vps-security-scanner

An automated VPS security audit runs nmap, trivy, and grype to check exposed ports, SSH settings, Docker image CVEs, and system posture. It generates a prioritized Markdown report of vulnerabilities and misconfigurations for administrators to review.

You can schedule daily security scans with Telegram notifications by integrating the scanner with systemd timers. It parses the audit report and sends alerts to administrators when critical security findings appear.

The VPS scanner checks for Docker image vulnerabilities using trivy and inspects sshd_config for risky settings like PermitRootLogin or PasswordAuthentication. It also uses grype to detect CVEs in system packages.

To scan Docker containers and system packages for CVEs, you need nmap, trivy, grype, jq, docker, curl, and python3 installed on your Linux VPS. These dependencies enable network discovery, vulnerability scanning, and report parsing.

Auditing exposed ports and SUID permission issues is best done using an automated scanner that combines nmap service discovery with system posture checks. It identifies open ports, service versions, and risky file permissions in a single Markdown report.

You can use this scanner for post-deploy security checks and incident investigations on systems running Docker and standard Linux services. It applies to scheduled daily scans, post-deploy checks, and incident investigations on systems running Docker, standard Linux services, and system packages.