# Server Audit Checklist

## Complete Audit Checklist

Run these checks in order. Each produces output or identifies a fix.

### 1. Listening Ports

```bash
ss -tlnp
ss -ulnp
ss -tnp state established
```

**Check for:** Ports bound to `0.0.0.0` that should be `127.0.0.1` only.

### 2. Firewall

```bash
ufw status verbose 2>/dev/null || echo "ufw not installed"
iptables -L -n -v 2>/dev/null | head -50
nft list ruleset 2>/dev/null | head -50
```

**Check for:** No firewall rules, all ports open.

### 3. Tailscale

```bash
tailscale status
tailscale funnels 2>/dev/null
```

**Check for:** Funnel exposure, unexpected peers.

### 4. Disk Usage

```bash
df -h / /home /var /tmp
du -sh /* 2>/dev/null | sort -rh | head -20
du -sh /home/rurouni/* 2>/dev/null | sort -rh | head -20
```

**Check for:** Large directories, low disk space.

### 5. Storage

```bash
cat /proc/mdstat
mdadm --detail /dev/md0 2>/dev/null
mount | grep -E "nvme|sda|sdb|sdc|sdd|sde"
systemctl list-timers --all 2>/dev/null | grep -i trim
smartctl -a /dev/nvme0n1 2>/dev/null | grep -E "Model|Temperature|Health"
```

**Check for:** RAID0 without redundancy, missing TRIM, SMART errors.

### 6. Docker

```bash
docker system df
docker info 2>/dev/null | head -40
docker ps -a --format "table {{.Names}}\t{{.Status}}\t{{.Size}}"
```

**Check for:** Dangling images, unbounded logs, no resource limits.

### 7. Docker Container Details

```bash
for c in $(docker ps -q); do
  name=$(docker inspect --format '{{.Name}}' $c 2>/dev/null | sed 's/\///')
  mem=$(docker inspect --format '{{.HostConfig.Memory}}' $c 2>/dev/null)
  log=$(docker inspect --format '{{json .HostConfig.LogConfig}}' $c 2>/dev/null)
  restart=$(docker inspect --format '{{.HostConfig.RestartPolicy.Name}}' $c 2>/dev/null)
  echo "$name: memory=$mem log=$log restart=$restart"
done
```

**Check for:** Memory=0 (no limit), empty log config, no restart policy.

### 8. LLM Stack

```bash
cat ~/.config/llama-swap/config.yaml
ps aux | grep llama-server-sm75 | grep -v grep
nvidia-smi --query-gpu=memory.used,temperature.gpu,power.draw --format=csv
```

**Check for:** High VRAM usage, high temperature, model config issues.

### 9. Security

```bash
cat /etc/ssh/sshd_config | grep -v "^#" | grep -v "^$"
fail2ban-client status 2>/dev/null
cat /etc/passwd | grep -E "/bin/(bash|fish|sh)$"
aa-status 2>/dev/null | head -10
```

**Check for:** X11Forwarding yes, no fail2ban jails, too many user accounts.

### 10. Backup

```bash
du -sh /backup/* 2>/dev/null
find /backup -type f -exec ls -lh {} \; 2>/dev/null
crontab -l 2>/dev/null
ls /etc/cron.d/ 2>/dev/null
```

**Check for:** Empty backup directory, no backup cron jobs.

### 11. System Health

```bash
uptime
cat /proc/loadavg
ps aux --sort=-%cpu | head -15
ps aux --sort=-%mem | head -15
iostat -x 2>/dev/null | head -30
```

**Check for:** High load average, high CPU/memory usage, disk I/O bottlenecks.

### 12. Kernel Parameters

```bash
sysctl vm.swappiness
sysctl vm.vfs_cache_pressure
sysctl vm.dirty_ratio
ulimit -n
cat /proc/cmdline
```

**Check for:** Default swappiness (60), low open files limit (1024).

### 13. Crash History

```bash
journalctl --since "2 days ago" -p err --no-pager -n 20 2>/dev/null
last reboot 2>/dev/null | head -10
```

**Check for:** Repeated crashes, OOM kills, hardware errors.

## Expected Outputs for This Server

| Check | Expected | Finding |
|-------|----------|---------|
| Listening ports | Services on 127.0.0.1 | 6 ports on 0.0.0.0 |
| Firewall | UFW enabled | No firewall |
| Docker limits | Memory set per container | All containers: 0 |
| Docker logging | max-size=10m max-file=3 | No rotation |
| Backup | Regular rsync/pg_dump | Empty /backup |
| swappiness | 10 | Was 60, now 10 |
| RAID0 | Acceptable for cache | /data is RAID0 |
| SSH | X11Forwarding no | X11Forwarding yes |
| fail2ban | SSH jail active | No jails |
| PostgreSQL | shared_buffers=16GB | shared_buffers=128MB |
| Redis | maxmemory=2gb | No maxmemory |
| CORS | Specific origin | CORS_ALLOW_ORIGIN=* |
| Code execution | Disabled | ENABLE_CODE_EXECUTION=true |