Rootkit / Malware
Rootkit, backdoor and hidden-process traces — highest priority signs of an existing compromise.
- Known rootkit traces Presence of known rootkit files, paths or signatures.
- ld.so.preload injection Shared libraries force-loaded via /etc/ld.so.preload or LD_PRELOAD.
- Hidden processes Mismatch between the ps listing and /proc (hidden PIDs).
- Suspicious kernel modules Unsigned/unknown loaded kernel modules.
- Promiscuous NIC Network interfaces in promiscuous mode.
- Rootkit-scanner result Warnings from rkhunter/chkrootkit when installed.
Patch / Updates
Security updates applied and EOL status — exposure to known vulnerabilities.
- Pending security updates Count of unapplied security updates (yum/apt).
- EOL operating system Whether the OS release is end-of-life.
- Kernel reboot pending Running kernel differs from the newest installed (reboot pending).
SSH config
Hardening of the remote-access gateway — root login, password auth, empty passwords.
- Direct root login sshd PermitRootLogin setting.
- SSH empty passwords sshd PermitEmptyPasswords setting.
- SSH password auth sshd PasswordAuthentication (key-based preferred).
- SSH weak algorithms Use of legacy protocol / weak KEX, ciphers or MACs.
- SSH auth-try limit sshd MaxAuthTries value.
Accounts / Privilege
Privilege-escalation surface — duplicate UID0, empty-password accounts, broad sudo.
- Duplicate UID 0 Accounts with UID 0 other than root.
- Empty-password accounts Accounts with an empty password in /etc/shadow.
- Passwordless sudo Broad NOPASSWD sudo rules (e.g. ALL).
- Password aging Whether a max password age is set.
- System-account shells System accounts with a login shell.
Network exposure
Externally exposed services, legacy protocols, public DB ports.
- Legacy cleartext services telnet, rsh, rlogin, cleartext ftp active.
- DB ports exposed MySQL/PostgreSQL/Redis/Mongo listening on 0.0.0.0.
- Exposed listeners Services listening on 0.0.0.0/::.
Filesystem perms
World-writable, SUID and sensitive-file permissions — local privilege-escalation paths.
- /etc/shadow perms Ownership/permissions of the shadow file (640/000).
- World-writable files World-writable files/dirs without sticky bit.
- SUID/SGID inventory Unexpected SUID/SGID binaries.
- /etc/passwd perms passwd file perms (644, root-owned).
- /tmp exec restriction /tmp mounted noexec/nosuid.
System hardening
Kernel and security-module settings — ASLR, SELinux, SYN cookies and other basics.
- SELinux/AppArmor Whether mandatory access control is enforcing.
- ASLR kernel.randomize_va_space value (2 recommended).
- TCP SYN cookies net.ipv4.tcp_syncookies enabled.
- IP forwarding net.ipv4.ip_forward (0 unless a router).
- Core-dump limits setuid/global core-dump restrictions.
Services / Firewall
Host firewall active and unnecessary services — attack-surface reduction.
- Host firewall firewalld/ufw/nftables active.
- Unnecessary services Needlessly enabled daemons.
Audit / Logging
auditd and syslog — the prerequisite for post-breach tracing and forensics.
- Audit daemon (auditd) Whether auditd is running.
- System logging Whether rsyslog/journald is running.
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.