Suitable for
- Taking over an existing Linux server
- Preparing a major update or migration
- Missing or outdated operations documentation
- Unclear patch, backup or security status
One-time assessment
Know what runs on your Linux server - and what to fix first
Whether the administrator is gone, nobody has looked inside for years or a migration is coming up: we review the existing Linux instance during live operation, document findings and prioritize the next steps. Hardening follows as a second step if required.
- 1-2 business days
- Technical report
- 1-hour results call
- No findings, no charge.
Purpose
Establish a traceable technical baseline
The audit creates a reliable baseline before an operational takeover, an upgrade or the prioritization of technical measures. We review configuration and operating condition and document scope, findings and boundaries.
Not included in the basic audit
- Configuration changes or remediation
- Penetration testing or evidence-preserving forensics
- Backup restore testing
- Full application or source-code audit
Scope
What the basic audit covers
This scope applies to one standard Linux instance and is confirmed before access. Different platforms or multiple systems are scoped separately.
Exposed ports and unnecessary services
Patch level, support status and known vulnerabilities
SSH, root and sudo configuration
Firewall rules and baseline hardening
Indicators of common compromise patterns
Configured backup jobs and recent logs
Retention and offsite concept
Configured encryption
Boundary: no restore test in the basic audit
Disk condition and file systems
Storage utilization, inodes and resources
System and service errors in logs
Database reachability and baseline configuration
Result
Technical report with prioritized measures
The report separates observations, risks and recommendations. During the results call, we discuss priorities, dependencies and possible next steps.
Findings overview
The reviewed areas, identified deviations and their technical urgency are documented in a traceable format.Action plan
Recommended measures are prioritized by risk, dependencies and a practical implementation order.Results review
We review the report in a one-hour call. Remediation or ongoing operations can then be commissioned separately.
Illustrative example
What an audit typically surfaces
Each finding separates the observation, technical impact and recommended action. The examples below are anonymized patterns showing both the report format and the range of what surfaces on a system left unattended for a while.
| Finding | Observation | Impact | Recommendation |
|---|---|---|---|
| Finding SYS-02 · High Operating system no longer receiving security updates | The installed distribution has passed its end of vendor support. Security updates are no longer published for this version. | Newly disclosed vulnerabilities in the kernel and system libraries stay open permanently. Updating individual packages does not close them. | Define and schedule a migration path to a supported version; restrict reachable services until then. |
| Finding NET-01 · High Database service reachable from the internet | The database service listens on all network interfaces and is reachable from the internet. | The service is directly exposed to automated scans and login attempts, with no upstream access control in between. | Bind to the local interface or restrict access to known sources; route application access over the internal network. |
| Finding BAK-03 · High Backup stored on the same system | The configured backup writes to a directory on the same server. No copy outside the system is set up. | If the storage fails or the system is encrypted, the backup is affected as well. It is unavailable precisely when it is needed. | Set up a target outside the system and restrict write access to it from the server. |
| Finding ACC-05 · Medium Administrative accounts without an owner | Several accounts with sudo privileges had not logged in for an extended period. They could not consistently be mapped to people currently involved. | Access nobody owns is overlooked when staff change and simply remains in place. | Map accounts to current owners, disable those that cannot be mapped, and document the assignment. |
- Which of these apply to your system is not known in advance - that is precisely the question the audit answers. If the report contains no finding for which we recommend a measure, we do not invoice it.
Process
How the server audit works
- 01
Agree scope and access
Define scope, maintenance window and time-limited SSH access
- 02
Review the system
Technical review within 1-2 business days, without changes in the basic audit
- 03
Review the report
Technical report and one-hour results call
- 04
Hardening as the second step
Implement the findings on a time-and-materials basis or as quoted; ongoing operations separately if required
Price & request
Audit, hardening and NIS2 operations check
Basic audit of one standard Linux instancefrom €290 netOne-time: review, technical report and a one-hour results call. No findings, no charge.
Payment
- Bank transfer
Multiple systems, clusters, Windows servers or active security incidents: separate quote in advance. Credentials only once scope and price are agreed.
Afterwards or instead
Step 2 · HardeningImplement the findings
SSH, access and permissions, firewall and open services, security updates and package sources, backup configuration according to the report. Time and materials or a quote for the action plan.
Hardening checklist →Variant · NIS2 operations checkTechnical evidence for NIS2
Patch level and security updates, logging, backup and recoverability, access and MFA; report with evidence and open items. Whether NIS2 applies is for your legal advisers.
Compliance operations →After the audit
A finding is only worth something once someone can act on it
Many audit reports end with a list and the question of who implements it. We work on all three levels a finding can land on - and say openly in the results call which of them you actually need.
Secure
- Hardening of SSH, firewall and services
- Remote access through NetBird instead of open ports - we are an official NetBird Reseller Partner
- MFA through your identity provider, not a second user database
- CVE monitoring against NVD, CISA KEV, CERT-Bund and BSI
When the finding concerns access, patch level or exposed services.
See CVE monitoringOperate
- Server operations from €149.90 per month - patching, backup management, monitoring and incident response
- Monitoring only from €49.90 per server and month, if operations stay with you
- For Hetzner, IONOS, OVH, netcup, AWS, Azure and your own hardware
- Server and contract stay in your account - we take on the operations, not the ownership
When the finding shows that nobody looks regularly.
Configure server operationsModernize
- Migration from VMware or Hyper-V to Proxmox
- Moving out of AWS, Azure or GCP to European providers
- Managed Proxmox from €179.90 per node per month
- On-premises, when data must not leave the building
When the server no longer has the right home.
See migration pathsThe audit obliges you to none of this. The report is yours and may be shared internally or with another provider.
Frequently Asked Questions
Details on scope, access, results and boundaries
Process & Security
- No planned shutdown is required for the basic audit. The review is predominantly read-only during live operation; load tests and configuration changes are not included. We agree any special risks or necessary exceptions in advance.
- We generally require time-limited SSH access using a public key and the sudo permissions needed for the agreed scope. Database access or additional permissions are agreed only when required for the review.
- Credentials are not sent by unencrypted email. We agree an appropriate transfer method, such as an encrypted one-time secret link. Temporary accounts and keys should be disabled or revoked after completion.
- A non-disclosure agreement can be concluded before work begins. Where required for the specific access, we additionally agree a data processing agreement.
- After completion, we remove the audit credentials stored in our working systems. The customer revokes temporary accounts and keys, or they are transferred into a controlled operating scope if ongoing operations are commissioned.
Scope & Technology
- We review common Linux distributions such as Ubuntu, Debian, AlmaLinux, Rocky Linux and SUSE/SLES. For unsupported versions, the focus is on risk, migration feasibility and a suitable upgrade path. The end-of-support dates for Debian, Ubuntu and CentOS are listed in the Linux end of life guide.
- Yes. We check both 'bare' Linux servers and systems managed with panels like Plesk, cPanel, LiveConfig or CloudPanel. We specifically check whether the panel itself is securely configured and whether updates are pending.
- The basic audit can identify indicators of common compromise patterns, unusual processes or suspicious persistence mechanisms. It does not replace evidence-preserving incident response or a forensic investigation. If there is a concrete suspicion, we define a separate scope.
- Yes. We check MySQL/MariaDB and PostgreSQL for obvious misconfigurations (e.g. open ports to the outside, default passwords, missing backups). However, we don't do performance tuning of individual SQL queries (that would be application-level). Ongoing database operations are described on the database operations page.
- The basic audit reviews backup configuration, retention and recent job logs. An actual restore test is not included and can be commissioned separately with a suitable target system and agreed procedure, on a regular basis for example with managed backup.
- The audit reviews one Linux instance once from the inside: configuration, access, patch level and backups. The vulnerability scan checks agreed systems automatically with OpenVAS for known vulnerabilities, including network devices and appliances, one-off or recurring. Neither is a penetration test.
Results & Costs
- The starting price applies to one independently reviewable physical or virtual Linux server running common system, web, database or container services. Clusters, orchestration platforms, multiple coupled systems and environments with an active incident concern receive a separate scope in advance.
- No. The basic audit is an assessment without configuration changes. If required, we define a separate scope and quote for suitable remediation measures or an operational takeover. The usual measures are described in the Linux server hardening guide.
- The described basic audit of one standard Linux instance costs from €290 excluding VAT as a one-time fee. It does not create an ongoing management service. Clusters, extensive platforms or additional systems are scoped separately in advance.
- Then we do not invoice the basic audit. The report is the criterion: if it contains no finding for which we recommend a measure, the fee is waived. In practice this rarely happens - on a system nobody has reviewed for a while, there are almost always items that need attention.
- If a finding requires short-term action in our technical assessment, we contact you through the agreed channel before the report is complete. System changes require approval or a separately agreed incident scope.
- Yes. After the audit, the system state, risks, and recommended measures are documented. On that basis, we can offer a clearly defined operating scope for updates, monitoring, backup management, and support.
- Yes. You receive the technical report and prioritized action plan regardless of whether WZ-IT subsequently performs remediation or takes over operations. The report can be used internally or with another service provider.
- Yes, as a second step. Hardening implements the measures from the report, for example on SSH, access, firewall, updates and backup configuration. It is billed on a time-and-materials basis or based on a quote for the action plan.
- A variant of the audit that compiles technical evidence for operations: patch level, logging, backup and access. The price is stated in the quote. The check is not legal advice; whether NIS2 applies to your organisation is for your legal advisers to determine.
- The basic audit described here applies to Linux servers. Windows Server, Active Directory, Exchange and comparable Microsoft environments are outside this offer.
Reviews & projects
Operations that visibly relieve customers
Customer feedback on monitoring, updates, maintenance, support and stable production systems.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
Enquiry
Request a Linux server audit
Tell us the provider, number of systems and reason for the audit. We will contact you with the next steps and clarify any special requirements before commissioning.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.