Metadata-Version: 2.4
Name: serverscout
Version: 0.1.1
Summary: Lightweight SSH-based security scanner for Linux servers
Project-URL: Homepage, https://github.com/w1cee/serverscout
Project-URL: Repository, https://github.com/w1cee/serverscout
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: paramiko
Requires-Dist: click
Requires-Dist: rich
Dynamic: license-file

# serverscout

Lightweight SSH-based security scanner for Linux servers.

Checks open ports, firewall rules, SSH config, and malware persistence — no agent required.

## Install

```bash
pip install serverscout
```

## CLI usage

```bash
serverscout --host 1.2.3.4 --key ~/.ssh/id_rsa
serverscout --host 1.2.3.4 --password mypass
```

## Python usage

```python
from serverscout import scan

results = scan([
    {"host": "1.2.3.4", "key": "~/.ssh/id_rsa"},
    {"host": "5.6.7.8", "password": "mypass"},
])
```

Disable Rich output and process results yourself:

```python
results = scan(servers, report=False)

for host, data in results.items():
    if data["status"] == "error":
        print(f"{host}: connection failed — {data['error']}")
        continue
    criticals = [
        msg for section in data["results"].values()
        for severity, msg in section
        if severity == "critical"
    ]
    if criticals:
        print(f"{host}: {len(criticals)} critical issues")
```

## Parallel scanning

```python
from serverscout import scan
from concurrent.futures import ThreadPoolExecutor

servers = [{"host": f"10.0.0.{i}", "key": "~/.ssh/id_rsa"} for i in range(1, 20)]

with ThreadPoolExecutor(max_workers=10) as executor:
    futures = [executor.submit(scan, [s], report=False) for s in servers]
    results = {}
    for f in futures:
        results.update(f.result())
```

## What it checks

| Section | Checks |
|---|---|
| Ports | Dangerous ports exposed to the internet (Redis, Postgres, MongoDB, etc.) |
| Firewall | iptables/nftables rules, fail2ban |
| SSH Config | Root login, password auth, empty passwords, X11 forwarding |
| Persistence | Executables in /tmp, postgres crontab, known malware processes, suspicious outgoing connections |
