[2025-08-23 02:44:46] [INFO] Starting comprehensive system audit on audrey
[2025-08-23 02:44:46] [INFO] Output directory: /tmp/system_audit_audrey_20250823_024446
[2025-08-23 02:44:46] [INFO] Script version: 2.0
[2025-08-23 02:44:46] [INFO] Validating environment and dependencies...
[2025-08-23 02:44:46] [WARN] Optional tool not found: podman
[2025-08-23 02:44:46] [WARN] Optional tool not found: vnstat
[2025-08-23 02:44:46] [INFO] Environment validation completed
[2025-08-23 02:44:46] [INFO] Running with root privileges
[2025-08-23 02:44:46] [INFO] Running module: collect_system_info

[0;34m==== SYSTEM INFORMATION ====[0m

[0;32m--- Basic System Details ---[0m
Hostname: audrey
FQDN: audrey
IP Addresses: 192.168.50.145 100.118.220.45 172.17.0.1 172.18.0.1 172.19.0.1 fd56:f1f9:1afc:8f71:36cf:f6ff:fee7:6530 fd7a:115c:a1e0::c934:dc2d 
Date/Time: Sat Aug 23 02:44:46 AM UTC 2025
Uptime:  02:44:46 up 30 days,  2:54,  2 users,  load average: 0.28, 0.60, 0.68
Load Average: 0.28 0.60 0.68 1/423 2956212
Architecture: x86_64
Kernel: 6.14.0-24-generic
Distribution: Ubuntu 24.04.3 LTS
Kernel Version: #24~24.04.3-Ubuntu SMP PREEMPT_DYNAMIC Mon Jul  7 16:39:17 UTC 2

[0;32m--- Hardware Information ---[0m
Architecture:                         x86_64
CPU op-mode(s):                       32-bit, 64-bit
Address sizes:                        39 bits physical, 48 bits virtual
Byte Order:                           Little Endian
CPU(s):                               2
On-line CPU(s) list:                  0,1
Vendor ID:                            GenuineIntel
BIOS Vendor ID:                       GenuineIntel
Model name:                           Intel(R) Celeron(R) N4000 CPU @ 1.10GHz
BIOS Model name:                      Intel(R) Celeron(R) N4000 CPU @ 1.10GHz  CPU @ 0.0GHz
BIOS CPU family:                      12
CPU family:                           6
Model:                                122
Thread(s) per core:                   1
Core(s) per socket:                   2
Socket(s):                            1
Stepping:                             1
CPU(s) scaling MHz:                   96%
CPU max MHz:                          2600.0000
CPU min MHz:                          800.0000
BogoMIPS:                             2188.80
Flags:                                fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg cx16 xtpr pdcm sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave rdrand lahf_lm 3dnowprefetch cpuid_fault cat_l2 pti cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust sgx smep erms mpx rdt_a rdseed smap clflushopt intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts vnmi umip rdpid sgx_lc md_clear arch_capabilities
Virtualization:                       VT-x
L1d cache:                            48 KiB (2 instances)
L1i cache:                            64 KiB (2 instances)
L2 cache:                             4 MiB (1 instance)
NUMA node(s):                         1
NUMA node0 CPU(s):                    0,1
Vulnerability Gather data sampling:   Not affected
Vulnerability Ghostwrite:             Not affected
Vulnerability Itlb multihit:          Not affected
Vulnerability L1tf:                   Not affected
Vulnerability Mds:                    Not affected
Vulnerability Meltdown:               Mitigation; PTI
Vulnerability Mmio stale data:        Not affected
Vulnerability Reg file data sampling: Mitigation; Clear Register File
Vulnerability Retbleed:               Not affected
Vulnerability Spec rstack overflow:   Not affected
Vulnerability Spec store bypass:      Mitigation; Speculative Store Bypass disabled via prctl
Vulnerability Spectre v1:             Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2:             Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS Not affected; BHI SW loop, KVM SW loop
Vulnerability Srbds:                  Not affected
Vulnerability Tsx async abort:        Not affected
               total        used        free      shared  buff/cache   available
Mem:           3.7Gi       1.1Gi       302Mi       2.3Mi       2.6Gi       2.6Gi
Swap:          3.7Gi       508Ki       3.7Gi
Filesystem                            Size  Used Avail Use% Mounted on
tmpfs                                 378M  2.1M  376M   1% /run
efivarfs                               64K  2.8K   57K   5% /sys/firmware/efi/efivars
/dev/sda2                             113G   15G   93G  14% /
tmpfs                                 1.9G     0  1.9G   0% /dev/shm
tmpfs                                 5.0M     0  5.0M   0% /run/lock
/dev/sda1                             1.1G  6.2M  1.1G   1% /boot/efi
192.168.50.107:/export/audrey_backup  7.3T  306G  7.0T   5% /mnt/omv-backup
tmpfs                                 378M   12K  378M   1% /run/user/1000
overlay                               113G   15G   93G  14% /var/lib/docker/overlay2/bd850def42e5f1ffe8aa9db20670d6e31115c303c4f31b035d5c5e5b4ed76798/merged
overlay                               113G   15G   93G  14% /var/lib/docker/overlay2/9174a91cfba55e021606a61b9b24db72c6f4fa5e56196b7660a4f9490df5e2a8/merged
overlay                               113G   15G   93G  14% /var/lib/docker/overlay2/d7c9480076e10ab7a94dd7fb54d89c9df7048cc867edbffa907ed9df3cf982fb/merged
overlay                               113G   15G   93G  14% /var/lib/docker/overlay2/25ab0c6ca302cdbdcf23f9af6dc747b1ea8aa2b01fa7ea09ead01d3a30d18bed/merged
NAME         MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
loop0          7:0    0  13.2M  1 loop /snap/canonical-livepatch/338
loop1          7:1    0  13.2M  1 loop /snap/canonical-livepatch/341
loop3          7:3    0  73.9M  1 loop /snap/core22/2045
loop4          7:4    0  66.8M  1 loop /snap/core24/1006
loop5          7:5    0  66.8M  1 loop /snap/core24/1055
loop6          7:6    0  50.9M  1 loop /snap/snapd/24718
loop7          7:7    0  49.3M  1 loop /snap/snapd/24792
loop8          7:8    0  28.4M  1 loop /snap/tailscale/108
loop9          7:9    0  27.1M  1 loop /snap/tailscale/97
loop10         7:10   0  73.9M  1 loop /snap/core22/2082
sda            8:0    1 115.5G  0 disk 
├─sda1         8:1    1     1G  0 part /boot/efi
└─sda2         8:2    1 114.4G  0 part /
mmcblk0      179:0    0  58.2G  0 disk 
├─mmcblk0p1  179:1    0  49.4G  0 part 
├─mmcblk0p2  179:2    0    32M  0 part 
├─mmcblk0p3  179:3    0     4G  0 part 
├─mmcblk0p4  179:4    0    32M  0 part 
├─mmcblk0p5  179:5    0     4G  0 part 
├─mmcblk0p6  179:6    0   512B  0 part 
├─mmcblk0p7  179:7    0   512B  0 part 
├─mmcblk0p8  259:0    0    16M  0 part 
├─mmcblk0p9  259:1    0   512B  0 part 
├─mmcblk0p10 259:2    0   512B  0 part 
├─mmcblk0p11 259:3    0     8M  0 part 
└─mmcblk0p12 259:4    0    32M  0 part 
mmcblk0boot0 179:8    0     4M  1 disk 
mmcblk0boot1 179:16   0     4M  1 disk 
00:00.0 Host bridge: Intel Corporation Gemini Lake Host Bridge (rev 03)
00:00.1 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor Dynamic Platform and Thermal Framework Processor Participant (rev 03)
00:02.0 VGA compatible controller: Intel Corporation GeminiLake [UHD Graphics 600] (rev 03)
00:0c.0 Network controller: Intel Corporation Gemini Lake PCH CNVi WiFi (rev 03)
00:0e.0 Multimedia audio controller: Intel Corporation Celeron/Pentium Silver Processor High Definition Audio (rev 03)
00:15.0 USB controller: Intel Corporation Celeron/Pentium Silver Processor USB 3.0 xHCI Controller (rev 03)
00:16.0 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor I2C 0 (rev 03)
00:17.0 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor I2C 4 (rev 03)
00:17.1 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor I2C 5 (rev 03)
00:17.2 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor I2C 6 (rev 03)
00:18.0 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor Serial IO UART Host Controller (rev 03)
00:18.2 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor Serial IO UART Host Controller (rev 03)
00:19.0 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor Serial IO SPI Host Controller (rev 03)
00:19.2 Signal processing controller: Intel Corporation Celeron/Pentium Silver Processor Serial IO SPI Host Controller (rev 03)
00:1c.0 SD Host controller: Intel Corporation Celeron/Pentium Silver Processor SDA Standard Compliant SD Host Controller (rev 03)
00:1f.0 ISA bridge: Intel Corporation Celeron/Pentium Silver Processor PCI-default ISA-bridge (rev 03)
00:1f.1 SMBus: Intel Corporation Celeron/Pentium Silver Processor Gaussian Mixture Model (rev 03)
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 04f2:b657 Chicony Electronics Co., Ltd 720p HD Camera
Bus 001 Device 003: ID 8087:0aaa Intel Corp. Bluetooth 9460/9560 Jefferson Peak (JfP)
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 002 Device 002: ID 154b:1006 PNY USB 3.2.1 FD
[2025-08-23 02:44:46] [INFO] Running module: collect_network_info

[0;34m==== NETWORK INFORMATION ====[0m

[0;32m--- Network Interfaces ---[0m
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: wlp0s12f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 34:cf:f6:e7:65:30 brd ff:ff:ff:ff:ff:ff
    inet 192.168.50.145/24 brd 192.168.50.255 scope global wlp0s12f0
       valid_lft forever preferred_lft forever
    inet6 fd56:f1f9:1afc:8f71:36cf:f6ff:fee7:6530/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 1764sec preferred_lft 1764sec
    inet6 fe80::36cf:f6ff:fee7:6530/64 scope link 
       valid_lft forever preferred_lft forever
3: tailscale0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 100.118.220.45/32 scope global tailscale0
       valid_lft forever preferred_lft forever
    inet6 fd7a:115c:a1e0::c934:dc2d/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::2db6:c46c:7efd:a53/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:c2:5d:c8:fe brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:c2ff:fe5d:c8fe/64 scope link 
       valid_lft forever preferred_lft forever
5: br-a8c08ace4629: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:31:9c:ba:6b brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 brd 172.18.255.255 scope global br-a8c08ace4629
       valid_lft forever preferred_lft forever
    inet6 fe80::42:31ff:fe9c:ba6b/64 scope link 
       valid_lft forever preferred_lft forever
7: veth8a78a0a@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-a8c08ace4629 state UP group default 
    link/ether 32:81:7f:63:36:ea brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::3081:7fff:fe63:36ea/64 scope link 
       valid_lft forever preferred_lft forever
9: veth86570b3@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-a8c08ace4629 state UP group default 
    link/ether e2:96:41:e2:30:e6 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::e096:41ff:fee2:30e6/64 scope link 
       valid_lft forever preferred_lft forever
11: veth39b59a1@if10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-a8c08ace4629 state UP group default 
    link/ether 22:44:10:87:0c:5f brd ff:ff:ff:ff:ff:ff link-netnsid 2
    inet6 fe80::2044:10ff:fe87:c5f/64 scope link 
       valid_lft forever preferred_lft forever
15: docker_gwbridge: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:b8:f7:cd:c6 brd ff:ff:ff:ff:ff:ff
    inet 172.19.0.1/16 brd 172.19.255.255 scope global docker_gwbridge
       valid_lft forever preferred_lft forever
    inet6 fe80::42:b8ff:fef7:cdc6/64 scope link 
       valid_lft forever preferred_lft forever
48: vethe28bdc9@if47: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether 3e:65:5e:d4:2e:5e brd ff:ff:ff:ff:ff:ff link-netnsid 3
    inet6 fe80::3c65:5eff:fed4:2e5e/64 scope link 
       valid_lft forever preferred_lft forever
default via 192.168.50.1 dev wlp0s12f0 proto static 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 
172.18.0.0/16 dev br-a8c08ace4629 proto kernel scope link src 172.18.0.1 
172.19.0.0/16 dev docker_gwbridge proto kernel scope link src 172.19.0.1 linkdown 
192.168.50.0/24 dev wlp0s12f0 proto kernel scope link src 192.168.50.145 
# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search tail6ca08d.ts.net
Netid State  Recv-Q Send-Q               Local Address:Port  Peer Address:PortProcess
udp   UNCONN 0      0                          0.0.0.0:42857      0.0.0.0:*          
udp   UNCONN 0      0                       127.0.0.54:53         0.0.0.0:*          
udp   UNCONN 0      0                    127.0.0.53%lo:53         0.0.0.0:*          
udp   UNCONN 0      0                          0.0.0.0:111        0.0.0.0:*          
udp   UNCONN 0      0                          0.0.0.0:39440      0.0.0.0:*          
udp   UNCONN 0      0                          0.0.0.0:43625      0.0.0.0:*          
udp   UNCONN 0      0                        127.0.0.1:688        0.0.0.0:*          
udp   UNCONN 0      0                          0.0.0.0:5353       0.0.0.0:*          
udp   UNCONN 0      0                             [::]:55075         [::]:*          
udp   UNCONN 0      0                                *:36655            *:*          
udp   UNCONN 0      0                             [::]:111           [::]:*          
udp   UNCONN 0      0                             [::]:37795         [::]:*          
udp   UNCONN 0      0                                *:58384            *:*          
udp   UNCONN 0      0                             [::]:52283         [::]:*          
udp   UNCONN 0      0                             [::]:5353          [::]:*          
udp   UNCONN 0      0                                *:7443             *:*          
udp   UNCONN 0      0                                *:38480            *:*          
tcp   LISTEN 0      4096                       0.0.0.0:9999       0.0.0.0:*          
tcp   LISTEN 0      4096                     127.0.0.1:35321      0.0.0.0:*          
tcp   LISTEN 0      4096                100.118.220.45:39830      0.0.0.0:*          
tcp   LISTEN 0      64                         0.0.0.0:34979      0.0.0.0:*          
tcp   LISTEN 0      4096                       0.0.0.0:8443       0.0.0.0:*          
tcp   LISTEN 0      4096                       0.0.0.0:22         0.0.0.0:*          
tcp   LISTEN 0      4096                    127.0.0.54:53         0.0.0.0:*          
tcp   LISTEN 0      4096                       0.0.0.0:111        0.0.0.0:*          
tcp   LISTEN 0      4096                       0.0.0.0:3001       0.0.0.0:*          
tcp   LISTEN 0      4096                 127.0.0.53%lo:53         0.0.0.0:*          
tcp   LISTEN 0      4096                       0.0.0.0:9001       0.0.0.0:*          
tcp   LISTEN 0      4096                       0.0.0.0:45879      0.0.0.0:*          
tcp   LISTEN 0      4096                             *:7443             *:*          
tcp   LISTEN 0      4096   [fd7a:115c:a1e0::c934:dc2d]:49720         [::]:*          
tcp   LISTEN 0      4096                          [::]:9999          [::]:*          
tcp   LISTEN 0      4096                          [::]:49627         [::]:*          
tcp   LISTEN 0      4096                          [::]:8443          [::]:*          
tcp   LISTEN 0      4096                          [::]:22            [::]:*          
tcp   LISTEN 0      4096                          [::]:111           [::]:*          
tcp   LISTEN 0      4096                          [::]:3001          [::]:*          
tcp   LISTEN 0      4096                          [::]:9001          [::]:*          
tcp   LISTEN 0      64                            [::]:39465         [::]:*          
Netid State  Recv-Q Send-Q               Local Address:Port  Peer Address:PortProcess                                                    
udp   UNCONN 0      0                          0.0.0.0:42857      0.0.0.0:*    users:(("rpc.statd",pid=1360,fd=8))                       
udp   UNCONN 0      0                       127.0.0.54:53         0.0.0.0:*    users:(("systemd-resolve",pid=717,fd=16))                 
udp   UNCONN 0      0                    127.0.0.53%lo:53         0.0.0.0:*    users:(("systemd-resolve",pid=717,fd=14))                 
udp   UNCONN 0      0                          0.0.0.0:111        0.0.0.0:*    users:(("rpcbind",pid=714,fd=5),("systemd",pid=1,fd=216)) 
udp   UNCONN 0      0                          0.0.0.0:39440      0.0.0.0:*    users:(("tailscaled",pid=1088,fd=16))                     
udp   UNCONN 0      0                          0.0.0.0:43625      0.0.0.0:*                                                              
udp   UNCONN 0      0                        127.0.0.1:688        0.0.0.0:*    users:(("rpc.statd",pid=1360,fd=5))                       
udp   UNCONN 0      0                          0.0.0.0:5353       0.0.0.0:*    users:(("orb",pid=608407,fd=5))                           
udp   UNCONN 0      0                             [::]:55075         [::]:*                                                              
udp   UNCONN 0      0                                *:36655            *:*    users:(("orb",pid=608407,fd=17))                          
udp   UNCONN 0      0                             [::]:111           [::]:*    users:(("rpcbind",pid=714,fd=7),("systemd",pid=1,fd=218)) 
udp   UNCONN 0      0                             [::]:37795         [::]:*    users:(("tailscaled",pid=1088,fd=15))                     
udp   UNCONN 0      0                                *:58384            *:*    users:(("orb",pid=608407,fd=12))                          
udp   UNCONN 0      0                             [::]:52283         [::]:*    users:(("rpc.statd",pid=1360,fd=10))                      
udp   UNCONN 0      0                             [::]:5353          [::]:*    users:(("orb",pid=608407,fd=11))                          
udp   UNCONN 0      0                                *:7443             *:*    users:(("orb",pid=608407,fd=16))                          
udp   UNCONN 0      0                                *:38480            *:*    users:(("orb",pid=608407,fd=13))                          
tcp   LISTEN 0      4096                       0.0.0.0:9999       0.0.0.0:*    users:(("docker-proxy",pid=2241,fd=4))                    
tcp   LISTEN 0      4096                     127.0.0.1:35321      0.0.0.0:*    users:(("containerd",pid=1504,fd=8))                      
tcp   LISTEN 0      4096                100.118.220.45:39830      0.0.0.0:*    users:(("tailscaled",pid=1088,fd=18))                     
tcp   LISTEN 0      64                         0.0.0.0:34979      0.0.0.0:*                                                              
tcp   LISTEN 0      4096                       0.0.0.0:8443       0.0.0.0:*    users:(("docker-proxy",pid=2221,fd=4))                    
tcp   LISTEN 0      4096                       0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=2619406,fd=3),("systemd",pid=1,fd=253))
tcp   LISTEN 0      4096                    127.0.0.54:53         0.0.0.0:*    users:(("systemd-resolve",pid=717,fd=17))                 
tcp   LISTEN 0      4096                       0.0.0.0:111        0.0.0.0:*    users:(("rpcbind",pid=714,fd=4),("systemd",pid=1,fd=215)) 
tcp   LISTEN 0      4096                       0.0.0.0:3001       0.0.0.0:*    users:(("docker-proxy",pid=2200,fd=4))                    
tcp   LISTEN 0      4096                 127.0.0.53%lo:53         0.0.0.0:*    users:(("systemd-resolve",pid=717,fd=15))                 
tcp   LISTEN 0      4096                       0.0.0.0:9001       0.0.0.0:*    users:(("docker-proxy",pid=1119841,fd=4))                 
tcp   LISTEN 0      4096                       0.0.0.0:45879      0.0.0.0:*    users:(("rpc.statd",pid=1360,fd=9))                       
tcp   LISTEN 0      4096                             *:7443             *:*    users:(("orb",pid=608407,fd=14))                          
tcp   LISTEN 0      4096   [fd7a:115c:a1e0::c934:dc2d]:49720         [::]:*    users:(("tailscaled",pid=1088,fd=23))                     
tcp   LISTEN 0      4096                          [::]:9999          [::]:*    users:(("docker-proxy",pid=2247,fd=4))                    
tcp   LISTEN 0      4096                          [::]:49627         [::]:*    users:(("rpc.statd",pid=1360,fd=11))                      
tcp   LISTEN 0      4096                          [::]:8443          [::]:*    users:(("docker-proxy",pid=2227,fd=4))                    
tcp   LISTEN 0      4096                          [::]:22            [::]:*    users:(("sshd",pid=2619406,fd=4),("systemd",pid=1,fd=254))
tcp   LISTEN 0      4096                          [::]:111           [::]:*    users:(("rpcbind",pid=714,fd=6),("systemd",pid=1,fd=217)) 
tcp   LISTEN 0      4096                          [::]:3001          [::]:*    users:(("docker-proxy",pid=2207,fd=4))                    
tcp   LISTEN 0      4096                          [::]:9001          [::]:*    users:(("docker-proxy",pid=1119847,fd=4))                 
tcp   LISTEN 0      64                            [::]:39465         [::]:*                                                              
Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
    lo: 71960852  701130    0    0    0     0          0         0 71960852  701130    0    0    0     0       0          0
wlp0s12f0: 18898978813 56881579    0    0    0     0          0         0 12475500647 24731079    0    9    0     0       0          0
tailscale0: 23340701   21848    0    0    0     0          0         0 64437072  191621    0    0    0     0       0          0
docker0: 378507383  420758    0    0    0     0          0         0 118394291  577347    0 28750    0     0       0          0
br-a8c08ace4629: 476128944 3281551    0    0    0     0          0         0 2169060078 3407638    0    2    0     0       0          0
veth8a78a0a: 268444597 2465431    0    0    0     0          0         0 2115358467 2671090    0    0    0     0       0          0
veth86570b3: 164806302  514099    0    0    0     0          0         0 143758216  782985    0    0    0     0       0          0
veth39b59a1: 88819759  302021    0    0    0     0          0         0 118043128  563055    0    0    0     0       0          0
docker_gwbridge:       0       0    0    0    0     0          0         0 19806138   57425    0 116061    0     0       0          0
vethe28bdc9: 384395667  420722    0    0    0     0          0         0 138089463  635790    0    0    0     0       0          0
Interface: wlp0s12f0
	Link detected: yes
Interface: tailscale0
	Speed: Unknown!
	Duplex: Full
	Link detected: yes
Interface: docker0
	Speed: 10000Mb/s
	Duplex: Unknown! (255)
	Link detected: yes
Interface: br-a8c08ace4629
	Speed: 10000Mb/s
	Duplex: Unknown! (255)
	Link detected: yes
Interface: veth8a78a0a@if6
Interface: veth86570b3@if8
Interface: veth39b59a1@if10
Interface: docker_gwbridge
	Speed: Unknown!
	Duplex: Unknown! (255)
	Link detected: no
Interface: vethe28bdc9@if47
vnstat not installed

[0;32m--- Firewall Status ---[0m
Status: inactive
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ts-input   0    --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  0    --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-1  0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0           
ts-forward  0    --  0.0.0.0/0            0.0.0.0/0           
DROP       0    --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (3 references)
target     prot opt source               destination         
ACCEPT     6    --  0.0.0.0/0            172.18.0.2           tcp dpt:3001
ACCEPT     6    --  0.0.0.0/0            172.18.0.3           tcp dpt:8443
ACCEPT     6    --  0.0.0.0/0            172.18.0.4           tcp dpt:8080
ACCEPT     6    --  0.0.0.0/0            172.17.0.2           tcp dpt:9001

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  0    --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-2  0    --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-2  0    --  0.0.0.0/0            0.0.0.0/0           
RETURN     0    --  0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-ISOLATION-STAGE-2 (3 references)
target     prot opt source               destination         
DROP       0    --  0.0.0.0/0            0.0.0.0/0           
DROP       0    --  0.0.0.0/0            0.0.0.0/0           
DROP       0    --  0.0.0.0/0            0.0.0.0/0           
RETURN     0    --  0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     0    --  0.0.0.0/0            0.0.0.0/0           

Chain ts-forward (1 references)
target     prot opt source               destination         
MARK       0    --  0.0.0.0/0            0.0.0.0/0            MARK xset 0x40000/0xff0000
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0            mark match 0x40000/0xff0000
DROP       0    --  100.64.0.0/10        0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0           

Chain ts-input (1 references)
target     prot opt source               destination         
ACCEPT     0    --  100.118.220.45       0.0.0.0/0           
RETURN     0    --  100.115.92.0/23      0.0.0.0/0           
DROP       0    --  100.64.0.0/10        0.0.0.0/0           
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     17   --  0.0.0.0/0            0.0.0.0/0            udp dpt:39440
[2025-08-23 02:44:47] [INFO] Running module: collect_container_info

[0;34m==== CONTAINER INFORMATION ====[0m

[0;32m--- Docker Information ---[0m
Docker version 27.5.1, build 27.5.1-0ubuntu3~24.04.2
Client:
 Version:    27.5.1
 Context:    default
 Debug Mode: false
 Plugins:
  compose: Docker Compose (Docker Inc.)
    Version:  2.33.0+ds1-0ubuntu1~24.04.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 5
  Running: 4
  Paused: 0
  Stopped: 1
 Images: 5
 Server Version: 27.5.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 
 runc version: 
 init version: 
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.14.0-24-generic
 Operating System: Ubuntu 24.04.3 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 3.691GiB
 Name: audrey
 ID: ca8e37c0-566d-4de2-8055-054a308e6484
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

CONTAINER ID   IMAGE                                    COMMAND                  CREATED        STATUS                    PORTS                                         NAMES
5de45132bc0c   portainer/agent:latest                   "./agent"                2 weeks ago    Up 2 weeks                0.0.0.0:9001->9001/tcp, :::9001->9001/tcp     portainer_agent
850c5fba4e69   amir20/dozzle:latest                     "/dozzle"                2 months ago   Up 4 weeks                0.0.0.0:9999->8080/tcp, [::]:9999->8080/tcp   dozzle
235008e10dc8   prom/prometheus:latest                   "/bin/prometheus --c…"   2 months ago   Exited (0) 2 months ago                                                 prometheus
6fd14bae2376   louislam/uptime-kuma:latest              "/usr/bin/dumb-init …"   2 months ago   Up 4 weeks (healthy)      0.0.0.0:3001->3001/tcp, :::3001->3001/tcp     uptime-kuma
cc6d5deba429   lscr.io/linuxserver/code-server:latest   "/init"                  2 months ago   Up 4 weeks                0.0.0.0:8443->8443/tcp, :::8443->8443/tcp     code-server
REPOSITORY                        TAG       IMAGE ID       CREATED        SIZE
portainer/agent                   latest    9f786420f676   7 weeks ago    171MB
lscr.io/linuxserver/code-server   latest    f5883d6d765b   2 months ago   597MB
amir20/dozzle                     latest    2156500e81c5   2 months ago   57MB
prom/prometheus                   latest    1db0f2fd4e18   2 months ago   304MB
louislam/uptime-kuma              latest    542ef8cfcae2   8 months ago   440MB
NETWORK ID     NAME              DRIVER    SCOPE
954160f4290f   bridge            bridge    local
d7e649fc1b3d   docker_gwbridge   bridge    local
ec45415e968d   host              host      local
a8c08ace4629   monitoring-net    bridge    local
3070c475b94f   none              null      local
DRIVER    VOLUME NAME
local     monitoring_netdatacache
local     monitoring_netdataconfig
local     monitoring_netdatalib
/home/jon/homelab/monitoring/docker-compose.yml
portainer_agent   portainer/agent:latest                   0.0.0.0:9001->9001/tcp, :::9001->9001/tcp
CONTAINER      CPU %     MEM USAGE / LIMIT     NET I/O
5de45132bc0c   0.00%     11.23MiB / 3.691GiB   138MB / 384MB
850c5fba4e69   0.00%     10.11MiB / 256MiB     118MB / 88.8MB
6fd14bae2376   1.42%     194.1MiB / 512MiB     2.12GB / 268MB
cc6d5deba429   0.00%     108.8MiB / 1GiB       144MB / 165MB

Docker Socket Permissions:
srw-rw---- 1 root docker 0 Jul 23 23:51 /var/run/docker.sock
[2025-08-23 02:44:50] [INFO] Running module: collect_software_info

[0;34m==== SOFTWARE INFORMATION ====[0m

[0;32m--- Installed Packages ---[0m
Installed Debian/Ubuntu packages:
Package list saved to packages_dpkg.txt (913 packages)

Available Security Updates:

[0;32m--- Running Services ---[0m
  UNIT                                                  LOAD   ACTIVE SUB     DESCRIPTION
  containerd.service                                    loaded active running containerd container runtime
  cron.service                                          loaded active running Regular background program processing daemon
  dbus.service                                          loaded active running D-Bus System Message Bus
  docker.service                                        loaded active running Docker Application Container Engine
  fail2ban.service                                      loaded active running Fail2Ban Service
  fwupd.service                                         loaded active running Firmware update daemon
  getty@tty1.service                                    loaded active running Getty on tty1
  netplan-wpa-wlp0s12f0.service                         loaded active running WPA supplicant for netplan wlp0s12f0
  networkd-dispatcher.service                           loaded active running Dispatcher daemon for systemd-networkd
  NetworkManager.service                                loaded active running Network Manager
  orb.service                                           loaded active running Orb Sensor
  polkit.service                                        loaded active running Authorization Manager
  rpc-statd.service                                     loaded active running NFS status monitor for NFSv2/3 locking.
  rpcbind.service                                       loaded active running RPC bind portmap service
  rsyslog.service                                       loaded active running System Logging Service
  snap.canonical-livepatch.canonical-livepatchd.service loaded active running Service for snap application canonical-livepatch.canonical-livepatchd
  snap.tailscale.tailscaled.service                     loaded active running Service for snap application tailscale.tailscaled
  snapd.service                                         loaded active running Snap Daemon
  ssh.service                                           loaded active running OpenBSD Secure Shell server
  systemd-journald.service                              loaded active running Journal Service
  systemd-logind.service                                loaded active running User Login Management
  systemd-networkd.service                              loaded active running Network Configuration
  systemd-resolved.service                              loaded active running Network Name Resolution
  systemd-timesyncd.service                             loaded active running Network Time Synchronization
  systemd-udevd.service                                 loaded active running Rule-based Manager for Device Events and Files
  thermald.service                                      loaded active running Thermal Daemon Service
  udisks2.service                                       loaded active running Disk Manager
  unattended-upgrades.service                           loaded active running Unattended Upgrades Shutdown
  upower.service                                        loaded active running Daemon for power management
  user@1000.service                                     loaded active running User Manager for UID 1000
  wpa_supplicant.service                                loaded active running WPA supplicant

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.

31 loaded units listed.
UNIT FILE                                             STATE   PRESET
apparmor.service                                      enabled enabled
apport.service                                        enabled enabled
auditd.service                                        enabled enabled
blk-availability.service                              enabled enabled
console-setup.service                                 enabled enabled
containerd.service                                    enabled enabled
cron.service                                          enabled enabled
dmesg.service                                         enabled enabled
docker.service                                        enabled enabled
e2scrub_reap.service                                  enabled enabled
fail2ban.service                                      enabled enabled
finalrd.service                                       enabled enabled
getty@.service                                        enabled enabled
gpu-manager.service                                   enabled enabled
grub-common.service                                   enabled enabled
grub-initrd-fallback.service                          enabled enabled
keyboard-setup.service                                enabled enabled
lvm2-monitor.service                                  enabled enabled
networkd-dispatcher.service                           enabled enabled
NetworkManager-dispatcher.service                     enabled enabled
NetworkManager-wait-online.service                    enabled enabled
NetworkManager.service                                enabled enabled
open-iscsi.service                                    enabled enabled
open-vm-tools.service                                 enabled enabled
orb.service                                           enabled enabled
pollinate.service                                     enabled enabled
postfix.service                                       enabled enabled
rpcbind.service                                       enabled enabled
rsyslog.service                                       enabled enabled
secureboot-db.service                                 enabled enabled
setvtrgb.service                                      enabled enabled
snap.canonical-livepatch.canonical-livepatchd.service enabled enabled
snap.tailscale.tailscaled.service                     enabled enabled
snapd.apparmor.service                                enabled enabled
snapd.autoimport.service                              enabled enabled
snapd.core-fixup.service                              enabled enabled
snapd.recovery-chooser-trigger.service                enabled enabled
snapd.seeded.service                                  enabled enabled
snapd.system-shutdown.service                         enabled enabled
ssh.service                                           enabled enabled
ssl-cert.service                                      enabled enabled
sysstat.service                                       enabled enabled
systemd-networkd-wait-online.service                  enabled enabled
systemd-networkd.service                              enabled enabled
systemd-pstore.service                                enabled enabled
systemd-resolved.service                              enabled enabled
systemd-timesyncd.service                             enabled enabled
thermald.service                                      enabled enabled
ua-reboot-cmds.service                                enabled enabled
ubuntu-advantage.service                              enabled enabled
ubuntu-fan.service                                    enabled enabled
udisks2.service                                       enabled enabled
ufw.service                                           enabled enabled
unattended-upgrades.service                           enabled enabled
vgauth.service                                        enabled enabled
wifi-pm-off.service                                   enabled enabled
wpa_supplicant.service                                enabled enabled

57 unit files listed.

[0;32m--- Running Processes ---[0m
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root     2956161  4.6  0.6  38820 26768 ?        S    02:44   0:00 /usr/bin/python3 /home/jon/.ansible/tmp/ansible-tmp-1755917084.674795-1113635-185913411263/AnsiballZ_command.py
orb       608407  3.5  1.2 2206552 48708 ?       Ssl  Jul29 1298:11 /usr/bin/orb sensor
root        2473  1.7  4.3 1019972 166888 ?      Ssl  Jul23 766:15 node server/server.js
root     2956166  1.0  0.1   8000  4208 ?        S    02:44   0:00 bash /tmp/linux_system_audit.sh
root         590  0.5  0.0      0     0 ?        S    Jul23 224:46 [irq/121-iwlwifi]
root        1491  0.4  2.4 2466836 93736 ?       Ssl  Jul23 186:13 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
root        1088  0.4  2.7 2136200 106560 ?      Ssl  Jul23 182:50 /snap/tailscale/108/bin/tailscaled --socket /var/snap/tailscale/common/socket/tailscaled.sock --statedir /var/snap/tailscale/common --verbose 10
root          18  0.0  0.0      0     0 ?        I    Jul23  40:25 [rcu_preempt]
root        1504  0.0  1.3 1950088 52496 ?       Ssl  Jul23  37:20 /usr/bin/containerd
root     2874329  0.0  0.8 409280 32000 ?        Ssl  Aug22   0:58 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
jon      2955383  0.0  0.2  18056  8256 ?        S    02:37   0:00 sshd: jon@notty
root        2302  0.0  0.4 1238276 16612 ?       Sl   Jul23  19:52 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 6fd14bae237666af92a20699a5bf8c092a9a1d135ae8f39e691d6047fb4521f7 -address /run/containerd/containerd.sock
root     2786308  0.0  0.2 422280 10848 ?        Ssl  Aug21   1:12 /usr/sbin/thermald --systemd --dbus-enable --adaptive
root         135  0.0  0.0      0     0 ?        S    Jul23  17:28 [usb-storage]
root     2953711  0.0  0.0      0     0 ?        I    02:25   0:00 [kworker/1:1-events]
jon         2756  0.0  2.3 1311024 89044 ?       Sl   Jul23  13:57 /app/code-server/lib/node /app/code-server/out/node/entry
root     2955951  0.0  0.0      0     0 ?        I    02:44   0:00 [kworker/0:0-events]
root     2953853  0.0  0.0      0     0 ?        D    02:30   0:00 [kworker/u8:5+flush-8:0]
root     2953510  0.0  0.0      0     0 ?        I    02:17   0:00 [kworker/u8:2-flush-8:0]
systemd-+-NetworkManager---3*[{NetworkManager}]
        |-canonical-livep---9*[{canonical-livep}]
        |-containerd---9*[{containerd}]
        |-containerd-shim-+-s6-svscan-+-s6-supervise---s6-linux-init-s
        |                 |           |-s6-supervise
        |                 |           |-s6-supervise---bash---sleep
        |                 |           |-s6-supervise---s6-ipcserverd
        |                 |           `-s6-supervise---node-+-node---10*[{node}]
        |                 |                                 `-10*[{node}]
        |                 `-12*[{containerd-shim}]
        |-containerd-shim-+-dozzle---8*[{dozzle}]
        |                 `-12*[{containerd-shim}]
        |-containerd-shim-+-dumb-init-+-node---10*[{node}]
        |                 |           `-nscd---6*[{nscd}]
        |                 `-12*[{containerd-shim}]
        |-containerd-shim-+-agent---5*[{agent}]
        |                 `-12*[{containerd-shim}]
        |-cron
        |-dbus-daemon
        |-dockerd-+-3*[docker-proxy---6*[{docker-proxy}]]
        |         |-docker-proxy---7*[{docker-proxy}]
        |         |-2*[docker-proxy---8*[{docker-proxy}]]
        |         |-2*[docker-proxy---5*[{docker-proxy}]]
        |         `-19*[{dockerd}]
        |-fail2ban-server---4*[{fail2ban-server}]
        |-fwupd---5*[{fwupd}]
        |-login---bash
        |-networkd-dispat
        |-orb---13*[{orb}]
        |-polkitd---3*[{polkitd}]
        |-python3---python3---python3---bash-+-pstree
        |                                    `-tee
        |-rpc.statd
        |-rpcbind
        |-rsyslogd---3*[{rsyslogd}]
        |-snapd---9*[{snapd}]
        |-sshd---sshd---sshd
        |-systemd---(sd-pam)
        |-systemd-journal
        |-systemd-logind
        |-systemd-network
        |-systemd-resolve
        |-systemd-timesyn---{systemd-timesyn}
        |-systemd-udevd
        |-tailscaled---11*[{tailscaled}]
        |-thermald---4*[{thermald}]
        |-udisksd---5*[{udisksd}]
        |-unattended-upgr---{unattended-upgr}
        |-upowerd---3*[{upowerd}]
        `-2*[wpa_supplicant]
[2025-08-23 02:44:53] [INFO] Running module: collect_security_info

[0;34m==== SECURITY ASSESSMENT ====[0m

[0;32m--- User Accounts ---[0m
root:x:0:0:root:/root:/bin/bash
jon:x:1000:1000:jon:/home/jon:/bin/bash
netdata:x:996:988::/var/lib/netdata:/bin/sh
orb:x:995:987::/home/orb:/bin/sh
root
sudo:x:27:jon
jon      tty1         2025-07-23 23:54
jon      pts/0        100.81.202.21    Sat Aug 23 02:44 - 02:44  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:44 - 02:44  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:44 - 02:44  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:44 - 02:44  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:44 - 02:44  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:44 - 02:44  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:44 - 02:44  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:44 - 02:44  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:43 - 02:43  (00:00)
jon      pts/0        100.81.202.21    Sat Aug 23 02:43 - 02:43  (00:00)

wtmp begins Sun Jun  8 21:30:11 2025

[0;32m--- SSH Configuration ---[0m
2025-08-19T21:54:33.258919+00:00 audrey sshd[2620677]: Failed password for invalid user jonathan from 192.168.50.225 port 33718 ssh2
2025-08-19T21:54:33.269464+00:00 audrey sshd[2620677]: Failed password for invalid user jonathan from 192.168.50.225 port 33718 ssh2
2025-08-19T21:59:00.570873+00:00 audrey sshd[2620870]: Failed password for jon from 100.81.202.21 port 34890 ssh2
2025-08-19T21:59:00.588665+00:00 audrey sshd[2620870]: Failed password for jon from 100.81.202.21 port 34890 ssh2

[0;32m--- File Permissions and SUID ---[0m
/var/lib/docker/overlay2/bd850def42e5f1ffe8aa9db20670d6e31115c303c4f31b035d5c5e5b4ed76798/merged/usr/local/bin/docker-entrypoint.sh
/var/lib/docker/overlay2/3c71cdad1ae866b49a83af66a8a93bda367ebe6f1dce8201654e336e2fef2189/diff/usr/local/bin/docker-entrypoint.sh
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/sudo
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/ssh-agent
/usr/bin/fusermount3
/usr/bin/su
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/expiry
/usr/bin/mount
/usr/bin/dotlockfile
/usr/bin/umount
/usr/bin/crontab
/usr/sbin/pppd
/usr/sbin/unix_chkpwd
/usr/sbin/mount.nfs
/usr/sbin/postdrop
/usr/sbin/postqueue
/usr/sbin/pam_extrausers_chkpwd
/usr/sbin/pam-tmpdir-helper
/usr/sbin/mount.cifs
/usr/lib/landscape/apt-update
/usr/lib/openssh/ssh-keysign
/usr/lib/x86_64-linux-gnu/utempter/utempter
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/snapd/snap-confine
/usr/lib/w3m/w3mimgdisplay
/usr/lib/polkit-1/polkit-agent-helper-1
  WARNING: Potentially dangerous SUID binary found: /bin/su
  WARNING: Potentially dangerous SUID binary found: /usr/bin/sudo
  WARNING: Potentially dangerous SUID binary found: /usr/bin/passwd
  WARNING: Potentially dangerous SUID binary found: /usr/bin/chfn
  WARNING: Potentially dangerous SUID binary found: /usr/bin/chsh
  WARNING: Potentially dangerous SUID binary found: /usr/bin/gpasswd
  WARNING: Potentially dangerous SUID binary found: /usr/bin/newgrp
  WARNING: Potentially dangerous SUID binary found: /usr/bin/mount
  WARNING: Potentially dangerous SUID binary found: /usr/bin/umount
/tmp
/home/jon/homelab/monitoring/prometheus-data
/run/screen
/run/lock
/snap/core22/2082/run/lock
/snap/core22/2082/tmp
/snap/core22/2082/var/tmp
/snap/core22/2045/run/lock
/snap/core22/2045/tmp
/snap/core22/2045/var/tmp

[0;32m--- Cron Jobs ---[0m
total 28
drwx------   2 root root  4096 Feb 16  2025 .
drwxr-xr-x 139 root root 12288 Aug 22 06:06 ..
-rw-r--r--   1 root root   201 Apr  8  2024 e2scrub_all
-rw-r--r--   1 root root   102 Feb 16  2025 .placeholder
-rw-r--r--   1 root root   396 Feb 16  2025 sysstat
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
# You can also override PATH, but by default, newer versions inherit it from the environment
#PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *	* * *	root	cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; }
47 6	* * 7	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; }
52 6	1 * *	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; }
#

[0;32m--- Shell History ---[0m
Analyzing: /home/jon/.bash_history
  WARNING: Pattern 'password' found in /home/jon/.bash_history
  WARNING: Pattern 'passwd' found in /home/jon/.bash_history
  WARNING: Pattern 'token' found in /home/jon/.bash_history
  WARNING: Pattern 'key' found in /home/jon/.bash_history
  WARNING: Pattern 'auth' found in /home/jon/.bash_history
  WARNING: Pattern 'login' found in /home/jon/.bash_history

[0;32m--- Tailscale Configuration ---[0m
100.118.220.45  audrey               jonpressnell@ linux   offline
100.104.185.11  bpcp-b3722383fb      jonpressnell@ windows offline
100.126.196.100 bpcp-s7g23273fb      jonpressnell@ windows offline
100.81.202.21   fedora               jonpressnell@ linux   active; relay "ord", tx 267236 rx 3097444
100.96.2.115    google-pixel-9-pro   jonpressnell@ android -
100.107.248.69  ipad-10th-gen-wificellular jonpressnell@ iOS     offline
100.123.118.16  jon-ser              jonpressnell@ linux   -
100.67.250.42   jonathan             jonpressnell@ linux   offline
100.99.235.80   lenovo               jonpressnell@ linux   -
100.98.144.95   lenovo420            jonpressnell@ linux   -
100.78.26.112   omv800               jonpressnell@ linux   -
100.65.76.70    qualcomm-go103       jonpressnell@ android offline
100.72.166.115  samsung-sm-g781u1    jonpressnell@ android offline
100.67.40.97    surface              jonpressnell@ linux   -
100.69.142.126  xreal-x4000          jonpressnell@ android offline

# Health check:
#     - Tailscale hasn't received a network map from the coordination server in 2m7s.
100.118.220.45
[2025-08-23 02:45:07] [INFO] Running module: run_vulnerability_scan

[0;34m==== VULNERABILITY ASSESSMENT ====[0m

[0;32m--- Kernel Vulnerabilities ---[0m
6.14.0-24-generic
Current kernel: 6.14.0-24-generic
Kernel major version: 6
Kernel minor version: 14
Risk Level: LOW
Assessment: Kernel version is recent and likely secure

Kernel Security Features:
  ASLR (Address Space Layout Randomization): ENABLED
  Dmesg restriction: ENABLED

[0;32m--- Open Ports Security Check ---[0m
Port 53 (DNS) - Ensure properly configured
[2025-08-23 02:45:07] [INFO] Running module: collect_env_info

[0;34m==== ENVIRONMENT AND CONFIGURATION ====[0m

[0;32m--- Environment Variables ---[0m
SHELL=/bin/bash
HOME=/root
LANG=en_US.UTF-8
USER=root
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

[0;32m--- Mount Points ---[0m
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=1894260k,nr_inodes=473565,mode=755,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,noexec,relatime,size=387056k,mode=755,inode64)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
/dev/sda2 on / type ext4 (rw,relatime)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k,inode64)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=32,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=4625)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,nosuid,nodev,relatime,pagesize=2M)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
/var/lib/snapd/snaps/canonical-livepatch_338.snap on /snap/canonical-livepatch/338 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/canonical-livepatch_341.snap on /snap/canonical-livepatch/341 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core24_1006.snap on /snap/core24/1006 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core22_2045.snap on /snap/core22/2045 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core24_1055.snap on /snap/core24/1055 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snapd_24718.snap on /snap/snapd/24718 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snapd_24792.snap on /snap/snapd/24792 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/tailscale_108.snap on /snap/tailscale/108 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/tailscale_97.snap on /snap/tailscale/97 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/dev/sda1 on /boot/efi type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
sunrpc on /run/rpc_pipefs type rpc_pipefs (rw,relatime)
tmpfs on /run/snapd/ns type tmpfs (rw,nosuid,nodev,noexec,relatime,size=387056k,mode=755,inode64)
nsfs on /run/snapd/ns/tailscale.mnt type nsfs (rw)
nsfs on /run/snapd/ns/canonical-livepatch.mnt type nsfs (rw)
192.168.50.107:/export/audrey_backup on /mnt/omv-backup type nfs (rw,relatime,vers=3,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.50.107,mountvers=3,mountport=56632,mountproto=udp,local_lock=none,addr=192.168.50.107)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=387052k,nr_inodes=96763,mode=700,uid=1000,gid=1000,inode64)
overlay on /var/lib/docker/overlay2/bd850def42e5f1ffe8aa9db20670d6e31115c303c4f31b035d5c5e5b4ed76798/merged type overlay (rw,relatime,lowerdir=/var/lib/docker/overlay2/l/XE6XKML6GAUMVL72UYINHXFEZN:/var/lib/docker/overlay2/l/2DDFT3SFANJMTLQVQJT6QNMYY6:/var/lib/docker/overlay2/l/4BE34UV534RN6YCIRJVMPJTRKZ:/var/lib/docker/overlay2/l/NHCXNSPIR7YOPIHKTRYYDW5Y2L:/var/lib/docker/overlay2/l/43CVT54S74CGWCZUOMHIFACWJ7:/var/lib/docker/overlay2/l/MUJAJBHJEIR4A5SZZOC6CQUTVT:/var/lib/docker/overlay2/l/45GIGYUNPJE2HQ7UCVT6XQEDL3:/var/lib/docker/overlay2/l/A4NV5NZFSSNQPEX43CBWFXOMED:/var/lib/docker/overlay2/l/KAWSTQ5J2OAW6WERZ2DK4QYTLA:/var/lib/docker/overlay2/l/MGFJ4NWGW5TGK27ZL3W6N4ORHH:/var/lib/docker/overlay2/l/AJKTYJBBG7TWBGQZVUV4OR72EI:/var/lib/docker/overlay2/l/E5TR2GD2PTUXFJHA3AWCMYNKBX:/var/lib/docker/overlay2/l/NI5A3OJFV2HRTHB63B6UB55IHU,upperdir=/var/lib/docker/overlay2/bd850def42e5f1ffe8aa9db20670d6e31115c303c4f31b035d5c5e5b4ed76798/diff,workdir=/var/lib/docker/overlay2/bd850def42e5f1ffe8aa9db20670d6e31115c303c4f31b035d5c5e5b4ed76798/work,nouserxattr)
overlay on /var/lib/docker/overlay2/9174a91cfba55e021606a61b9b24db72c6f4fa5e56196b7660a4f9490df5e2a8/merged type overlay (rw,relatime,lowerdir=/var/lib/docker/overlay2/l/NIOKMY64SM54ASHDW2W7XIDLIR:/var/lib/docker/overlay2/l/MX2Y36LPVSNEEPENZBPNWLC3UF:/var/lib/docker/overlay2/l/YRY7WF2UVHTIDFNYDZCXITY6H6:/var/lib/docker/overlay2/l/WMYSB4GUHMTT4VV2T6IJI2WXKV:/var/lib/docker/overlay2/l/VGDVB3TFH2LHEO4GZOSLSVKN5B:/var/lib/docker/overlay2/l/NRUZM66U2IXYSIMKC7NEALBESY:/var/lib/docker/overlay2/l/L4QRIZWOMKP2IWFJRXH47ATK2H:/var/lib/docker/overlay2/l/JRZAUQNPN7NXF5NRHMAY6CCVML:/var/lib/docker/overlay2/l/BG555F7P4MOQ5IIDZ3EHGHDWMS:/var/lib/docker/overlay2/l/NEJODA33KUH4WZ334DN4PEGZAJ:/var/lib/docker/overlay2/l/I4HDGKR573ZXGCXBWFQV5PBF3N,upperdir=/var/lib/docker/overlay2/9174a91cfba55e021606a61b9b24db72c6f4fa5e56196b7660a4f9490df5e2a8/diff,workdir=/var/lib/docker/overlay2/9174a91cfba55e021606a61b9b24db72c6f4fa5e56196b7660a4f9490df5e2a8/work,nouserxattr)
overlay on /var/lib/docker/overlay2/d7c9480076e10ab7a94dd7fb54d89c9df7048cc867edbffa907ed9df3cf982fb/merged type overlay (rw,relatime,lowerdir=/var/lib/docker/overlay2/l/SY7E7PNHGLXQDF77THYZ33HW72:/var/lib/docker/overlay2/l/32AISOYMLMLYLEZYJIPSOMLXFL:/var/lib/docker/overlay2/l/NQPU6A7OGCLRHRZKBPGYPXOLFU:/var/lib/docker/overlay2/l/XWMWFRVPRIKHADZC3CWFGR47I2:/var/lib/docker/overlay2/l/R7NYC2TRVP25NOXWU227B3HMKN,upperdir=/var/lib/docker/overlay2/d7c9480076e10ab7a94dd7fb54d89c9df7048cc867edbffa907ed9df3cf982fb/diff,workdir=/var/lib/docker/overlay2/d7c9480076e10ab7a94dd7fb54d89c9df7048cc867edbffa907ed9df3cf982fb/work,nouserxattr)
nsfs on /run/docker/netns/658617fb4477 type nsfs (rw)
nsfs on /run/docker/netns/9169cd5aad57 type nsfs (rw)
nsfs on /run/docker/netns/b58de695f453 type nsfs (rw)
overlay on /var/lib/docker/overlay2/25ab0c6ca302cdbdcf23f9af6dc747b1ea8aa2b01fa7ea09ead01d3a30d18bed/merged type overlay (rw,relatime,lowerdir=/var/lib/docker/overlay2/l/5RTMHNUOE75I7WY7H3DK4VK42Q:/var/lib/docker/overlay2/l/ZKWL6BPTBTEW6LDN3TKV3YJHLG:/var/lib/docker/overlay2/l/NBCF5N25G7HR4GTXTZYTXQD7K3:/var/lib/docker/overlay2/l/OBUHAJWWLHXOKWC6R4STR6EU5D:/var/lib/docker/overlay2/l/34ZVE4XI3JKNTTKZLNHVJHWHBJ:/var/lib/docker/overlay2/l/PHOLC4N5MLTCWEJ5AXF4BVG2L6:/var/lib/docker/overlay2/l/PQ53Q3EQTSVWEBGEMUCQKSX3LD:/var/lib/docker/overlay2/l/N7MW6XLBPXGLCSIJ37TLMWYCJG:/var/lib/docker/overlay2/l/73XQXAZ2RUNKGMMIXGJJDRN3DI:/var/lib/docker/overlay2/l/5RPWABGXH37PG4AEXARZFI5PWL,upperdir=/var/lib/docker/overlay2/25ab0c6ca302cdbdcf23f9af6dc747b1ea8aa2b01fa7ea09ead01d3a30d18bed/diff,workdir=/var/lib/docker/overlay2/25ab0c6ca302cdbdcf23f9af6dc747b1ea8aa2b01fa7ea09ead01d3a30d18bed/work,nouserxattr)
nsfs on /run/docker/netns/953d9c206f8a type nsfs (rw)
tracefs on /sys/kernel/debug/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
/var/lib/snapd/snaps/core22_2082.snap on /snap/core22/2082 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
Filesystem                            Size  Used Avail Use% Mounted on
tmpfs                                 378M  2.1M  376M   1% /run
efivarfs                               64K  2.8K   57K   5% /sys/firmware/efi/efivars
/dev/sda2                             113G   15G   93G  14% /
tmpfs                                 1.9G     0  1.9G   0% /dev/shm
tmpfs                                 5.0M     0  5.0M   0% /run/lock
/dev/sda1                             1.1G  6.2M  1.1G   1% /boot/efi
192.168.50.107:/export/audrey_backup  7.3T  306G  7.0T   5% /mnt/omv-backup
tmpfs                                 378M   12K  378M   1% /run/user/1000
overlay                               113G   15G   93G  14% /var/lib/docker/overlay2/bd850def42e5f1ffe8aa9db20670d6e31115c303c4f31b035d5c5e5b4ed76798/merged
overlay                               113G   15G   93G  14% /var/lib/docker/overlay2/9174a91cfba55e021606a61b9b24db72c6f4fa5e56196b7660a4f9490df5e2a8/merged
overlay                               113G   15G   93G  14% /var/lib/docker/overlay2/d7c9480076e10ab7a94dd7fb54d89c9df7048cc867edbffa907ed9df3cf982fb/merged
overlay                               113G   15G   93G  14% /var/lib/docker/overlay2/25ab0c6ca302cdbdcf23f9af6dc747b1ea8aa2b01fa7ea09ead01d3a30d18bed/merged

[0;32m--- System Limits ---[0m
real-time non-blocking time  (microseconds, -R) unlimited
core file size              (blocks, -c) 0
data seg size               (kbytes, -d) unlimited
scheduling priority                 (-e) 0
file size                   (blocks, -f) unlimited
pending signals                     (-i) 14644
max locked memory           (kbytes, -l) 483816
max memory size             (kbytes, -m) unlimited
open files                          (-n) 1024
pipe size                (512 bytes, -p) 8
POSIX message queues         (bytes, -q) 819200
real-time priority                  (-r) 0
stack size                  (kbytes, -s) 8192
cpu time                   (seconds, -t) unlimited
max user processes                  (-u) 14644
virtual memory              (kbytes, -v) unlimited
file locks                          (-x) unlimited
[2025-08-23 02:45:07] [INFO] Generating JSON summary

[0;34m==== GENERATING SUMMARY ====[0m
[2025-08-23 02:45:07] [Generating JSON summary...] 
[2025-08-23 02:45:08] [INFO] JSON summary generated successfully: /tmp/system_audit_audrey_20250823_024446/results.json

[0;34m==== AUDIT COMPLETE ====[0m
[2025-08-23 02:45:08] [INFO] Audit completed successfully in 22 seconds
[2025-08-23 02:45:08] [INFO] Results available in: /tmp/system_audit_audrey_20250823_024446
[2025-08-23 02:45:08] [INFO] Enhanced summary created: /tmp/system_audit_audrey_20250823_024446/SUMMARY.txt
[2025-08-23 02:45:08] [INFO] Compressing audit results...
