Host Checks

Ten checks assess the Linux host via SSH commands. All require --ssh-host and either --ssh-password or --ssh-key.

Requires SSH access. Without SSH credentials, all host checks return WARN and are excluded from scoring.

HOST-SSH-001 in Detail

This is the most safety-critical auto-fix in the framework. Applying PermitRootLogin prohibit-password while authenticated with a password would lock you out permanently.

StackSentry prevents this with a four-step key pre-flight. See SSH Key Safety for the full explanation.

SSH command executed:

grep -i "^PermitRootLogin" /etc/ssh/sshd_config

Auto-fix applies:

sed -i 's/^#*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
systemctl restart sshd

HOST-FW-001 — Firewall

SSH command:

ufw status | head -1

Auto-fix applies:

ufw --force enable
ufw default deny incoming
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp

HOST-UPDATE-001 — Automatic Updates

SSH command:

dpkg -l unattended-upgrades 2>/dev/null | grep ^ii

Auto-fix applies:

apt-get install -y unattended-upgrades
dpkg-reconfigure -f noninteractive unattended-upgrades

Service User Checks

HOST-SVC-GUNICORN, HOST-SVC-UWSGI, HOST-SVC-MYSQL, and HOST-SVC-REDIS verify that these processes run as non-root system users, following the principle of least privilege. Running application servers as root means a compromised process has full system access.

SSH commands used:

ps aux | grep gunicorn | grep -v grep
ps aux | grep uwsgi | grep -v grep
ps aux | grep mysqld | grep -v grep
ps aux | grep redis-server | grep -v grep

These checks return WARN (not FAIL) if the service is not running — the service absence is not a security finding.