A read-only script that checks the things that actually get servers owned - SSH config, firewall, updates, accounts, kernel settings, auditing, file integrity - and gives you a grade with exact fixes. Runs in seconds, changes nothing.
A security tool you pipe from the internet into a shell is a contradiction, so this one is a download you inspect first. It contains no curl, wget, apt, or a single write - it only reads config and prints a report. Root isn't required (some checks just say "run as root" without it).
# inspect it first (it's short), then run
curl -O https://alertkick.com/tools/hardening-audit.sh
less hardening-audit.sh
sudo bash hardening-audit.shDownloading with curl -O then reading is the point - never pipe an unread script straight into a shell, this one included.
sshd -T config when run as root)/etcGrade an A today and you've earned it - then someone re-enables password auth for a contractor, a deploy opens a port, an upgrade rewrites a config, and the A quietly decays. This script has no way to notice that; nobody re-runs an audit on a server that isn't complaining, which is exactly how servers get owned. For the fixes behind each finding, the hardening checklists walk through them per distro (Debian, RHEL family).
AlertKick's agent watches these same controls continuously - and pages you when sshd_config changes, a port opens, or a system file is modified. The audit becomes a live guarantee instead of a Tuesday snapshot. Free tier, no card.