Read-only Debian shared-host security audit — avoid banning yourself

I need to check the security of Debian servers running DirectAdmin periodically — both during routine checks and after a restore/migration to avoid bringing old vulnerabilities back. My rule is read-only first, always: inspect everything first, then decide on fixes as a separate step that needs approval again. I don't rush into changing anything during a scan, so I thought I'd share the sequence I use.

The first trap: whitelist yourself first, or get yourself banned

Servers with CSF/LFD have rules for detecting brute-force attempts and port scans. When I start scanning (hitting multiple ports, trying multiple endpoints), my own traffic matches those rules, and LFD bans my IP midway through — leaving the audit stuck and me wondering when the connection dropped.

MY_IP=$(curl -s ifconfig.me)
csf -ta "$MY_IP" 86400 "audit window $(date +%F)"   # temp allow 24 ชม.
# ... ทำ audit ...
# เสร็จแล้วถอด: csf -tr "$MY_IP"

What I check (read-only)

These are all inspection commands that change nothing:

# 1) ใครฟัง port อะไรอยู่บ้าง — มี service แปลกปลอมไหม
ss -ltnp | sort -k4

# 2) process ที่รันด้วย root แต่มาจาก path แปลก (webshell/miner)
ps aux | awk '$1=="root"' | grep -iE '/tmp/|/dev/shm/|\.\/'

# 3) cron ของทุก user (backdoor ชอบซ่อนตรงนี้)
for u in $(cut -d: -f1 /etc/passwd); do
  crontab -l -u "$u" 2>/dev/null | grep -v '^#' | sed "s/^/[$u] /"
done

# 4) ไฟล์ที่เพิ่งถูกแก้ในที่ที่ไม่ควรมีของใหม่
find /etc /usr/local/bin -mtime -7 -type f 2>/dev/null

# 5) SSH: key ที่ authorized + การตั้งค่าที่หลวม
grep -rE 'PermitRootLogin|PasswordAuthentication' /etc/ssh/sshd_config

Checking against the current vulnerability landscape

While inspecting, remember to check against CVEs still active in 2024-2026, especially in the kernel and mail stack, which are frequent targets on shared hosts.

# kernel + แพ็กเกจที่ค้างอัปเดต
uname -r
apt list --upgradable 2>/dev/null | grep -iE 'linux-image|exim|dovecot|roundcube|openssl'
# ไฟล์ตั้งค่า DA ที่ควรจำกัดสิทธิ์
ls -la /usr/local/directadmin/conf/ 2>/dev/null | grep -vE 'rw-r-----|rw-------'

I put particular weight on kernel nf_tables local privilege escalation (public exploits exist, and it is listed in KEV) and vulnerabilities in mail services that are constantly exposed to the internet — these two are routes attackers tend to use on shared hosts more often than other, flashier vulnerabilities.

A safe audit sequence, in summary

1. Temporarily whitelist your own IP first (to avoid banning yourself)
2. Inspect in read-only mode: ports, processes, cron, recently modified files, ssh config
3. Write output only to a directory with permissions 0700
4. Check kernel/mail/tenant components against active CVEs
5. Summarize findings as P0-P2, then fix them in a separate step (get approval before making changes)

The core of a good audit is "inspect everything before touching anything" and "don't let the inspection itself break the system" — whitelisting your own IP before scanning is a small step people often forget, leaving the work stuck midway through. If you manage shared-host servers, feel free to use this sequence for your routine checks. If I've left anything out or made a typo, I'll come back and correct it later.