Features · Server scanning
Server scanning
Every layer of the server, checked every six hours
One small agent runs the scanners a careful administrator would run by hand — vulnerabilities, malware, rootkits, SSH posture, file changes — and turns what they find into one scored list. It runs at the lowest CPU and disk priority and exits between runs, so live sites never notice it.
What it does
The established tools, run properly
Trivy for package vulnerabilities, ClamAV and MalDet for malware and PHP web shells, rkhunter for rootkits and altered system binaries. Heavy scanners work incrementally, so a large server reaches full coverage over several runs instead of timing out on the first.
Findings that respect how Linux is patched
AlmaLinux and RHEL fix vulnerabilities by backporting patches under the old version number. Astrari reads backports, TuxCare and KernelCare extended support, and which kernel is actually running, so the score reflects real exposure rather than version strings.
Fixes from the dashboard
Common hardening findings — SSH root login, password authentication, unsafe settings — come with a one-click fix the agent applies on its next check-in. Anything it changes is recorded against the finding. OS updates run the same way, with database, web server, PHP, mail server and container packages held back by default because updating them restarts the service; a separate service-package update is coming.
A scan that can't finish says so
If a scanner times out or fails, Astrari raises a scanner-error finding rather than reporting nothing. An empty malware result means nothing was found, not that nothing was checked. These clear on their own when a later run completes.
What it finds
- ▸ Known CVEs in installed OS packages, matched against NVD and OSV
- ▸ Vulnerable dependencies in Ruby, Node.js, PHP and Python applications on the server, reported per application
- ▸ Malware, PHP web shells and obfuscated backdoors in web roots, including cPanel and Plesk accounts
- ▸ Rootkits, backdoors and modified system commands
- ▸ Unsafe SSH settings — root login, password authentication, empty passwords
- ▸ Files added or changed since the baseline taken on the first run
- ▸ End-of-life runtimes such as PHP, Node.js, Python and MySQL versions past vendor support
- ▸ Inactive firewalls, services listening on every interface, expiring TLS certificates
Example finding
sudo — 1 high CVE
Installed sudo package is affected by a privilege-escalation vulnerability. The finding names the CVE, the installed and fixed versions, and whether your distribution has already backported the fix.
How it works
- 1
Install the agent with one command
A single static Go binary on a systemd timer. It makes outbound HTTPS calls only — no inbound ports, no SSH from Astrari.
- 2
First scan within a minute
The agent checks in every 30 seconds. A full scan runs every six hours; the heavier malware and rootkit scanners run weekly and catch up incrementally.
- 3
Findings are scored and deduplicated
The same issue on the next scan updates the existing finding instead of creating a new one, and a finding that clears is resolved automatically.
- 4
Act from one list
Apply a fix, acknowledge a risk you accept, or run any scanner on demand. Alerts go to email, Slack, Teams, PagerDuty or a signed webhook, depending on your plan.
Plans
Server scanning is included on every plan, including the free Starter plan (one server). Basic covers two servers, Professional five and Agency twenty-five. Compare plans.
Good to know
- ▸ Supports 64-bit Linux with systemd, on x86-64 or ARM64.
- ▸ ClamAV is used when it is already installed; the agent installs scanners only when you choose to from the dashboard.
See it on your own servers
The free Starter plan covers one website and one Linux server. The agent installs with one command and reports its first scan within a minute.