Server security: audit, hardening, cleanup
A read-only audit of ports, SSH, firewall, users, scheduled jobs, Docker and exposed files; optional hardening with backups confirmed first and every change recorded; and crypto-miner or malware cleanup with an incident report and a rebuild recommendation when cleanup is not enough.
STYD performs a read-only security audit of Linux VPS servers (ports, firewall, SSH, users, cron and systemd persistence, Docker, exposed files, databases, malware indicators), applies baseline hardening only with written approval, and cleans crypto-miner or malware infections with evidence kept, an incident report and a rebuild recommendation when needed.
The problem
Most business servers were set up once, quickly, by someone who may no longer be around. Since then, ports were opened for a test, a database is listening on the internet, a .env or .git folder is served by the web server, and root can still log in with a password. Nothing looks wrong until a crypto-miner such as kinsing, kdevtmpfsi or xmrig shows up, the host sends an abuse warning, or a credential leaks. Killing the miner process rarely works: it reinstalls itself from cron jobs, systemd services or hidden users.
Who it's for
Businesses running their own Linux VPS for a web app, Odoo, WordPress, Docker, a database or automation tools such as n8n: owners who inherited the server and want to know whether it is safe, and owners of servers showing high CPU, unknown processes or a hosting provider's abuse warning.
The outcome
A server whose real state is known and documented: dangerous exposures closed, SSH and firewall on a sound baseline, sensitive files no longer public, and a clear list of what remains. If the server was infected: the active infection stopped, its persistence removed, evidence preserved, and a written account of what was found, which credentials must be treated as exposed, and whether the server can stay in service or should be rebuilt.
What STYD delivers
STYD first audits the server read-only: inventory, public ports, firewall, SSH configuration, shell users and sudoers, cron and systemd persistence, Docker, web exposure of .env, .git and backup files, SSL, database exposure, basic malware indicators, and where secrets are stored, without exposing their values. Every finding is rated Critical, High, Medium, Low or OK. If you approve hardening, STYD applies the baseline: key-only SSH with root login disabled where safe, a UFW firewall baseline, Fail2ban, unattended security updates without automatic reboot, sensitive-file blocks and safe security headers on Nginx or Apache, and tighter secret-file permissions, validated before and after. If the server is infected, STYD captures evidence before touching anything, investigates processes, listeners, cron, systemd, startup files, temp folders, containers, users and SSH keys, removes only confirmed malicious items (suspicious files are quarantined, not destroyed), rechecks the server and delivers an incident report with a secret rotation plan and, when cleanup is not enough, a rebuild recommendation.
Common questions this service helps with
- Linux VPS security audit
- harden Ubuntu VPS SSH and firewall
- is my VPS server secure
- remove crypto miner from Linux server
- kdevtmpfsi kinsing malware removal
- VPS high CPU unknown process
- VPS provider abuse warning malware
- Odoo VPS hardening
Pricing
Final pricing is confirmed after a short scoping conversation.
FAQ
That is the main risk of careless hardening, so it is gated. Before SSH or firewall rules are touched, STYD confirms written approval, a verified backup or restore point, a provider snapshot where possible, out-of-band console access, and a working non-root user with an SSH key.
Hardening stops. Securing a server that may already be compromised only hides the problem, so the work moves to the cleanup part of this service: evidence first, then removal of the confirmed items, then a recheck.
You can, and it often comes back. Miners reinstall themselves from cron jobs, systemd services, startup files or hidden users. Cleanup means finding and removing all of those, and understanding how they got in.
Manual cleanup cannot guarantee a compromised server is 100% clean. If root-level compromise is suspected or the entry point cannot be found, the honest recommendation is a rebuild on a fresh server, quoted separately.
Audit from $350, audit with hardening from $750, cleanup from $500. Urgent cases, such as a host threatening to suspend the server, are quoted on contact based on the server and the situation.
No server can be guaranteed 100% secure. The work closes common and dangerous exposures, puts access on a sound baseline, and states plainly what remains. Optional monitoring and a monthly care plan can follow once the server is stable, quoted on request.
Application code review, forensic investigation for legal or insurance purposes, and ongoing monitoring are separate. A full rebuild on a fresh server is quoted separately when a server cannot be trusted. This is not a penetration test or a certified compliance audit.
Related STYD services
A read-only, evidence-based review of the custom apps, code and automations your business runs on, and an independent assessment of a system still being built: what is exposed, what is sound, and whether to keep building.
A practical review of how your company runs on its tools: workflows, reports, automations, integrations, hosting. It ends in a prioritised list of what to fix first.
An AI analyst installed on your own Linux server that answers questions from your Odoo, your PostgreSQL or MySQL databases and your documents, read-only. STYD hosts nothing, and you choose the AI behind it.
Tell us about your setup and we'll confirm fit, scope, and pricing.