v0.2.0

Fail2ban SSH jail port alignment check

New check that catches a failure mode where fail2ban appears to be working but blocks nothing.

fail2ban's [sshd] jail inherits port = ssh (port 22) from jail.conf. If sshd listens on a non-standard port, the generated firewall rule reads tcp dport 22 ... reject and every ban is a silent no-op. fail2ban-client status still reports the bans as successful, so nothing looks wrong from the outside.

This was found on a live host running SSH on port 2022: roughly 114,000 brute force attempts over a month, 209 "successful" bans, none of which blocked anything. One source IP sustained the attack for 16 consecutive days without ever being meaningfully blocked.

What the check does

• Resolves the effective SSH port from sshd -T, falling back to the existing config grep
• Compares it against the jail port, honouring fail2ban's file precedence: jail.conf, jail.d/*.conf, jail.local, jail.d/*.local
• Resolves service names (ssh), comma lists (ssh,2222) and ranges (0:65535)
• Treats an allports banaction as covering every port
• Reports WARN when the [sshd] jail is disabled entirely

Example failing output:

[FAIL] Fail2ban Port Alignment - The fail2ban [sshd] jail blocks port 'ssh' but SSH
listens on 2022 - every ban is silently ineffective. Set 'port = 2022' in
/etc/fail2ban/jail.local, or use banaction = nftables[type=allports]

Other changes

• New FAIL2BAN_CONFIG_DIR configuration variable (defaults to /etc/fail2ban)
• Version string bumped to 0.2.0

Full Changelog: v0.1.0...v0.2.0

v0.1.0

First tagged release of vps-audit, a single-file bash script that audits the security and performance posture of a Linux server. No dependencies beyond what a stock Debian or Ubuntu install already ships.

Usage

curl -O https://raw.githubusercontent.com/Nuver-Labs/vps-audit/main/vps-audit.sh
chmod +x vps-audit.sh
sudo ./vps-audit.sh

Every check prints PASS, WARN or FAIL with a short explanation of why, and the whole run is also written to a timestamped report file.

What it checks

Security:

• SSH root login, password authentication, and non-default or unprivileged ports, including Include overrides
• Firewall status across UFW, firewalld, iptables and nftables
• Intrusion prevention via Fail2ban or CrowdSec, including containerized installs
• Failed login attempts, read from auth.log or from journald on Debian 11 and newer
• Pending system updates
• Running service count, listening ports, and how many are publicly exposed
• Sudo logging
• Password policy via pwquality.conf
• SUID files outside standard locations

Performance:

• Disk, memory and CPU usage, load average, and active connections

Configuration

Thresholds and file paths are plain variables at the top of the script, so you can retune the PASS/WARN/FAIL bands or point a check at a non-standard path without touching the logic. The Customization section of the README documents each one.

Known limitations

• Targets Debian and Ubuntu. The update check assumes apt, and package detection assumes dpkg.
• Sudo logging reads /etc/sudoers only, not sudoers.d.
• Requires root or sudo.

Thanks

To everyone who has sent a patch: @latetedemelon, @alvarosaavedrau, @Un1q32, @davefatkin, @jnsvgt, @kyle-mckay, @idosysstuff, @xgboosted, @neod123, @DazEdword and @aafmj.