Design principles
Made for the host
you’re worried about.
A security tool runs as root on exactly that machine. So this one reads and never writes, never executes what it finds, only downloads public data, and tells you plainly what it cannot see.
Read-only
It writes no files unless you pass -o or press s. Although it runs as root, it never executes a program from the host. Versions are read from the contents of binaries instead of running nginx -v, so a replaced ps or ss cannot feed it false output. The end-to-end suite verifies this with strace.
Known exception: reading BPF filters can make the kernel load af_packet_diag, the same effect as ss -0. The report says so when it happens, and --no-netlink turns it off. To see the certificate a scanner such as Censys gets, it makes a TLS handshake to the host’s own HTTPS ports without a server name, and sends no request.
Outbound traffic only downloads public data
Plain GET requests that carry no information about the host. Most are made only when the matching software is found. End-of-life dates come from endoflife.date but are built into the binary, so the scan never contacts it. --offline stops all network use.
| Server | When | What |
|---|---|---|
security-metadata.canonical.com | Always, unless --offline | USN and CVE OVAL data for the host’s release |
nginx.org | Only for non-Ubuntu nginx builds | nginx security advisories |
www.php.net | Only for non-Ubuntu PHP builds | Latest release on each PHP branch |
vuln.go.dev | Only for non-Ubuntu Caddy builds | Go vulnerability database |
api.github.com | Only when LXD is installed | Canonical’s LXD security advisories |
api.snapcraft.io | Only when LXD is installed | Latest LXD version on its branch |
CVE checks do not rely on version numbers alone
Ubuntu backports fixes to older versions, so nginx 1.18.0 may already be patched. Apt packages are always compared against Canonical’s OVAL data, ESM fixes included. Only self-compiled, upstream repository and PPA builds are compared against upstream advisories from nginx.org, php.net or Go’s vulnerability database.
The same applies to end of life: Ubuntu’s own packages are not judged by upstream dates, because Ubuntu backports security fixes into them.
Gentle on production
The slowest test scan took about 2.5 minutes when the OVAL download was slow. The test containers hold few files, so the full filesystem scan takes longer on hosts with many: cap it with --fs-timeout or skip it with --skip-fs. A check that runs out of time keeps what it already found.
Defends against hostile content on the host
- It does not follow symlinks into files users control: a link inside a home directory is reported, not read.
- FIFOs and devices are refused without being opened, so a planted pipe cannot hang the scan.
- Terminal control characters in host details, process names and file names are escaped before they reach your screen.
- Password hashes from /etc/passwd and /etc/shadow are discarded on reading; only the account status and algorithm are kept.
- Common forms of credentials in command lines and configuration are masked. This cannot catch every form, so treat reports as sensitive.
A binary you can verify
People run this binary as root, so the build is treated as part of the product.
Limitations
What it cannot tell you.
A triage tool is only useful if you know where its answers stop.
A clean result does not prove a clean host.
If a rootkit controls the kernel, anything a local tool sees may be falsified. The hidden process and module checks catch common techniques, not all of them. If you suspect a compromise, boot from clean media and perform offline forensics.
Not checked does not mean passed.
Items that lacked permission, timed out or could not reach the network are shown as Not checked, never count as passed, and make the exit code 3 unless there are critical or high findings.
USN data covers only vulnerabilities Ubuntu has fixed, and only apt packages.
Unpatched CVEs and packages from snap, pip, npm or container images are out of scope of the normal scan.
Hash checks trust the local dpkg database.
An attacker who also modifies the database will not be detected by this check.
Webshell detection is signature based.
It catches common samples, not customized or obfuscated ones.
Firewall rules are not evaluated.
It reads ufw’s default policy and IPv6 setting, but does not run iptables or nft and cannot see cloud security groups, so bound to a non-loopback address does not necessarily mean reachable.
Livepatch is not taken into account.
Kernel results compare versions, so CVEs already fixed by Livepatch may still be listed.
Detection is tested with planted samples.
make e2e plants fake backdoors in a container for each Ubuntu release. It does not exercise real rootkits.