Hi there !
Reading this nice article [fr], it mentioned a “command line tool which check major security practices” pschecker.
I sound interesting, so I tried obtaining the following :
Running the audit of your personal server…
Context:
- Distribution: debian
- Domain names:
Processing tests:
Root must not use password: done
Servers should not listen 0.0.0.0: done
A firewall should be up and running: done
Last system update was done recently: done┌Your personal server diagnostic─────────────────────┐
│ Name │ Result │ Infos ───────┤
│ Root must not use password : KO: Your root user should not be able to log in with password, only SSH login should be allowed.
│ Servers should not listen 0.0.0.0 : KO : Some of your servers listen to the 0.0.0.0 host: transmission-da (51413), dovecot (4190), mysqld (3306), transmission-da (51413), dovecot (4190)
│ A firewall should be up and running : WARN : No firewall was found.
│ Last system update was done recently : OK
└───────────────────────────────────┘
I am not at all an expert in security, so : do you think those tests are sensitives ?
PS : I know that the first point is mentioned in the yunohost documentation (which I should set up…).