╔══════════════════════════════════════════════════════════════════╗ ║ AUDITORÍA COMPLETA DEL VPS ║ ║ Ubuntu 24.04 ║ ╚══════════════════════════════════════════════════════════════════╝  ================================================================================ 1. INFORMACIÓN DEL SISTEMA ================================================================================ Hostname: sv-2jK2fxf55r.cloud.elastika.pe Fecha y Hora: Wed Jun 11 05:16:42 AM -05 2025 Uptime: up 14 weeks, 1 day, 1 hour, 17 minutes Kernel: 6.8.0-31-generic Arquitectura: x86_64 Distribución: Ubuntu 24.04.2 LTS --- Información de CPU --- Modelo: QEMU Virtual CPU version 2.5+ pc-i440fx-8.2 CPU @ 2.0GHz Núcleos: 2 Carga actual: 0.00 0.11 0.08 --- Información de Memoria --- total used free shared buff/cache available Mem: 1.9Gi 413Mi 164Mi 5.4Mi 1.5Gi 1.5Gi Swap: 0B 0B 0B --- Espacio en Disco --- Filesystem Size Used Avail Use% Mounted on tmpfs 192M 984K 192M 1% /run /dev/sda1 40G 6.9G 31G 19% / tmpfs 960M 0 960M 0% /dev/shm tmpfs 5.0M 0 5.0M 0% /run/lock tmpfs 192M 12K 192M 1% /run/user/0 ================================================================================ 2. SERVICIOS Y PROCESOS ================================================================================ --- Servicios del Sistema Activos --- apache-htcacheclean.service loaded active running Disk Cache Cleaning Daemon for Apache HTTP Server apache2.service loaded active running The Apache HTTP Server kmod-static-nodes.service loaded active exited Create List of Static Device Nodes --- Puertos Abiertos --- tcp6 0 0 :::22 :::* LISTEN 1/systemd tcp6 0 0 :::80 :::* LISTEN 33077/apache2 tcp6 0 0 :::443 :::* LISTEN 33077/apache2 --- Procesos que más CPU/Memoria consumen --- USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1456802 0.0 5.8 165092 115148 ? S ../sites-available/apietvasa.transporteurbanogps.click.conf lrwxrwxrwx 1 root root 76 Feb 26 13:26 apietvasa.transporteurbanogps.click-le-ssl.conf -> /etc/apache2/sites-available/apietvasa.transporteurbanogps.click-le-ssl.conf Módulos habilitados: Loaded Modules: core_module (static) so_module (static) watchdog_module (static) http_module (static) log_config_module (static) logio_module (static) version_module (static) unixd_module (static) access_compat_module (shared) --- Nginx --- Estado: No instalado --- Lighttpd --- Estado: No instalado ================================================================================ 4. LENGUAJES DE PROGRAMACIÓN ================================================================================ --- PHP --- Estado: Instalado Versión: PHP 8.3.6 (cli) (built: Dec 2 2024 12:36:18) (NTS) Archivo de configuración: /etc/php/8.3/cli/php.ini Extensiones instaladas (algunas): curl gd json libxml mbstring mysqli pdo_mysql xml xmlreader xmlwriter PHP-FPM: No activo --- Python --- Python 3: Python 3.12.3 --- Node.js --- Estado: No instalado --- Java --- Estado: No instalado --- Ruby --- Estado: No instalado ================================================================================ 5. BASES DE DATOS ================================================================================ --- MySQL --- Estado: No instalado --- MariaDB --- Estado: No instalado --- PostgreSQL --- Estado: No instalado --- Redis --- Estado: No instalado ================================================================================ 6. HERRAMIENTAS Y SERVICIOS ADICIONALES ================================================================================ --- Docker --- Estado: No instalado --- Composer --- Composer: Composer version 2.8.6 2025-02-25 13:03:50 --- Git --- Git: git version 2.43.0 --- Certbot --- Certbot: certbot 2.9.0 Certificados SSL instalados: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Found the following certs: Certificate Name: apietvasa.transporteurbanogps.click Serial Number: 5e28403620a5af11a2b06174b8987052222 Key Type: ECDSA Domains: apietvasa.transporteurbanogps.click Expiry Date: 2025-08-01 05:32:34+00:00 (VALID: 50 days) Certificate Path: /etc/letsencrypt/live/apietvasa.transporteurbanogps.click/fullchain.pem Private Key Path: /etc/letsencrypt/live/apietvasa.transporteurbanogps.click/privkey.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - --- Fail2ban --- Estado: No instalado ================================================================================ 7. SEGURIDAD Y FIREWALL ================================================================================ --- UFW (Uncomplicated Firewall) --- UFW instalado: Sí Estado: Status: active Reglas activas: Status: active To Action From -- ------ ---- [ 1] 80 ALLOW IN Anywhere [ 2] 22 ALLOW IN Anywhere [ 3] 443 ALLOW IN Anywhere [ 4] 80 (v6) ALLOW IN Anywhere (v6) [ 5] 22 (v6) ALLOW IN Anywhere (v6) [ 6] 443 (v6) ALLOW IN Anywhere (v6) --- SSH --- SSH: Activo Puerto SSH: Puerto por defecto (22) Configuración de autenticación: PermitRootLogin yes ================================================================================ 8. USUARIOS Y GRUPOS ================================================================================ --- Usuarios del Sistema --- Usuarios con shell de login: root 0 root --- Usuarios con privilegios sudo --- ================================================================================ 9. LOGS Y MONITOREO ================================================================================ --- Logs del Sistema (últimas 10 líneas) --- Syslog: 2025-06-11T05:16:28.870416-05:00 sv-2jK2fxf55r kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:fb:42:67:00:de:fb:c8:6d:a7:08:00 SRC=179.43.191.98 DST=161.132.38.41 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=54321 PROTO=TCP SPT=45922 DPT=8000 WINDOW=65535 RES=0x00 SYN URGP=0 2025-06-11T05:16:40.283270-05:00 sv-2jK2fxf55r kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:fb:42:67:00:de:fb:c8:6d:a7:08:00 SRC=185.242.226.54 DST=161.132.38.41 LEN=44 TOS=0x00 PREC=0x00 TTL=237 ID=54321 PROTO=TCP SPT=44732 DPT=8284 WINDOW=65535 RES=0x00 SYN URGP=0 2025-06-11T05:16:51.168799-05:00 sv-2jK2fxf55r qemu-ga: info: guest-file-open called, filepath: /proc/meminfo, mode: r 2025-06-11T05:16:51.169210-05:00 sv-2jK2fxf55r qemu-ga: info: guest-file-open, handle: 20105 2025-06-11T05:16:51.264355-05:00 sv-2jK2fxf55r qemu-ga: info: guest-file-close called, handle: 20105 Auth log: 2025-06-11T05:15:11.623038-05:00 sv-2jK2fxf55r sshd[1839224]: pam_unix(sshd:auth): check pass; user unknown 2025-06-11T05:15:11.623160-05:00 sv-2jK2fxf55r sshd[1839224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.93.28 2025-06-11T05:15:14.314967-05:00 sv-2jK2fxf55r sshd[1839224]: Failed password for invalid user king from 103.82.93.28 port 51354 ssh2 2025-06-11T05:15:15.109141-05:00 sv-2jK2fxf55r sshd[1839224]: Received disconnect from 103.82.93.28 port 51354:11: Bye Bye [preauth] 2025-06-11T05:15:15.109412-05:00 sv-2jK2fxf55r sshd[1839224]: Disconnected from invalid user king 103.82.93.28 port 51354 [preauth] Apache Error Log: [Wed Jun 11 00:00:03.612967 2025] [mpm_prefork:notice] [pid 33077] AH00163: Apache/2.4.58 (Ubuntu) OpenSSL/3.0.13 configured -- resuming normal operations [Wed Jun 11 00:00:03.613159 2025] [core:notice] [pid 33077] AH00094: Command line: '/usr/sbin/apache2' ================================================================================ 10. TAREAS PROGRAMADAS ================================================================================ --- Cron Jobs del Sistema --- /etc/cron.d/: drwxr-xr-x 2 root root 4096 Feb 26 13:22 . drwxr-xr-x 116 root root 4096 Jun 11 05:11 .. -rw-r--r-- 1 root root 802 Apr 16 2023 certbot -rw-r--r-- 1 root root 201 Apr 8 2024 e2scrub_all -rw-r--r-- 1 root root 712 Jan 18 2024 php -rw-r--r-- 1 root root 102 Apr 23 2024 .placeholder -rw-r--r-- 1 root root 396 Apr 23 2024 sysstat /etc/cron.daily/: drwxr-xr-x 2 root root 4096 Feb 26 12:53 . drwxr-xr-x 116 root root 4096 Jun 11 05:11 .. -rwxr-xr-x 1 root root 539 Mar 18 2024 apache2 -rwxr-xr-x 1 root root 376 Apr 18 2024 apport -rwxr-xr-x 1 root root 1478 Mar 22 2024 apt-compat -rwxr-xr-x 1 root root 123 Feb 4 2024 dpkg -rwxr-xr-x 1 root root 377 Apr 23 2024 logrotate -rwxr-xr-x 1 root root 1395 Apr 23 2024 man-db -rw-r--r-- 1 root root 102 Apr 23 2024 .placeholder -rwxr-xr-x 1 root root 518 Apr 23 2024 sysstat /etc/cron.hourly/: drwxr-xr-x 2 root root 4096 Apr 26 2024 . drwxr-xr-x 116 root root 4096 Jun 11 05:11 .. -rw-r--r-- 1 root root 102 Apr 23 2024 .placeholder /etc/cron.monthly/: drwxr-xr-x 2 root root 4096 Apr 26 2024 . drwxr-xr-x 116 root root 4096 Jun 11 05:11 .. -rw-r--r-- 1 root root 102 Apr 23 2024 .placeholder /etc/cron.weekly/: drwxr-xr-x 2 root root 4096 Apr 26 2024 . drwxr-xr-x 116 root root 4096 Jun 11 05:11 .. -rwxr-xr-x 1 root root 73 Apr 26 2024 fstrim -rwxr-xr-x 1 root root 1055 Apr 23 2024 man-db -rw-r--r-- 1 root root 102 Apr 23 2024 .placeholder /etc/cron.yearly/: drwxr-xr-x 2 root root 4096 Apr 26 2024 . drwxr-xr-x 116 root root 4096 Jun 11 05:11 .. -rw-r--r-- 1 root root 102 Apr 23 2024 .placeholder --- Cron Jobs de Usuarios --- ================================================================================ 11. RESUMEN DE LA AUDITORÍA ================================================================================ ✓ Servidores Web: - Apache: Instalado - Nginx: No instalado ✓ Bases de Datos: - MySQL: No instalado - MariaDB: No instalado - PostgreSQL: No instalado - Redis: No instalado ✓ Lenguajes: - PHP: Instalado - Python 3: Instalado - Node.js: No instalado ✓ Herramientas: - Docker: No instalado - Git: Instalado - Composer: Instalado ================================================================================ Auditoría completada en: Wed Jun 11 05:16:52 AM -05 2025 Para más detalles, revisa las secciones específicas arriba. ================================================================================ Sugerencias: 1. Guarda este reporte: ./audit_script.sh > server_audit_20250611.txt 2. Revisa los logs de errores si hay servicios inactivos 3. Actualiza los paquetes regularmente: sudo apt update && sudo apt upgrade 4. Considera configurar backups automáticos 5. Revisa la configuración de seguridad (SSH, Firewall, Fail2ban)