The Problem

System administrators need a quick, repeatable way to surface common security mis‑configurations and resource‑use anomalies on a freshly‑provisioned or long‑running Ubuntu/Debian VPS. Manual inspection is error‑prone and time‑consuming, especially when the same checklist must be applied across many hosts.

What This Does

vps-audit.sh is a single‑file Bash script that runs a fixed series of checks (SSH settings, UFW status, Fail2ban, failed login counts, service list, open ports, SUID files, and basic performance metrics). The script writes colored console output and a timestamped report file (vps-audit-report-[TIMESTAMP].txt). Documentation lives in README.md (usage, thresholds, customization) and the repository includes a LICENSE (MIT) and a screenshot.png showing sample output. No external dependencies beyond standard tools (awk, grep, netstat, etc.) are required.

How It Is Wired

Entry point: execution starts with ./vps-audit.sh (typically via sudo). The script parses no external configuration files; all thresholds and toggles are hard‑coded variables near the top of the file.

Control flow: after the shebang, the script sequentially invokes a series of internal functions—each encapsulating a single audit item (e.g., check_ssh_root_login, check_ufw_status). Because there is only one source file, the call graph is a linear chain; there are 0 internal modules, 0 import edges, and no circular dependencies.

External touchpoints:

  • Filesystem – reads /etc/ssh/sshd_config, /etc/ufw/ufw.conf, /etc/fail2ban/, and other system files; writes the report file in the current directory.
  • Process space – runs commands such as systemctl list-units, netstat -tunlp, df -h, and free -m to gather state.
  • Network – only reads local socket information; no outbound connections are made.

Blast radius: the script’s only side‑effect is the report file; all checks are read‑only. Because logic is confined to a single Bash file, any modification (e.g., adding a new check) requires editing that file directly, which is straightforward but offers no modular isolation.

How To Use It

# Clone the repository
git clone https://github.com/moses-y/vps-audit
cd vps-audit

# Make the script executable
chmod +x vps-audit.sh

# Run the audit (requires root or sudo)
sudo ./vps-audit.sh

The script will emit colored status lines to the terminal and create vps-audit-report-$(date +%Y%m%d%H%M%S).txt in the current directory.

Real‑World Use

A DevOps engineer can schedule the script via a cron job (e.g., 0 2 * * 0 /path/to/vps-audit.sh >> /var/log/vps-audit.log 2>&1) to generate weekly compliance snapshots. The generated report can be archived or fed into a log‑aggregation system for trend analysis.

Code Health & Issues

  • Medium – No test files – repository lacks any unit or integration tests (tests present: no).
  • Medium – No CI/CD pipeline – there is no .github/workflows/ or other automation (CI: no).
  • Low – No Dockerfile – container builds are not supported (Dockerfile: no).
  • Low – No lockfile – dependency pinning is irrelevant for a Bash script but a lockfile is absent (lockfile: no).
  • Info – License present – LICENSE file supplies MIT terms (license: yes).
  • Info – No committed secrets – static scan found none.

The Bottom Line

vps-audit delivers a lightweight, zero‑dependency Bash audit that is easy to deploy on Debian/Ubuntu servers and provides immediate visibility into security posture and resource usage. The trade‑off is limited extensibility and a lack of automated testing or CI; it is best suited for teams that can manage Bash scripts directly and do not require a packaged, test‑driven pipeline.