How it works

From one command to a protected server.

A small agent runs on each Linux server and reports to one dashboard. It patches, scans and blocks attackers on a schedule — and runs your fixes when you click.

1command to install

0open ports needed

2 minto run your fixes

2 hpatch & scan cycle

Get started

Four steps. About five minutes.

Needs root (or sudo), curl and outbound HTTPS. Nothing else to install.

1
Create your account
Sign up on the Cloud Dashboard. You get 14 days free and no card is needed.
2
Add a server
Click Add server, give it a name and choose alert only or auto-apply. The dashboard shows a one-line install command with that server's own secret token.
3
Run the command
Paste it on the server as root. It checks what the server runs, installs the agent and its timers, and starts the first scan. You watch every step live on the server's Install log.
curl -fsSL "https://app.auditbash.com/?p=agent&f=install.sh" | sudo bash -s -- \ --dashboard "https://app.auditbash.com" --token pw_… --mode alert
4
Read your first report
Within minutes the server has a security grade from A to F, every finding sorted by severity, and the list of security updates it is missing.

Then it keeps going

What the agent does on its own.

The agent runs on timers (systemd, or cron where there is no systemd). You can change the schedule and the maintenance window for each server.

Every 2 minutes

Checks for work

Picks up fixes you queued in the dashboard and reports the result
Checks its logs against your brute-force rules and blocks attackers

Every 2 hours

Patches and quick checks

Looks for security updates to the languages and services it found
Installs them, or emails your team, depending on the server's mode
Quick checks: new ports, attacks, suspicious processes, changed files
Sends the full report to the dashboard

Once a day

Full deep scan

Every web root for malware and exposed backups
Hardening, TLS certificates, mail blacklists and file integrity
How often is up to you — every run, daily, or less

Any time

When you click

Full scan now or Patch now from the server page
Any one-click fix on a finding

How data flows

Your server talks out. Nothing talks in.

The agent sends its report to the dashboard over HTTPS and asks it for work. There is no inbound connection, no open port and no SSH access from us.

One token per server. Each server proves who it is with its own secret token. You can replace it any time.

Encrypted in the dashboard. Findings, reports and settings are AES-256 encrypted before they are stored.

An agent you can read. It is a plain bash script with no extra runtime, so you can see exactly what it does.

Patch modes

You decide who installs updates.

Default

Alert only

The agent finds the security updates and emails your team. Nothing changes on the server until someone clicks Patch now.

Best for busy production servers
You still get every scan and alert

Hands-off

Auto-apply

The agent installs security updates itself, inside the maintenance window you set, then restarts PHP-FPM and the web server and checks your sites still answer.

Versions saved before every install
Emails you if a site goes down afterwards

A security finding with its one-click fix in the AuditBash dashboard

From finding to fix

Fixed from the browser, in about two minutes.

1A finding appearsSay a backup.zip that anyone can download.
2You choose the fixOne click, or select every critical finding at once.
3The agent runs itWithin 2 minutes, with its safety checks.
4You see the resultThe finding is marked fixed and the action goes in the audit log.

Safety

Guard rails on every action.

The agent checks every fix before it runs it, even ones queued by an admin.

Never locks you out

It refuses to block your SSH port, the server's own IPs, private networks, or the address of your current SSH session.

Your never-block list

Office, VPN and monitoring IPs you list are never blocked — by a rule or by hand.

Files only in web roots

It only quarantines or deletes files under web roots, never system folders, and never .env, config.php, wp-config.php or index.php.

Protects core services

It will not kill sshd, systemd, the database or the web server.

Everything can be undone

Quarantined files can be restored, and blocked ports and IPs unblocked, from the same screen.

Every action is recorded

Who queued it, when, from where, and what the server answered.

For admins

Prefer the terminal? It works there too.

The main jobs — scans, patch runs, status and history — also run straight from the server. The command is auditbash (or patchwatch).

Read the docs

`auditbash status`	What the agent is doing, its mode, schedule and dashboard
`auditbash scan`	Run a full security scan now
`auditbash check`	See pending security updates without installing
`auditbash apply`	Run a patch cycle now
`auditbash history`	Past runs and what each one changed
`auditbash self-test`	Check the agent can do its job on this server

FAQ

Questions about the agent.

Does the agent need root?

Yes. Installing security updates and changing the firewall need root, so the install command runs with sudo.

Does it open any ports on my server?

No. The agent only connects out to the dashboard over HTTPS. Nothing listens on your server.

Will it install updates without asking?

Only if you choose auto-apply for that server. In alert-only mode it tells your team and waits.

Which servers does it run on?

Ubuntu, Debian, RHEL, CentOS, Rocky Linux, AlmaLinux, Amazon Linux, Fedora, openSUSE, Alpine, Arch and FreeBSD — including Plesk and cPanel servers.

How do I remove it?

Run the install script again with --uninstall. It removes the agent and its timers, and leaves its settings and logs for you to delete.