How to Run a Quick Security Check on a Linux Server from Your Phone

TL;DR

Security Check runs one read-only command over SSH and grades what it finds: root login and password authentication, publicly exposed services, firewall state, sensitive file permissions, pending updates and recent failed logins. It is a quick health check, not a full audit, and some results need root.

The problem

Most small servers are set up once and left alone. Months later nobody remembers whether root login is still enabled, whether the firewall is on, whether the database port is open to the internet, or how many updates are waiting. Checking means running six different commands across several files, which no one does on a phone. And failed login attempts quietly pile up unnoticed.

What Security Check does

It runs a single, dependency-free command over SSH and turns the results into a graded list, worst findings first, grouped by category:

  • SSH: whether root login is allowed, limited to keys or disabled; whether password authentication is on; empty passwords; whether SSH is on a non-default port.
  • Network: listening ports, flagging sensitive services exposed publicly; firewall state (ufw, firewalld, nftables or iptables).
  • Files: world-writable files, a readable /etc/shadow, a group-writable authorized_keys.
  • Updates: pending updates with apt, dnf or yum.
  • Logins: recent failed logins.

Each finding is graded pass, info, warning or risk, with a short explanation.

How to run it

  1. Open the server’s dashboard.
  2. Tap the ••• menu and choose Security Check.
  3. Read the overall assessment, then work through the risks first.

How to read it

  • Risk: act on these first (for example, SSH root login with a password, or a database listening on all interfaces).
  • Warning: worth fixing soon.
  • Info / unknown: context, or a check it couldn’t complete.

Be realistic

  • It’s a health check, not an audit. It doesn’t scan for malware, check application config, or replace a proper review.
  • Some checks need root. If your SSH user isn’t root, the firewall or failed-login checks may say “unknown”.
  • Distros differ. The checks use common tools; unusual setups may produce incomplete results.
  • Fixing is up to you. The app tells you what it found; you change the server in the terminal.

Make it a habit

Run it after setting up a server, after any big change and every month or two. It takes seconds.

FAQ

What does it check? SSH daemon settings (root login, password authentication, empty passwords, non-default port), listening ports and exposed sensitive services, firewall state, permissions of sensitive files, pending package updates and recent failed logins.

Does it change anything on the server? No. It only reads configuration and state.

Why do some items say “unknown”? Some checks need root, for example firewall state or failed-login history. Without it, the result is marked unknown rather than guessed.

Is it free? Yes. It is in the dashboard’s ••• menu and is not behind the paywall.

The app ServerPanel →