VPS & Server audit fixes

Services & Processes: fixing all 9 checks

The services and processes audit inventories the units, timers, cron entries and external listeners a host is running, so a failure names attack surface nobody asked for or a persistence foothold.

Three checks call systemctl and skip together when it is missing, so Unneeded Services, Running Service Count and Systemd Timers report three skips rather than three passes on an Alpine, OpenRC or container-style host that does not use systemd. The other two skips are External Listener Processes, which needs both root and ss, and Kernel Hardening, which skips when /proc/sys cannot be read at all.

9
checks in this audit
1
rated high severity
2
need root or sudo
~11s
automated run time

Transcribed from the vps-security-services-processes audit script. For what the audit covers rather than how to fix it, see the Services & Processes checklist.

Every check

Find your finding

Listed in the order the audit runs them. Take the check name from the third field of the result line and open its page.

  • Unneeded Services

    Soon

    Checks for services that rarely belong on a VPS (cups, avahi, bluetooth, ModemManager)

    LowNo root3 results

  • Running Service Count

    Soon

    Counts running systemd services as a proxy for attack surface

    LowNo root3 results

  • External Listener Processes

    Soon

    Maps processes listening on external interfaces

    MediumNeeds root3 results

  • Suspicious Cron Jobs

    Soon

    Counts cron entries and hunts for download-and-execute persistence patterns

    HighNeeds root2 results

  • Systemd Timers

    Soon

    Counts scheduled systemd timers

    LowNo root3 results

  • Time Synchronisation

    Soon

    Clock synchronisation, which every log timestamp depends on

    LowNo root2 results

  • Audit Daemon

    Soon

    auditd presence and state for a durable forensic trail

    MediumNo root3 results

  • Host AppArmor/SELinux

    Soon

    AppArmor or SELinux enforcement on the host itself

    MediumNo root2 results

  • Kernel Hardening

    Soon

    ASLR, dmesg restriction, reverse-path filtering and ICMP redirects

    MediumNo root3 results
Why checks skip

A SKIP is never a pass

A skipped check verified nothing at all. The most common cause is privilege: 2 of the 9 checks in this audit need root for a complete result. Before every run, each script works out which of four privilege modes it is in.

The four privilege modes an audit script can run in, and what each one means for checks that need root
ModeHow it is reachedWhat it means for your results
rootThe audit runs as UID 0.Every privileged branch runs directly. No check skips for lack of permission.
nopasssudo -n true succeeds, so the account has passwordless sudo.Privileged commands run through sudo -n.
passA sudo password was supplied in the CtrlOps audit settings and accepted.Privileged commands run through sudo -S.
noneNone of the above worked.CAN_ROOT=0. Every privileged branch returns SKIP with a "Need root" message rather than guessing.

If many checks skip with a “need root” message, run the audit as root, grant the audit account sudo (with or without NOPASSWD), or supply the sudo password in the CtrlOps audit settings.

Keep going

Related audits

FAQ

Services & Processes questions

Anything above 40 running units. It counts .service units reported by systemctl list-units --type=service --state=running, and warns past 40 on the basis that a single-purpose host does not need that many. Templated and per-user units such as getty@tty1 and user@1000.service inflate the total, and hosts running many containers as systemd units or a control panel exceed 40 legitimately. Treat the number as a prompt to read the list, not as a finding in itself.
External Listener Processes maps each externally bound TCP socket to its PID, checks whether /proc/PID is owned by uid 0, and then filters the names against a fixed allow-list of sshd, systemd, nginx, apache2, httpd, dockerd and containerd. docker-proxy is not on that list, so a container host gets one warning per published port even though the process is part of Docker itself. The same over-report hits rpcbind, the postfix master and any app you start as root, and because the filter matches on name alone it evaluates TCP only and would miss a renamed binary.
On a VPS, cups, avahi-daemon, bluetooth and ModemManager are the four it names and none of them has a job on a headless server, so stop, disable and then mask each one so a package update cannot re-enable it. Check what depends on them first with systemctl list-dependencies --reverse NAME, since desktop-derived and GPU images sometimes wire them into a target. The kernel hardening findings are the ones to stage carefully instead: write them to /etc/sysctl.d and apply with sysctl --system so the values survive a reboot, and expect rp_filter and accept_redirects changes to affect multi-homed or Docker hosts.
Audit your fleet

Run all 9 Services & Processes checks, in one click

CtrlOps runs this audit over your existing SSH connection - no agents, no scripts to manage. $7/user/month after a 1 month free trial - no credit card required.

✓ Start instantly·✓ No credit card·✓ No sneaky autorenewals