rs security — security check

rs security changes nothing — it shows findings and how to close them. ✗ — fix now, ! — worth a look.

SSH

• root can log in with a password — the most common way in. First add your key (ssh-copy-id user@server) and test logging in with it in a new window, then in /etc/ssh/sshd_config: PermitRootLogin prohibit-password, PasswordAuthentication no, and systemctl reload ssh.
• Password login is on — the same, without the root ban.
• Many guesses and no fail2ban/CrowdSec — apt install -y fail2ban (SSH protection is on right away).

Firewall and ports

• No firewall — every listening port is visible from the internet. Allow the SSH port first or you lock yourself out: ufw allow <SSH port>/tcp && ufw allow 80,443/tcp && ufw enable.
• A dangerous port is open (PostgreSQL, MySQL, Redis, MongoDB, Elasticsearch, Docker API, Ollama, RDP, SMB…) — bind the service to 127.0.0.1 (in Docker: "127.0.0.1:5432:5432" instead of "5432:5432") or allow only your IPs.
• Docker publishes ports on 0.0.0.0 with ufw on — Docker writes iptables rules that bypass ufw: such ports are open even if ufw "closed" them. Publish on 127.0.0.1 behind a proxy, or filter in the DOCKER-USER chain. RunStack services restrict IPs with rs <service> access.

Docker

• Docker API on tcp:2375 without TLS — whoever reaches it owns the server. Remove the tcp host from /etc/docker/daemon.json or the systemd unit.
• A --privileged container or one with docker.sock — full access to the host and every container. Keep it only where truly needed (Portainer, Traefik — knowingly).
• docker group members — effectively root.

Updates

• Security updates not installed — apt update && apt upgrade -y.
• Automatic updates are off — apt install -y unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades.
• Reboot required — a new kernel or libc is not active yet; reboot at a quiet time.

Accounts and system

• UID 0 besides root — another root; check who created it and why.
• An account without a password — passwd -l <user>.
• Clock not synchronized — timedatectl set-ntp true.
• ASLR weakened — sysctl -w kernel.randomize_va_space=2.
• World-writable files in /etc — chmod o-w <file>.

This is a quick check of common mistakes, not a full audit.