LTS.	Scantide community latest observed medium confidence
Squid	6.14	Squid	Proxy	Current / no lifecycle finding current	Info	Latest: 6.14	Squid matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep Squid updated and review proxy exposure.	Scantide community latest observed medium confidence
VMware Tools	13.0.0.0	VMware Tools / open-vm-tools	Virtualization/Guest Tools	Update available update_available	Info	Latest: 13.1.0	VMware Tools / open-vm-tools installed version 13.0.0.0 is older than latest known version 13.1.0.	Keep VMware Tools/open-vm-tools updated through VMware/Broadcom packages or the Linux distribution package channel. Treat guest tools as platform support software, not as the server's primary role.	Broadcom VMware Tools build numbers and versions high confidence
Python	3.12.3	Python	Runtime	Current / no lifecycle finding current	Info	Latest: 3.12.3	Python matched the lifecycle catalog and no outdated/EOL condition was detected.	Use supported Python 3 branches; Python 2 is end-of-support.	Scantide community latest observed medium confidence
Perl	5.38.2	Perl	Runtime	Newer version observed update_available	Low	Latest: 5.40.5	Perl installed version 5.38.2 is older than latest version observed by Scantide community data: 5.40.5.	Review vendor release notes and update policy before upgrading. Community latest observed is a signal, not vendor proof.	Scantide community latest observed low confidence
OpenVPN	2.6.19	OpenVPN	VPN	Current / no lifecycle finding current	Info	Latest: 2.6.19	OpenVPN matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep OpenVPN updated and review cipher/auth settings.	Scantide community latest observed medium confidence
Fail2ban	1.0.2	Fail2ban	Security	Current / no lifecycle finding current	Info	Latest: 1.0.2	Fail2ban matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep Fail2ban updated.	Scantide community latest observed medium confidence
ClamAV	1.4.4	ClamAV	Security/AV	Current / no lifecycle finding current	Info	Latest: 1.4.4	ClamAV matched the lifecycle catalog and no outdated/EOL condition was detected.	Keep ClamAV and signatures updated.	Scantide community latest observed medium confidence

proto	address	port	process	exposure	comment
udp	127.0.0.1	53	systemd-resolve	Loopback only	Only locally reachable on this address.
udp	127.0.0.1%lo	53	systemd-resolve	Loopback only	Only locally reachable on this address.
udp	10.0.0.10	123	ntpd	LAN-facing	Private-address listener. Verify network segmentation.
udp	127.0.0.1	123	ntpd	Loopback only	Only locally reachable on this address.
udp	0.0.0.0	123	ntpd	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
udp	0.0.0.0	35192	avahi-daemon	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
udp	0.0.0.0	5353	avahi-daemon	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
udp	0.0.0.0	42752	squid	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
udp	fe80::250:56ff:feb2:c2b9]%ens192	123	ntpd	IPv6 link-local	IPv6 link-local listener.
udp	::1	123	ntpd	Loopback only	Only locally reachable on this address.
udp	::	123	ntpd	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
udp	::	5353	avahi-daemon	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
udp	0.0.0.0	40713	squid	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
udp	::	44181	avahi-daemon	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
tcp	127.0.0.1	53	systemd-resolve	Loopback only	Only locally reachable on this address.
tcp	127.0.0.1%lo	53	systemd-resolve	Loopback only	Only locally reachable on this address.
tcp	127.0.0.1	6379	redis-server	Loopback only	Only locally reachable on this address.
tcp	0.0.0.0	22	sshd	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
tcp	10.0.0.10	6379	redis-server	LAN-facing	Private-address listener. Verify network segmentation.
tcp	127.0.0.1	18890	wsgsbd	Loopback only	Only locally reachable on this address.
tcp	127.0.0.1	18891	wsytgd	Loopback only	Only locally reachable on this address.
tcp	127.0.0.1	631	cupsd	Loopback only	Only locally reachable on this address.
tcp	127.0.0.1	25	master	Loopback only	Only locally reachable on this address.
tcp	::1	25	master	Loopback only	Only locally reachable on this address.
tcp	::1	631	cupsd	Loopback only	Only locally reachable on this address.
tcp	::1	6379	redis-server	Loopback only	Only locally reachable on this address.
tcp	0.0.0.0	80	apache2	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
tcp	::	22	sshd	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
tcp	0.0.0.0	443	apache2	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.
tcp	0.0.0.0	3128	squid	All interfaces	Potentially reachable on every bound interface. Verify firewall and routing.

path	exists	owner	mode	modified	comment
/etc/ssh/sshd_config	yes	root:root	644	2021-10-22 09:58:27	SSH server configuration
/etc/sudoers	yes	root:root	440	2024-01-29 18:09:56	sudo policy
/etc/sysctl.conf	yes	root:root	644	2024-09-26 10:44:05	kernel/sysctl settings
/etc/ufw/ufw.conf	yes	root:root	644	2025-10-16 16:28:29	UFW configuration
/etc/fstab	yes	root:root	644	2021-02-18 10:30:06	filesystem mount configuration
/etc/apache2/apache2.conf	yes	root:root	644	2026-04-01 16:03:09	Apache global config
/etc/httpd/conf/httpd.conf	no	Apache/RHEL global config
/etc/nginx/nginx.conf	no	nginx global config
/etc/redis/redis.conf	yes	root:redis	640	2026-03-30 11:16:19	Redis configuration
/etc/postfix/main.cf	yes	root:root	644	2025-10-22 10:34:22	Postfix configuration
/etc/squid/squid.conf	yes	root:root	644	2021-10-22 09:56:52	Squid configuration
/etc/audit/auditd.conf	no	auditd configuration
/etc/systemd/journald.conf	yes	root:root	644	2024-02-27 18:26:04	journald configuration

type	name	state	evidence
systemd-service	accounts-daemon.service	enabled	enabled service
systemd-service	anacron.service	enabled	enabled service
systemd-service	apache2.service	enabled	enabled service
systemd-service	apparmor.service	enabled	enabled service
systemd-service	apport.service	enabled	enabled service
systemd-service	avahi-daemon.service	enabled	enabled service
systemd-service	blk-availability.service	enabled	enabled service
systemd-service	bluetooth.service	enabled	enabled service
systemd-service	clamav-daemon.service	enabled	enabled service
systemd-service	clamav-freshclam.service	enabled	enabled service
systemd-service	cloud-config.service	enabled	enabled service
systemd-service	cloud-final.service	enabled	enabled service
systemd-service	cloud-init-local.service	enabled	enabled service
systemd-service	cloud-init.service	enabled	enabled service
systemd-service	console-setup.service	enabled	enabled service
systemd-service	cron.service	enabled	enabled service
systemd-service	cups-browsed.service	enabled	enabled service
systemd-service	cups.service	enabled	enabled service
systemd-service	dmesg.service	enabled	enabled service
systemd-service	e2scrub_reap.service	enabled	enabled service
systemd-service	fail2ban.service	enabled	enabled service
systemd-service	finalrd.service	enabled	enabled service
systemd-service	getty@.service	enabled	enabled service
systemd-service	gpu-manager.service	enabled	enabled service
systemd-service	grub-common.service	enabled	enabled service
systemd-service	grub-initrd-fallback.service	enabled	enabled service
systemd-service	kerneloops.service	enabled	enabled service
systemd-service	keyboard-setup.service	enabled	enabled service
systemd-service	lvm2-monitor.service	enabled	enabled service
systemd-service	ModemManager.service	enabled	enabled service
systemd-service	multipathd.service	enabled	enabled service
systemd-service	networkd-dispatcher.service	enabled	enabled service
systemd-service	NetworkManager-dispatcher.service	enabled	enabled service
systemd-service	NetworkManager-wait-online.service	enabled	enabled service
systemd-service	NetworkManager.service	enabled	enabled service
systemd-service	ntpsec.service	enabled	enabled service
systemd-service	open-iscsi.service	enabled	enabled service
systemd-service	open-vm-tools.service	enabled	enabled service
systemd-service	openvpn.service	enabled	enabled service
systemd-service	php8.3-fpm.service	enabled	enabled service
systemd-service	pollinate.service	enabled	enabled service
systemd-service	postfix.service	enabled	enabled service
systemd-service	power-profiles-daemon.service	enabled	enabled service
systemd-service	redis-server.service	enabled	enabled service
systemd-service	rsync.service	enabled	enabled service
systemd-service	rsyslog.service	enabled	enabled service
systemd-service	secureboot-db.service	enabled	enabled service
systemd-service	setvtrgb.service	enabled	enabled service
systemd-service	snap.lxd.activate.service	enabled	enabled service
systemd-service	snapd.apparmor.service	enabled	enabled service
systemd-service	snapd.autoimport.service	enabled	enabled service
systemd-service	snapd.core-fixup.service	enabled	enabled service
systemd-service	snapd.recovery-chooser-trigger.service	enabled	enabled service
systemd-service	snapd.seeded.service	enabled	enabled service
systemd-service	snapd.service	enabled	enabled service
systemd-service	snapd.system-shutdown.service	enabled	enabled service
systemd-service	squid.service	enabled	enabled service
systemd-service	ssl-cert.service	enabled	enabled service
systemd-service	sssd.service	enabled	enabled service
systemd-service	switcheroo-control.service	enabled	enabled service
systemd-service	systemd-networkd.service	enabled	enabled service
systemd-service	systemd-oomd.service	enabled	enabled service
systemd-service	systemd-pstore.service	enabled	enabled service
systemd-service	systemd-resolved.service	enabled	enabled service
systemd-service	thermald.service	enabled	enabled service
systemd-service	ua-reboot-cmds.service	enabled	enabled service
systemd-service	ubuntu-advantage.service	enabled	enabled service
systemd-service	udisks2.service	enabled	enabled service
systemd-service	ufw.service	enabled	enabled service
systemd-service	unattended-upgrades.service	enabled	enabled service
systemd-service	vgauth.service	enabled	enabled service
systemd-service	wazuh-agent.service	enabled	enabled service
systemd-service	whoopsie.service	enabled	enabled service
systemd-service	wpa_supplicant.service	enabled	enabled service
systemd-service	wsgsbd.service	enabled	enabled service
systemd-service	wsicapd.service	enabled	enabled service
systemd-service	wsissue.service	enabled	enabled service
systemd-service	wsmond.service	enabled	enabled service
systemd-service	appsyncd.service	enabled	enabled service
systemd-service	wsytgd.service	enabled	enabled service
systemd-timer	anacron.timer	enabled	timer unit
systemd-timer	apport-autoreport.timer	enabled	timer unit
systemd-timer	apt-daily-upgrade.timer	enabled	timer unit
systemd-timer	apt-daily.timer	enabled	timer unit
systemd-timer	certbot.timer	enabled	timer unit
systemd-timer	clamav-freshclam-once.timer	disabled	timer unit
systemd-timer	dpkg-db-backup.timer	enabled	timer unit
systemd-timer	e2scrub_all.timer	enabled	timer unit
systemd-timer	fstrim.timer	enabled	timer unit
systemd-timer	fwupd-refresh.timer	enabled	timer unit
systemd-timer	logrotate.timer	enabled	timer unit
systemd-timer	man-db.timer	enabled	timer unit
systemd-timer	mdadm-last-resort@.timer	static	timer unit
systemd-timer	mdcheck_continue.timer	enabled	timer unit
systemd-timer	mdcheck_start.timer	enabled	timer unit
systemd-timer	mdmonitor-oneshot.timer	enabled	timer unit
systemd-timer	motd-news.timer	enabled	timer unit
systemd-timer	ntpsec-rotate-stats.timer	enabled	timer unit
systemd-timer	ntpsec.timer	masked	timer unit
systemd-timer	phpsessionclean.timer	enabled	timer unit
systemd-timer	snapd.snap-repair.timer	enabled	timer unit
systemd-timer	sysstat-collect.timer	disabled	timer unit
systemd-timer	sysstat-summary.timer	disabled	timer unit
systemd-timer	systemd-sysupdate-reboot.timer	disabled	timer unit
systemd-timer	systemd-sysupdate.timer	disabled	timer unit
systemd-timer	systemd-tmpfiles-clean.timer	static	timer unit
systemd-timer	ua-timer.timer	enabled	timer unit
systemd-timer	update-notifier-download.timer	enabled	timer unit
systemd-timer	update-notifier-motd.timer	enabled	timer unit
systemd-timer	xfs_scrub_all.timer	disabled	timer unit
cron	/etc/crontab	present	cron/autostart entry file
cron	/etc/cron.d/anacron	present	cron/autostart entry file
cron	/etc/cron.d/certbot	present	cron/autostart entry file
cron	/etc/cron.d/e2scrub_all	present	cron/autostart entry file
cron	/etc/cron.d/ntpsec	present	cron/autostart entry file
cron	/etc/cron.d/php	present	cron/autostart entry file
cron	/etc/cron.d/popularity-contest	present	cron/autostart entry file
cron	/etc/cron.d/sysstat	present	cron/autostart entry file
cron	/etc/cron.d/app-service_periodic	present	cron/autostart entry file
cron	/var/spool/cron/atjobs	present	cron/autostart entry file
cron	/var/spool/cron/crontabs	present	cron/autostart entry file

severity	component	item	evidence	recommendation
Medium	Apache	Directory listing may be enabled	Options Indexes found	Disable Indexes unless intentionally required.
Info	PHP-FPM	security.limit_extensions not found	No security.limit_extensions found in pool configs	Consider explicitly limiting PHP-FPM executable extensions.

Severity	Area	Item	Evidence	Recommendation	Risk type
Info	Boot Security	Legacy BIOS boot detected	UEFI firmware path not found	Verify whether legacy BIOS boot is expected for this server.	maintainability
Info	Boot Security	GRUB password appears configured	GRUB superusers/password directive found	Review bootloader policy.	security
Low	Kernel Security	Kernel lockdown mode is not active	[none] integrity confidentiality	Consider kernel lockdown on Secure Boot capable systems where compatible.	security
Medium	Dangerous Services	CUPS listener detected	port=631 listening	Disable if unused, or restrict exposure to trusted networks.	security
Low	Dangerous Services	Avahi/mDNS service active	avahi-daemon active	Disable on servers unless service discovery is required.	security
Medium	Database Security	Database/search service listens on all interfaces	port=6379 all-interface listener	Restrict bind address and firewall exposure.	security
Low	Web Application	PHP expose_php is enabled	expose_php=On	Set expose_php=Off.	security
Low	Web Application	HSTS header not detected locally	port=80	Add HSTS where HTTPS is enforced and compatible.	security
Low	Web Application	X-Frame-Options header not detected locally	port=80	Add X-Frame-Options or CSP frame-ancestors.	security
Info	Web Application	CSP header not detected locally	port=80	Consider CSP for web applications where practical.	security
Low	Startup Services	Enabled services not currently running	anacron.service,bluetooth.service clamav-daemon.service,dmesg.service e2scrub_reap.service,getty@.service gpu-manager.service,grub-common.service grub-initrd-fallback.service,NetworkManager-dispatcher.service open-iscsi.service,pollinate.service rsync.service,secureboot-db.service snap.lxd.activate.service,snapd.autoimport.service snapd.core-fixup.service,snapd.recovery-chooser-trigger.service snapd.system-shutdown.service,ssl-cert.service	Review whether enabled services should be running or disabled.	operational
Low	Login Activity	Recent failed login records detected	7 recent lastb rows	Review authentication logs and brute-force controls.	security
Info	Log Health	Journal disk usage	Review retention policy.	operational
Medium	Certificates	Local certificate file is expired	/etc/letsencrypt/archive/www.example.com/cert2.pem days_remaining=-101	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/letsencrypt/archive/www.example.com/cert1.pem days_remaining=-161	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/letsencrypt/archive/www.example.com/cert3.pem days_remaining=-41	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/letsencrypt/archive/www.example.com/fullchain1.pem days_remaining=-161	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/letsencrypt/archive/www.example.com/fullchain3.pem days_remaining=-41	Renew or remove expired certificate file if unused.	security
Low	Certificates	Local certificate file expires soon	/etc/letsencrypt/archive/www.example.com/fullchain4.pem days_remaining=18	Renew if the certificate is still in use.	security
Low	Certificates	Local certificate file expires soon	/etc/letsencrypt/archive/www.example.com/cert4.pem days_remaining=18	Renew if the certificate is still in use.	security
Medium	Certificates	Local certificate file is expired	/etc/letsencrypt/archive/www.example.com/fullchain2.pem days_remaining=-101	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/certs/SSLBackups/file.nokey.pem days_remaining=-552	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/certs/SSLBackups/file.withkey.pem days_remaining=-552	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/certs/SSLBackups/rCloud_HAproxy2024-12-17-New.pem days_remaining=-552	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/certs/SSLBackups/file.withkey-2021.pem days_remaining=-1251	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/certs/SSLBackups/rCloud.withkey.pem days_remaining=-1357	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/certs/SSLBackups/rCloud_HAproxy-2024-12-17.pem days_remaining=-552	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/certs/SSLBackups/rCloud.nokey.pem days_remaining=-1357	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/certs/rCloud_HAproxy.pem days_remaining=-187	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/etc/ssl/private/rCloud.crt days_remaining=-1357	Renew or remove expired certificate file if unused.	security
Medium	Certificates	Local certificate file is expired	/opt/app-ui/var/temp/app-service_backup/etc/license.pem days_remaining=-1686	Renew or remove expired certificate file if unused.	security
Info	Platform	Virtualization/cloud hint	vmware	Use platform-specific patching/backup/agent guidance.	maintainability
Info	Cloud	cloud-init detected	cloud-init present	Review cloud-init status and metadata exposure.	maintainability

Severity	Area	Item	Evidence	Recommendation
Medium	Operations	systemd failed units detected	4 failed unit(s): clamav-daemon.service,wsicapd.service wsmond.service,clamav-daemon.socket	Review failed units with systemctl --failed and journalctl -u <unit>.
Info	Time sync	NTP synchronized	Yes	No action required.
Info	Patch management	unattended-upgrades configured	service=enabled/active	Review policy and maintenance windows.

Server	Engine	SSL	Document root	Permissions	Certificate	Certificate status	Days	Config
www.example.com	apache	yes	/var/www/html www-data:www-data mode 755	ok	/etc/letsencrypt/live/www.example.com/fullchain.pem	valid	78	/etc/apache2/sites-enabled/default-ssl.conf
start.example.com	apache	no	/var/www/start www-data:www-data mode 755	ok	unknown			/etc/apache2/sites-enabled/start.conf
default/unknown	apache	no	unknown unknown mode					/etc/apache2/sites-enabled/app-service.conf

tool	status	evidence
duplicity	installed	/usr/bin/duplicity
tar	installed	/usr/bin/tar
Info	Backups	Latest backup-like file evidence	2026-06-25 00:00 /var/backups/alternatives.tar.0	Verify restore tests.

Proto	Address	Port	Process	PID	User/UID	Comment
udp	127.0.0.1	53	systemd-resolve	1314	101	Expected/unknown
udp	127.0.0.1%lo	53	systemd-resolve	1314	101	Expected/unknown
udp	10.0.0.10	123	ntpd	2019	138	Expected/unknown
udp	127.0.0.1	123	ntpd	2019		Expected/unknown
udp	0.0.0.0	123	ntpd	2019		Expected/unknown
udp	0.0.0.0	35192	avahi-daemon	1614	120	Expected/unknown
udp	0.0.0.0	5353	avahi-daemon	1614	120	Expected/unknown
udp	0.0.0.0	42752	squid	207744	13	Expected/unknown
udp	fe80::250:56ff:feb2:c2b9]%ens192	123	ntpd	2019		Expected/unknown
udp	::1	123	ntpd	2019		Expected/unknown
udp	::	123	ntpd	2019		Expected/unknown
udp	::	5353	avahi-daemon	1614	120	Expected/unknown
udp	0.0.0.0	40713	squid	207744	13	Expected/unknown
udp	::	44181	avahi-daemon	1614	120	Expected/unknown
tcp	127.0.0.1	53	systemd-resolve	1314	101	Expected/unknown
tcp	127.0.0.1%lo	53	systemd-resolve	1314	101	Expected/unknown
tcp	127.0.0.1	6379	redis-server	62259	140	Review exposure: service is commonly sensitive or abused if Internet-facing.
tcp	0.0.0.0	22	sshd	2223	SSH: expected on many servers, but should be restricted and hardened.	Expected/unknown
tcp	10.0.0.10	6379	redis-server	62259	140	Review exposure: service is commonly sensitive or abused if Internet-facing.
tcp	127.0.0.1	18890	wsgsbd	1988	13	Expected/unknown
tcp	127.0.0.1	18891	wsytgd	1997	13	Expected/unknown
tcp	127.0.0.1	631	cupsd	223332		Expected/unknown
tcp	127.0.0.1	25	master	3052	Review exposure: service is commonly sensitive or abused if Internet-facing.	Expected/unknown
tcp	::1	25	master	3052	Review exposure: service is commonly sensitive or abused if Internet-facing.	Expected/unknown
tcp	::1	631	cupsd	223332		Expected/unknown
tcp	::1	6379	redis-server	62259	140	Review exposure: service is commonly sensitive or abused if Internet-facing.
tcp	0.0.0.0	80	apache2	228431	Web service: verify TLS, headers, exposure and patching.	Expected/unknown
tcp	::	22	sshd	2223	SSH: expected on many servers, but should be restricted and hardened.	Expected/unknown
tcp	0.0.0.0	443	apache2	228431	Web service: verify TLS, headers, exposure and patching.	Expected/unknown
tcp	0.0.0.0	3128	squid	207744		Expected/unknown

severity	area	item	evidence	recommendation
Medium	Accounts	Root account password appears enabled	passwd -S root reports password set	Prefer locked root password and sudo-based administration where practical.
Medium	Sudo	Passwordless sudo entries found	/etc/sudoers.d/app-service:1:app-service ALL=(root) NOPASSWD: /opt/app-service/bin/reload.sh, /opt/app-service/bin/restart.sh, /opt/app-service/bin/cluster.sh, /opt/app-ui/bin/certmgr.py, /opt/app-ui/bin/cachemgr.py, /usr/bin/tail, /opt/app-ui/bin/timezone.py, /opt/app-ui/bin/hostname.py, /opt/app-ui/bin/resolve.py, /opt/app-ui/bin/netmgr.py, /opt/app-ui/bin/fsmgr.py, /opt/app-ui/bin/cronmgr.py, /opt/app-ui/bin/logrotatemgr.py, /opt/app-ui/bin/confmgr.py
/etc/sudoers.d/appsyncd:1:proxy ALL=(root) NOPASSWD: /opt/app-service/bin/cluster.sh	Review NOPASSWD sudo entries and restrict them to justified automation.

severity	area	key	actual	recommendation
Medium	Kernel/sysctl	net.ipv4.conf.default.accept_source_route	1	Disable source-routed packets by default.
Medium	Kernel/sysctl	net.ipv4.conf.all.accept_redirects	1	Disable ICMP redirects.
Medium	Kernel/sysctl	net.ipv4.conf.default.accept_redirects	1	Disable ICMP redirects by default.
Medium	Kernel/sysctl	net.ipv4.conf.all.send_redirects	1	Disable sending redirects.
Medium	Kernel/sysctl	net.ipv4.conf.default.send_redirects	1	Disable sending redirects by default.
Medium	Kernel/sysctl	fs.suid_dumpable	2	Disable core dumps for SUID programs.
Low	Kernel/sysctl	kernel.sysrq	176	Disable SysRq unless operationally required.

severity	area	item	evidence	recommendation
Medium	Audit/logging	auditd not active	not-found/inactive	Enable auditd where local audit trail requirements apply.
Info	Audit/logging	No obvious remote syslog forwarding detected	No remote logging pattern found	Consider remote log forwarding for important servers.
Info	Audit/logging	AIDE not installed	aide command not found	Consider file integrity monitoring for sensitive servers.

Metric	Value	Evidence source
available_updates	0	apt-get -s upgrade fallback
security_updates	0	apt-get -s upgrade fallback
reboot_required	Yes	/var/run/reboot-required

Tool	Status	Note
lynis	not installed	Optional CIS-style local auditing helper. Not required by Scantide.
oscap	not installed	Optional OpenSCAP compliance scanner. Not required by Scantide.
aide	not installed	Optional file integrity monitoring. Not required by Scantide.
needrestart	installed	Optional reboot/service restart helper.
debsecan	not installed	Optional Debian/Ubuntu advisory helper.

Scantide Linux Local Security Check

Important Disclaimer

Linux Script Version Check

Executive Overview

System Overview

Scantide Version Check

Quick Actions

Reason

Reason

Reason

Reason

Reason

Reason

Reason

Reason

Reason

Reason

Likely Server Role Detection

Platform / Virtualization

Services Summary

Top Risks and Strengths

Top Risks

Top Strengths

What To Verify Manually

Scantide Linux Security Score

System Information

Executive Findings

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence

Recommendation

Evidence