Server Security Audit Checklist: 20 Points

Why Security Auditing Is Essential

A security audit is a systematic, comprehensive examination of your systems and servers to discover weaknesses before anyone exploits them. The difference between an audit and penetration testing: an audit reviews everything (policies, configurations, permissions, infrastructure) — while penetration testing focuses on attempting actual exploitation.

The rule: Full security audit every 6 months minimum. Quick monthly audit for critical items.

Comprehensive Audit Checklist

Section 1: Operating System

Item	Check	Status
System updates	All security updates installed
OS version	Supported version, not EOL
Kernel	Latest stable release
Unnecessary services	Disabled and uninstalled
Time synchronization	NTP enabled and running
Temporary files	/tmp with noexec,nosuid

Verification Commands:

# Pending updates
apt list --upgradable 2>/dev/null | wc -l

# OS version
cat /etc/os-release

# Running services
systemctl list-units --type=service --state=running

# Time sync
timedatectl status

Section 2: User Management and Permissions

• Root account disabled for SSH login
• No users with empty passwords
• Every user has defined permissions (no unrestricted sudo)
• Inactive users deleted or disabled
• Password policy enforced (length + complexity + expiration)
• sudoers file reviewed

# Users without passwords
awk -F: '($2 == "" ) {print $1}' /etc/shadow

# Users with sudo access
getent group sudo

# Last login for each user
lastlog | grep -v "Never"

# Check sudoers
cat /etc/sudoers | grep -v "^#" | grep -v "^$"

Section 3: SSH

Item	Required Value
PermitRootLogin	no
PasswordAuthentication	no (SSH keys only)
Port	Non-default (not 22)
MaxAuthTries	3
LoginGraceTime	30
AllowUsers	Specified by username
Protocol	2
X11Forwarding	no

# Check SSH configuration
sshd -T | grep -E "permitrootlogin|passwordauthentication|port|maxauthtries"

Section 4: Firewall

• Firewall enabled (UFW or iptables)
• Default policy: deny incoming
• Open ports defined and documented
• No unnecessary open ports
• Denied attempt logging enabled

# UFW status
ufw status verbose

# Actually open ports
ss -tulnp

# iptables rules
iptables -L -n -v

Section 5: Encryption and SSL

• All sites running over HTTPS
• SSL certificates valid and not expired
• TLS 1.2 minimum (TLS 1.3 preferred)
• SSL 2.0/3.0 and TLS 1.0/1.1 disabled
• HSTS enabled
• Sensitive database encryption active

# Check SSL certificate
openssl s_client -connect yourdomain.com:443 -tls1_3

# Check certificate expiration
echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

Section 6: Backup

Item	Standard
Backup frequency	Daily for data, weekly for system
Retention	7 days daily + 4 weeks weekly
Offsite copy	Exists at different location
Backup encryption	Enabled
Restore testing	Monthly
Procedure documentation	Up to date

Section 7: Monitoring and Logging

• System logs (syslog) running and preserved
• Retention period: 12 months minimum (NCA requirement)
• Immediate alerts for failed login attempts
• Resource usage monitoring (CPU, RAM, Disk)
• fail2ban installed and active
• Weekly log review

# fail2ban status
fail2ban-client status

# Log size
du -sh /var/log/

# Recent failed login attempts
journalctl _SYSTEMD_UNIT=sshd.service | grep "Failed" | tail -20

Section 8: Applications and Databases

• Web applications updated to latest version
• Database does not accept external connections (bind 127.0.0.1)
• Database user has limited permissions (not root)
• No default databases present (test, sample)
• Encrypted connection between application and database

Periodic Audit Schedule

Type	Frequency	Duration
Quick check (SSH, Firewall, Updates)	Weekly	30 minutes
Medium audit (all sections)	Monthly	2-4 hours
Full audit + penetration test	Every 6 months	2-5 days

Automating Audits

Free tools that help:

• Lynis — Comprehensive Linux security audit
• OpenSCAP — Security compliance scanning
• CIS Benchmarks — Reference security standards for every system

# Install and run Lynis
apt install lynis -y
lynis audit system

Start with a Secured Server

CLOUD (cloud.net.sa) servers in Riyadh come with baseline security configurations. Firewall, account isolation, and DDoS protection available as an add-on. A secure foundation that cuts your audit checklist in half.

---

Get Started

Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.