serverscout 0.1.0__tar.gz

serverscout-0.1.0/PKG-INFO

@@ -0,0 +1,82 @@
+Metadata-Version: 2.4
+Name: serverscout
+Version: 0.1.0
+Summary: Lightweight SSH-based security scanner for Linux servers
+License: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: paramiko
+Requires-Dist: click
+Requires-Dist: rich
+
+# serverscout
+
+Lightweight SSH-based security scanner for Linux servers.
+
+Checks open ports, firewall rules, SSH config, and malware persistence — no agent required.
+
+## Install
+
+```bash
+pip install serverscout
+```
+
+## CLI usage
+
+```bash
+serverscout --host 1.2.3.4 --key ~/.ssh/id_rsa
+serverscout --host 1.2.3.4 --password mypass
+```
+
+## Python usage
+
+```python
+from serverscout import scan
+
+results = scan([
+    {"host": "1.2.3.4", "key": "~/.ssh/id_rsa"},
+    {"host": "5.6.7.8", "password": "mypass"},
+])
+```
+
+Disable Rich output and process results yourself:
+
+```python
+results = scan(servers, report=False)
+
+for host, data in results.items():
+    if data["status"] == "error":
+        print(f"{host}: connection failed — {data['error']}")
+        continue
+    criticals = [
+        msg for section in data["results"].values()
+        for severity, msg in section
+        if severity == "critical"
+    ]
+    if criticals:
+        print(f"{host}: {len(criticals)} critical issues")
+```
+
+## Parallel scanning
+
+```python
+from serverscout import scan
+from concurrent.futures import ThreadPoolExecutor
+
+servers = [{"host": f"10.0.0.{i}", "key": "~/.ssh/id_rsa"} for i in range(1, 20)]
+
+with ThreadPoolExecutor(max_workers=10) as executor:
+    futures = [executor.submit(scan, [s], report=False) for s in servers]
+    results = {}
+    for f in futures:
+        results.update(f.result())
+```
+
+## What it checks
+
+| Section | Checks |
+|---|---|
+| Ports | Dangerous ports exposed to the internet (Redis, Postgres, MongoDB, etc.) |
+| Firewall | iptables/nftables rules, fail2ban |
+| SSH Config | Root login, password auth, empty passwords, X11 forwarding |
+| Persistence | Executables in /tmp, postgres crontab, known malware processes, suspicious outgoing connections |

serverscout-0.1.0/README.md

@@ -0,0 +1,71 @@
+# serverscout
+
+Lightweight SSH-based security scanner for Linux servers.
+
+Checks open ports, firewall rules, SSH config, and malware persistence — no agent required.
+
+## Install
+
+```bash
+pip install serverscout
+```
+
+## CLI usage
+
+```bash
+serverscout --host 1.2.3.4 --key ~/.ssh/id_rsa
+serverscout --host 1.2.3.4 --password mypass
+```
+
+## Python usage
+
+```python
+from serverscout import scan
+
+results = scan([
+    {"host": "1.2.3.4", "key": "~/.ssh/id_rsa"},
+    {"host": "5.6.7.8", "password": "mypass"},
+])
+```
+
+Disable Rich output and process results yourself:
+
+```python
+results = scan(servers, report=False)
+
+for host, data in results.items():
+    if data["status"] == "error":
+        print(f"{host}: connection failed — {data['error']}")
+        continue
+    criticals = [
+        msg for section in data["results"].values()
+        for severity, msg in section
+        if severity == "critical"
+    ]
+    if criticals:
+        print(f"{host}: {len(criticals)} critical issues")
+```
+
+## Parallel scanning
+
+```python
+from serverscout import scan
+from concurrent.futures import ThreadPoolExecutor
+
+servers = [{"host": f"10.0.0.{i}", "key": "~/.ssh/id_rsa"} for i in range(1, 20)]
+
+with ThreadPoolExecutor(max_workers=10) as executor:
+    futures = [executor.submit(scan, [s], report=False) for s in servers]
+    results = {}
+    for f in futures:
+        results.update(f.result())
+```
+
+## What it checks
+
+| Section | Checks |
+|---|---|
+| Ports | Dangerous ports exposed to the internet (Redis, Postgres, MongoDB, etc.) |
+| Firewall | iptables/nftables rules, fail2ban |
+| SSH Config | Root login, password auth, empty passwords, X11 forwarding |
+| Persistence | Executables in /tmp, postgres crontab, known malware processes, suspicious outgoing connections |

serverscout-0.1.0/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["setuptools>=70", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "serverscout"
+version = "0.1.0"
+description = "Lightweight SSH-based security scanner for Linux servers"
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.11"
+dependencies = [
+    "paramiko",
+    "click",
+    "rich",
+]
+
+[project.scripts]
+serverscout = "serverscout.cli:scan"
+
+[tool.setuptools.packages.find]
+where = ["."]

serverscout-0.1.0/serverscout/__init__.py

@@ -0,0 +1,80 @@
+from .connector import Connector
+from .checks.ports import Ports
+from .checks.firewall import Firewall
+from .checks.ssh_config import SSHConfig
+from .checks.persistence import Persistence
+from .reporter import Reporter
+from rich.progress import Progress, SpinnerColumn, TextColumn
+
+
+def scan(servers: list[dict], report: bool = True) -> dict:
+    """
+    Scan one or more servers for security vulnerabilities.
+
+    Args:
+        servers: list of dicts with keys:
+                 host (required), user (default: root),
+                 key, password, port (default: 22)
+        report:  print Rich report to stdout (default: True)
+
+    Returns:
+        dict keyed by host with scan results per section
+
+    Example:
+        from serverscout import scan
+
+        results = scan([
+            {"host": "1.2.3.4", "key": "~/.ssh/id_rsa"},
+            {"host": "5.6.7.8", "password": "mypass"},
+        ])
+    """
+    all_results = {}
+
+    with Progress(
+        SpinnerColumn(),
+        TextColumn("[progress.description]{task.description}"),
+        transient=True,
+    ) as progress:
+        for server in servers:
+            host = server["host"]
+            task = progress.add_task(f"Connecting to {host}...", total=4)
+
+            conn_args = {
+                "host":     host,
+                "user":     server.get("user", "root"),
+                "key_path": server.get("key"),
+                "password": server.get("password"),
+                "port":     server.get("port", 22),
+            }
+            try:
+                with Connector(**conn_args) as conn:
+                    progress.update(task, description=f"[{host}] Checking ports...")
+                    ports = Ports(conn).check_vulnerable_ports()
+                    progress.advance(task)
+
+                    progress.update(task, description=f"[{host}] Checking firewall...")
+                    firewall = Firewall(conn).check()
+                    progress.advance(task)
+
+                    progress.update(task, description=f"[{host}] Checking SSH config...")
+                    ssh = SSHConfig(conn).check()
+                    progress.advance(task)
+
+                    progress.update(task, description=f"[{host}] Checking persistence...")
+                    persistence = Persistence(conn).check()
+                    progress.advance(task)
+
+                results = {
+                    "ports":       ports,
+                    "firewall":    firewall,
+                    "ssh_config":  ssh,
+                    "persistence": persistence,
+                }
+                if report:
+                    Reporter(host, results).render()
+                all_results[host] = {"status": "ok", "results": results}
+
+            except Exception as e:
+                all_results[host] = {"status": "error", "error": str(e)}
+
+    return all_results

serverscout-0.1.0/serverscout/checks/firewall.py

@@ -0,0 +1,30 @@
+class Firewall:
+    def __init__(self, conn):
+        self.conn = conn
+
+    def check(self):
+        findings = []
+
+        iptables = self.conn.run("iptables -L INPUT -n --line-numbers 2>/dev/null")
+        nft      = self.conn.run("nft list ruleset 2>/dev/null")
+
+        if not iptables and not nft:
+            findings.append(("critical", "No firewall detected (neither iptables nor nftables)"))
+            return findings
+
+        if iptables:
+            if "ACCEPT" in iptables and "DROP" not in iptables and "REJECT" not in iptables:
+                findings.append(("warn", "iptables accepts all traffic, no DROP/REJECT rules found"))
+            else:
+                findings.append(("ok", "iptables is active with restrictive rules"))
+
+        if nft and not iptables:
+            findings.append(("ok", "nftables is active"))
+
+        fail2ban = self.conn.run("systemctl is-active fail2ban 2>/dev/null")
+        if fail2ban != "active":
+            findings.append(("warn", "fail2ban is not running"))
+        else:
+            findings.append(("ok", "fail2ban is active"))
+
+        return findings

serverscout-0.1.0/serverscout/checks/persistence.py

@@ -0,0 +1,66 @@
+class Persistence:
+    def __init__(self, conn):
+        self.conn = conn
+
+    def check(self):
+        findings = []
+
+        # check /tmp and /var/tmp for executable files
+        tmp_exec = self.conn.run("find /tmp /var/tmp -type f -executable 2>/dev/null")
+        if tmp_exec:
+            for f in tmp_exec.splitlines():
+                findings.append(("critical", f"Executable file in /tmp: {f}"))
+        else:
+            findings.append(("ok", "No executable files found in /tmp"))
+
+        # check crontab for all users with login shells
+        users = self.conn.run("getent passwd | awk -F: '$7 !~ /nologin|false/ {print $1}'")
+        for user in users.splitlines():
+            cron = self.conn.run(f"crontab -u {user} -l 2>/dev/null")
+            if cron and "no crontab" not in cron:
+                for line in cron.splitlines():
+                    line = line.strip()
+                    if not line or line.startswith("#"):
+                        continue
+                    findings.append(("warn", f"Crontab entry for {user}: {line}"))
+
+        # check for suspicious systemd user services under postgres
+        pg_systemd = self.conn.run("ls /var/lib/postgresql/.config/systemd/user/ 2>/dev/null")
+        if pg_systemd:
+            findings.append(("critical", f"Systemd user services found under postgres: {pg_systemd}"))
+        else:
+            findings.append(("ok", "No systemd user services found under postgres"))
+
+        # check .bashrc files for suspicious entries
+        for user_home in ["/root", "/var/lib/postgresql"]:
+            bashrc = self.conn.run(f"cat {user_home}/.bashrc 2>/dev/null")
+            suspicious = [
+                line for line in bashrc.splitlines()
+                if any(x in line for x in ["curl", "wget", "bash -i", "/tmp", "nc ", "ncat"])
+            ]
+            if suspicious:
+                findings.append(("critical", f"Suspicious entry in {user_home}/.bashrc: {suspicious[0]}"))
+
+        # check for known malware process names
+        malware_names = ["reflect_client", "reflect_restart", "kinsing", "kdevtmpfsi", "xmrig"]
+        procs = self.conn.run("ps aux")
+        for name in malware_names:
+            if name in procs:
+                findings.append(("critical", f"Suspicious process detected: {name}"))
+
+        # check for outgoing connections on known malware ports
+        suspicious_conns = self.conn.run(
+            "ss -tnp state established 2>/dev/null | awk 'NR>1 {print $4, $5}'"
+        )
+        for line in suspicious_conns.splitlines():
+            parts = line.split()
+            if len(parts) >= 2:
+                dst = parts[1]
+                try:
+                    dst_port = int(dst.rsplit(":", 1)[-1])
+                except ValueError:
+                    continue
+                if dst_port in (9999, 4444, 1337, 31337):
+                    findings.append(("critical", f"Suspicious outgoing connection: {line}"))
+
+        return findings

serverscout-0.1.0/serverscout/checks/ports.py

@@ -0,0 +1,58 @@
+SHOULD_NOT_BE_OPEN = {
+    5432:  "PostgreSQL",
+    3306:  "MySQL",
+    6379:  "Redis",
+    9000:  "ClickHouse native",
+    9009:  "ClickHouse HTTP",
+    27017: "MongoDB",
+    5984:  "CouchDB",
+    2379:  "etcd",
+    2380:  "etcd peer",
+    8500:  "Consul",
+    9200:  "Elasticsearch",
+    9300:  "Elasticsearch cluster",
+    5601:  "Kibana",
+    8888:  "Dev server",
+    9090:  "Prometheus",
+    3000:  "Grafana",
+    9100:  "Node Exporter",
+    23:    "Telnet",
+    111:   "RPC",
+    2049:  "NFS",
+    5672:  "RabbitMQ",
+    15672: "RabbitMQ management",
+    9092:  "Kafka",
+}
+
+
+class Ports:
+    def __init__(self, conn):
+        self.conn = conn
+
+    def get_open_ports(self):
+        output = self.conn.run("ss -tlnpu")
+        tcp, udp = [], []
+        for line in output.splitlines()[1:]:
+            parts = line.split()
+            if len(parts) < 5:
+                continue
+            proto = parts[0]
+            addr  = parts[4]
+            port  = int(addr.rsplit(":", 1)[-1])
+            if "*" in addr or "0.0.0.0" in addr or ":::" in addr:
+                (tcp if "tcp" in proto else udp).append(port)
+        return sorted(set(tcp)), sorted(set(udp))
+
+    def check_vulnerable_ports(self):
+        tcp, udp = self.get_open_ports()
+        vuln_tcp = {p: SHOULD_NOT_BE_OPEN[p] for p in tcp if p in SHOULD_NOT_BE_OPEN}
+        vuln_udp = {p: SHOULD_NOT_BE_OPEN[p] for p in udp if p in SHOULD_NOT_BE_OPEN}
+
+        findings = []
+        for port, name in vuln_tcp.items():
+            findings.append(("critical", f"TCP {port} ({name}) is exposed to the internet"))
+        for port, name in vuln_udp.items():
+            findings.append(("critical", f"UDP {port} ({name}) is exposed to the internet"))
+        if not findings:
+            findings.append(("ok", "No dangerous open ports detected"))
+        return findings

serverscout-0.1.0/serverscout/checks/ssh_config.py

@@ -0,0 +1,34 @@
+class SSHConfig:
+    def __init__(self, conn):
+        self.conn = conn
+
+    def _get(self, key: str) -> str:
+        return self.conn.run(f"sshd -T 2>/dev/null | grep -i '^{key} '").split()[-1].lower()
+
+    def check(self):
+        findings = []
+
+        checks = {
+            "permitrootlogin":        ("prohibit-password", "warn",     "Root login allowed via password"),
+            "passwordauthentication": ("no",                "warn",     "Password authentication is enabled"),
+            "permitemptypasswords":   ("no",                "critical", "Empty passwords are permitted"),
+            "x11forwarding":          ("no",                "warn",     "X11 forwarding is enabled"),
+        }
+
+        for key, (safe_val, severity, msg) in checks.items():
+            try:
+                val = self._get(key)
+                if val != safe_val:
+                    findings.append((severity, f"{msg} ({key} = {val})"))
+                else:
+                    findings.append(("ok", f"{key} = {val}"))
+            except (IndexError, Exception):
+                findings.append(("warn", f"Could not retrieve {key}"))
+
+        port = self.conn.run("sshd -T 2>/dev/null | grep -i '^port '").split()[-1]
+        if port == "22":
+            findings.append(("warn", "SSH is running on default port 22"))
+        else:
+            findings.append(("ok", f"SSH is running on non-default port {port}"))
+
+        return findings

serverscout-0.1.0/serverscout/cli.py

@@ -0,0 +1,62 @@
+import json
+import click
+from .connector import Connector
+from .checks.ports import Ports
+from .checks.firewall import Firewall
+from .checks.ssh_config import SSHConfig
+from .checks.persistence import Persistence
+from .reporter import Reporter
+from rich.progress import Progress, SpinnerColumn, TextColumn
+from rich.console import Console
+
+console = Console()
+
+
+@click.command()
+@click.option("--host",     required=True,                 help="Server IP or hostname")
+@click.option("--user",     default="root",                help="SSH user (default: root)")
+@click.option("--key",      default=None,                  help="Path to private key")
+@click.option("--password", default=None,                  help="SSH password")
+@click.option("--port",     default=22, show_default=True, help="SSH port")
+@click.option("--json",     "as_json", is_flag=True,       help="Output results as JSON")
+def scan(host, user, key, password, port, as_json):
+    """Scan a remote server for security vulnerabilities and suspicious activity."""
+    with Progress(
+        SpinnerColumn(),
+        TextColumn("[progress.description]{task.description}"),
+        transient=True,
+    ) as progress:
+        task = progress.add_task(f"Connecting to {host}...", total=4)
+
+        with Connector(host, user, key, password, port) as conn:
+            progress.update(task, description=f"[{host}] Checking ports...")
+            ports = Ports(conn).check_vulnerable_ports()
+            progress.advance(task)
+
+            progress.update(task, description=f"[{host}] Checking firewall...")
+            firewall = Firewall(conn).check()
+            progress.advance(task)
+
+            progress.update(task, description=f"[{host}] Checking SSH config...")
+            ssh = SSHConfig(conn).check()
+            progress.advance(task)
+
+            progress.update(task, description=f"[{host}] Checking persistence...")
+            persistence = Persistence(conn).check()
+            progress.advance(task)
+
+    results = {
+        "ports":       ports,
+        "firewall":    firewall,
+        "ssh_config":  ssh,
+        "persistence": persistence,
+    }
+
+    if as_json:
+        click.echo(json.dumps({host: {"status": "ok", "results": results}}, indent=2))
+    else:
+        Reporter(host, results).render()
+
+
+if __name__ == "__main__":
+    scan()

serverscout-0.1.0/serverscout/connector.py

@@ -0,0 +1,37 @@
+import paramiko
+
+
+class Connector:
+    def __init__(self, host: str, user: str = "root", key_path: str = None, password: str = None, port: int = 22):
+        self.host = host
+        self.user = user
+        self.key_path = key_path
+        self.password = password
+        self.port = port
+        self.client = None
+
+    def connect(self):
+        self.client = paramiko.SSHClient()
+        self.client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        self.client.connect(
+            hostname=self.host,
+            port=self.port,
+            username=self.user,
+            key_filename=self.key_path,
+            password=self.password,
+        )
+        return self
+
+    def run(self, cmd: str) -> str:
+        _, stdout, _ = self.client.exec_command(cmd)
+        return stdout.read().decode().strip()
+
+    def disconnect(self):
+        if self.client:
+            self.client.close()
+
+    def __enter__(self):
+        return self.connect()
+
+    def __exit__(self, *_):
+        self.disconnect()

serverscout-0.1.0/serverscout/reporter.py

@@ -0,0 +1,60 @@
+from rich.console import Console
+from rich.table import Table
+from rich import box
+from rich.text import Text
+
+console = Console()
+
+ICONS  = {"ok": "✓", "warn": "⚠", "critical": "✗"}
+COLORS = {"ok": "green", "warn": "yellow", "critical": "red"}
+SCORES = {"ok": 0, "warn": 1, "critical": 3}
+
+SECTION_NAMES = {
+    "ports":       "Ports",
+    "firewall":    "Firewall",
+    "ssh_config":  "SSH Config",
+    "persistence": "Malware / Persistence",
+}
+
+
+class Reporter:
+    def __init__(self, host: str, results: dict):
+        self.host = host
+        self.results = results
+
+    def render(self):
+        console.print(f"\n[bold]serverscout report — {self.host}[/bold]\n")
+
+        total_score = 0
+
+        for section, findings in self.results.items():
+            table = Table(
+                title=SECTION_NAMES.get(section, section),
+                box=box.SIMPLE_HEAVY,
+                show_header=False,
+                padding=(0, 1),
+            )
+            table.add_column("", width=2)
+            table.add_column("Description")
+
+            for severity, msg in findings:
+                color = COLORS[severity]
+                icon  = ICONS[severity]
+                table.add_row(
+                    Text(icon, style=f"bold {color}"),
+                    Text(msg,  style=color if severity != "ok" else "default"),
+                )
+                total_score += SCORES[severity]
+
+            console.print(table)
+
+        if total_score == 0:
+            verdict = "[bold green]All clean[/bold green]"
+        elif total_score <= 3:
+            verdict = "[bold yellow]Minor issues found[/bold yellow]"
+        elif total_score <= 8:
+            verdict = "[bold red]Needs attention[/bold red]"
+        else:
+            verdict = "[bold red on white]CRITICAL[/bold red on white]"
+
+        console.print(f"Total score: {total_score} — {verdict}\n")

serverscout-0.1.0/serverscout.egg-info/PKG-INFO

@@ -0,0 +1,82 @@
+Metadata-Version: 2.4
+Name: serverscout
+Version: 0.1.0
+Summary: Lightweight SSH-based security scanner for Linux servers
+License: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: paramiko
+Requires-Dist: click
+Requires-Dist: rich
+
+# serverscout
+
+Lightweight SSH-based security scanner for Linux servers.
+
+Checks open ports, firewall rules, SSH config, and malware persistence — no agent required.
+
+## Install
+
+```bash
+pip install serverscout
+```
+
+## CLI usage
+
+```bash
+serverscout --host 1.2.3.4 --key ~/.ssh/id_rsa
+serverscout --host 1.2.3.4 --password mypass
+```
+
+## Python usage
+
+```python
+from serverscout import scan
+
+results = scan([
+    {"host": "1.2.3.4", "key": "~/.ssh/id_rsa"},
+    {"host": "5.6.7.8", "password": "mypass"},
+])
+```
+
+Disable Rich output and process results yourself:
+
+```python
+results = scan(servers, report=False)
+
+for host, data in results.items():
+    if data["status"] == "error":
+        print(f"{host}: connection failed — {data['error']}")
+        continue
+    criticals = [
+        msg for section in data["results"].values()
+        for severity, msg in section
+        if severity == "critical"
+    ]
+    if criticals:
+        print(f"{host}: {len(criticals)} critical issues")
+```
+
+## Parallel scanning
+
+```python
+from serverscout import scan
+from concurrent.futures import ThreadPoolExecutor
+
+servers = [{"host": f"10.0.0.{i}", "key": "~/.ssh/id_rsa"} for i in range(1, 20)]
+
+with ThreadPoolExecutor(max_workers=10) as executor:
+    futures = [executor.submit(scan, [s], report=False) for s in servers]
+    results = {}
+    for f in futures:
+        results.update(f.result())
+```
+
+## What it checks
+
+| Section | Checks |
+|---|---|
+| Ports | Dangerous ports exposed to the internet (Redis, Postgres, MongoDB, etc.) |
+| Firewall | iptables/nftables rules, fail2ban |
+| SSH Config | Root login, password auth, empty passwords, X11 forwarding |
+| Persistence | Executables in /tmp, postgres crontab, known malware processes, suspicious outgoing connections |

serverscout-0.1.0/serverscout.egg-info/SOURCES.txt

@@ -0,0 +1,17 @@
+README.md
+pyproject.toml
+serverscout/__init__.py
+serverscout/cli.py
+serverscout/connector.py
+serverscout/reporter.py
+serverscout.egg-info/PKG-INFO
+serverscout.egg-info/SOURCES.txt
+serverscout.egg-info/dependency_links.txt
+serverscout.egg-info/entry_points.txt
+serverscout.egg-info/requires.txt
+serverscout.egg-info/top_level.txt
+serverscout/checks/__init__.py
+serverscout/checks/firewall.py
+serverscout/checks/persistence.py
+serverscout/checks/ports.py
+serverscout/checks/ssh_config.py

serverscout-0.1.0/serverscout.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

serverscout-0.1.0/serverscout.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+serverscout = serverscout.cli:scan

serverscout-0.1.0/serverscout.egg-info/requires.txt

@@ -0,0 +1,3 @@
+paramiko
+click
+rich

serverscout-0.1.0/serverscout.egg-info/top_level.txt

@@ -0,0 +1,2 @@
+dist
+serverscout

serverscout-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+