Security monitoring

Security monitoring runs on all plans. The Wazuh agent on the server tracks login attempts, file integrity, configuration and vulnerabilities, and sends events to the security server in the Netherlands. The higher the plan, the more modules are enabled.

Modules by plan

Plan	What is included	When you receive a report
Starter	access threat reports: password brute-force attempts via TTY and SSH on Linux and Proxmox VE, via console and RDP on Windows Server	on an alert
	configuration assessment with OS hardening recommendations	when the service is enabled, on request and on an alert
Advanced	everything in Starter, plus file integrity monitoring: system files are monitored and you are notified of suspicious activity	on an alert
Premium	everything in Advanced, plus vulnerability detection: a report on OS and software vulnerabilities	on request or on an alert

When the service is enabled, we carry out an initial security assessment and send you a report. We fix the findings according to the checklist for your OS after you approve.

Fixing monitoring findings

We fix problems from security monitoring reports: we install updates, change the configuration and close the attack vector. The work is done after your approval.

We fix findings from the security monitoring modules included in your plan. The scope is the same for Linux, Proxmox VE and Windows Server.

Plan	Findings we fix
Starter	configuration assessment, access threats
Advanced	everything in Starter, plus file integrity monitoring
Premium	everything in Advanced, plus detected vulnerabilities

Configuration assessment checks

Linux

Accounts and files: only root has UID 0; all passwords are stored in /etc/shadow; there are no empty passwords; there are no duplicate UIDs; /etc/passwd and /etc/group are owned by root and not writable by group and others; /etc/shadow and /etc/gshadow are owned by root and not accessible to others; sudoers is owned by root and not writable by group and others; the system cron is owned by root and not writable by group and others; the sticky bit is set on /tmp, /var/tmp and /dev/shm.

SSH: root cannot log in with a password; PermitEmptyPasswords no; host-based and rhosts authentication are disabled; private host keys are owned by root and not accessible to others; sshd_config and drop-in files are owned by root and not writable; LogLevel is INFO or VERBOSE; MaxAuthTries is 6 or less; PasswordAuthentication no is an optional check.

Kernel and network stack: ASLR = 2; SYN cookies are enabled; source routing is not allowed; ICMP redirects are not accepted; AppArmor or SELinux is in enforcing mode; hardlink and symlink protection is enabled; ptrace_scope is at least 1; unprivileged eBPF is not allowed; suid_dumpable = 0 or 2.

Network: a firewall is active (ufw, firewalld, iptables or nftables); the insecure remote access services telnet, rexec and rlogin are not running and do not accept connections.

Logs and time: time synchronization is running; logs are written to disk.

Proxmox VE

Proxmox VE firewall: the PVE firewall is enabled and running (pve-firewall status); the datacenter inbound policy is not ACCEPT; the firewall is not disabled at the node level (host.fw).

Management access: 2FA is set up for root@pam; there are no root@pam API tokens without privilege separation.

Updates and kernel: the enterprise repository is not enabled without a subscription; the pvetest / pve-test repository is not used; the newest installed kernel is running.

Guests and data: all LXC containers on the node are unprivileged; at least one backup job is configured; rpcbind (port 111) is not reachable from outside, or the PVE firewall is enabled.

Windows Server

Accounts: Guest (RID 501) is disabled; blank passwords are allowed for local logon only; the minimum password length is at least 8; accounts are locked out after 1 to 10 failed attempts.

Credentials and UAC: LM hashes are not stored; LmCompatibilityLevel is at least 3 (NTLMv2); WDigest does not store passwords in clear text; UAC is enabled; remote UAC restrictions for local administrators are not disabled, which protects against pass-the-hash.

Network: the SMBv1 server is disabled; the SMBv1 client is disabled or removed; anonymous access to SAM, shares and named pipes is restricted; the firewall is enabled in all three profiles; RDP is disabled or requires NLA.

Protection and updates: Defender real-time protection is enabled; Defender signatures are no older than 7 days; the Windows Update service is not disabled; Print Spooler is disabled on domain controllers, and on other servers this check passes automatically.

Logs: logon auditing records both successful and failed attempts. This is required to detect RDP password brute-force attacks.

Security audit and hardening

Available from the Advanced plan for Linux, Proxmox VE and Windows Server. The work is done after your approval.

Linux

1. Installing all updates and enabling automatic updates.
2. Disabling password login.
3. Disabling root login with a password.
4. Setting the default iptables policy to DENY.
5. Setting up allowlists for management access.
6. Reviewing listening ports and disabling unnecessary services.
7. Setting strong passwords for services.
8. Applying the after.rules fix if Docker and UFW are used.
9. Enabling password brute-force protection.
10. Running containers without privileges.
11. Restricting sudo.
12. Setting up a password policy.
13. Applying network sysctl settings.
14. Applying kernel sysctl settings.
15. Mounting special directories with restrictive options.
16. Configuring SSH cryptography.
17. Locking down SSH parameters.

Proxmox VE

1. Installing all updates; further updates are done only with full-upgrade.
2. Closing the web interface and SSH to access from the internet.
3. Enabling 2FA for all administrative accounts.
4. Working under personal accounts instead of root.
5. Enabling the firewall at the datacenter level.
6. Enabling the firewall on the nodes.
7. Setting up backups to Proxmox Backup Server.
8. Installing a valid TLS certificate on the web interface.
9. Protecting the web interface against password brute-force attacks.
10. Sending logs to a central system.
11. Applying basic Linux hardening adapted to Proxmox VE.

Windows Server

1. Installing updates.
2. Securing RDP access.
3. Disabling SMBv1.
4. Disallowing NTLMv1 and LM.
5. Enabling Windows Defender.
6. Enabling all Windows Firewall profiles.
7. Renaming or disabling built-in accounts.
8. Setting up the password and account lockout policy.
9. Applying the Microsoft Security Baseline with the Microsoft Security Compliance Toolkit.

Warning

Some hardening steps change how you access the server: for example, they disable password login or close the web interface to the internet. Before the work, we agree with you on how you will connect afterwards.