Security controls

A control is one thing vps-ready audit checks. There are 29, each with a stable ID you can track in CI, a severity, and the reason it matters. When a module can fix a failed control, audit prints the command under it, for example fix: sudo vps-ready apply --module ssh.server.

Each control ends as one of four outcomes: pass, fail (with the value found), unknown (the fact could not be read, usually without root) or skip (not checked here, for example kernel settings inside a container). Unknown never counts as a pass: audit exits 0 only when no control fails or is unknown.

SSH server

Checks read the effective config from sshd -T, so sshd’s own rules (drop-ins, first value wins) are already applied.

Control	What it checks and why
SSH-001 medium	Root login disabled Root is the one account name every scanner tries, and its actions are not tied to a person. Log in as a named user and use sudo. Fixed by ssh.server
SSH-002 high	Password authentication disabled Passwords can be guessed or reused from leaks; SSH keys cannot be brute-forced. Fixed by ssh.server
SSH-003 high	Keyboard-interactive authentication disabled It is a second way to ask for a password, through PAM, so leaving it on undoes SSH-002. Fixed by ssh.server
SSH-004 high	Empty passwords rejected An account with an empty password could be logged into by name alone. Fixed by ssh.server
SSH-005 low	X11 forwarding disabled A server has no use for graphical apps, and a forwarded display lets the server reach into your desktop session. Fixed by ssh.server
SSH-006 low	Host-based authentication disabled It lets a client machine vouch for its users, so a compromised machine the server trusts can log in as them without their keys. Fixed by ssh.server
SSH-007 low	User environment files ignored With it on, a user’s ~/.ssh/environment can set variables such as LD_PRELOAD, which can bypass restrictions like a forced command. Fixed by ssh.server
SSH-008 low	Repeated failed logins are slowed down Bots try common passwords all day. Holding back an address that keeps failing cuts the log noise and slows down a guess at a weak password. Fixed by ssh.bruteforce

Firewall

Checks read the live nftables ruleset, which also holds the rules of ufw, firewalld and the iptables command.

Control	What it checks and why
FW-001 medium	Incoming traffic denied by default Without it, any service listening on all addresses, such as a database left at its defaults, is reachable from the internet. A firewall at your provider also protects the server, but this check cannot see it. Fixed by firewall.inbound
FW-002 medium	Container ports do not bypass the firewall Traffic to a port Docker publishes is forwarded to the container and skips the input rules of ufw and firewalld: -p 5432:5432 makes a database reachable from anywhere even when the firewall blocks port 5432. Publish on 127.0.0.1 (-p 127.0.0.1:5432:5432) or filter forwarded traffic yourself, e.g. in the DOCKER-USER chain. Fixed by no module yet

Kernel

Checks read /proc/sys, so they see the values the running kernel uses, whichever file set them.

Control	What it checks and why
KRN-001 low	Kernel pointers hidden Kernel memory addresses help an attacker aim a kernel exploit; hiding them from normal users makes that harder. Fixed by kernel.sysctl
KRN-002 low	Kernel log restricted to root The kernel log can reveal addresses and system details useful to an attacker; only admins need to read it. Fixed by kernel.sysctl
KRN-003 medium	Unprivileged BPF disabled Unprivileged BPF has been the entry point for many kernel privilege escalations, and normal users rarely need it. Fixed by kernel.sysctl
KRN-004 medium	ptrace scope restricted Otherwise a compromised process can read the memory of your other processes, including secrets such as keys held by ssh-agent. Fixed by kernel.sysctl
KRN-005 medium	Symlink protection enabled A symlink planted in a shared directory such as /tmp can trick a root process into writing to a file the attacker chose. Fixed by kernel.sysctl
KRN-006 medium	Hardlink protection enabled Hard links to files you do not own let an attacker redirect root’s writes or keep a vulnerable setuid program around. Fixed by kernel.sysctl
KRN-007 low	FIFO protection enabled A FIFO planted in a shared directory such as /tmp can feed a privileged program data it did not expect. Fixed by kernel.sysctl
KRN-008 low	Regular file protection enabled A file planted in a shared directory such as /tmp lets another user control what a privileged program reads or writes. Fixed by kernel.sysctl
KRN-009 low	Setuid core dumps restricted Crash dumps of setuid programs can hold passwords and keys from memory; they must be off or readable only by root. Fixed by kernel.sysctl
KRN-010 medium	Address space randomization fully enabled A random memory layout makes memory-corruption bugs much harder to exploit reliably. Fixed by kernel.sysctl
KRN-011 low	Kernel profiling restricted perf events can expose kernel addresses and timing to any user, and the subsystem has had privilege-escalation bugs. 2 is the kernel’s own restriction; Debian adds 3 and Ubuntu 4, which block more. Fixed by kernel.sysctl

Network

Checks read /proc/sys.

Control	What it checks and why
NET-001 low	TCP SYN cookies enabled SYN cookies keep the server accepting real connections during a SYN flood. Fixed by kernel.sysctl
NET-002 low	Source-routed packets rejected Source-routed packets let the sender pick their path, which can get around network filtering. Fixed by kernel.sysctl
NET-003 low	Broadcast pings ignored Answering broadcast pings lets the server be used to amplify attacks on others. Fixed by kernel.sysctl
NET-004 low	IPv4 reverse path filtering enabled Reverse path filtering drops incoming packets whose source address the server has no route back to, which stops many spoofed packets. Fixed by no module yet
NET-005 medium	IPv4 ICMP redirects not accepted Accepted ICMP redirects change the server’s routes, so a forged redirect can send its traffic through another machine on the local network. Fixed by no module yet
NET-006 low	IPv4 ICMP redirects not sent ICMP redirects tell other hosts on the network to change their routes. A server that forwards packets only for its own containers or tunnels is not the network’s router, so it has no reason to send them. Fixed by no module yet

Updates

Checks read apt’s effective settings from apt-config and the state of its timers and services from systemd, not the files in apt.

Control	What it checks and why
UPD-001 medium	Security updates installed automatically Attackers scan for a flaw soon after its fix is published. Unattended upgrades install security fixes on their own, so a server nobody logs into still gets them. Fixed by updates.auto

Mandatory access control

Checks read the kernel’s state from /sys.

Control	What it checks and why
MAC-001 medium	AppArmor enabled AppArmor confines programs that have a profile, limiting what a compromised one can read, write or run. Debian and Ubuntu enable it by default. Fixed by no module yet

The catalog lives in crates/vps-ready/src/audit/controls, one TOML file per area, so you can review it without reading Rust.