Step-by-step guides that solve the problem entirely by hand: real commands, real configs, tested on Ubuntu 24.04 and Debian 12. Only at the end do you read what monsys automates.
Linux and Windows servers, Docker, systemd, disk prediction, baselines.
4 guidesSSH brute force, honeypots, process integrity, GeoIP, kernel modules, USB.
5 guidesOSV.dev, kernel backports, package-lock, EPSS/KEV, VEX, Trivy.
6 guidesChecklists, auditor evidence, access reviews, tamper-evident logs, CRA, AI Act.
5 guidesunattended-upgrades, kernel updates, backup verification, status pages, TLS expiry, SMART.
5 guidesSeparating customers, handover reports, on-call without PagerDuty, NOC screens, tagging.
2 guidesWho can become root on which server, and with which SSH key? On one host that's five commands; on thirty hosts it's the question nobody answers anymore. This script produces one tsv per host with accounts, sudo rules and every authorised public key (with fingerprint and comment), plus the diff check that reports the moment a key or sudo rule is added.
From 1 January 2027 AWS validates MSP partners only against Validation Checklist 8.0: 24 new and 27 rewritten controls, with GenAI observability, toil measurement and AI governance as new blocks. This is the method to know where you stand in one afternoon: which controls you already cover with existing systems, which need a time series you must start today, and which are purely organisational. With two scripts (AI-dependency inventory and toil baseline) and a fill-in worksheet.
Control A.8.8 requires you to identify, assess and address vulnerabilities in a timely way. Most organisations prove that with a policy and a screenshot of a scanner. An auditor wants to see the chain: when the CVE became known, when you saw it, what you decided, when it was closed. This is how to pull those four timestamps automatically from your servers and turn them into a metric — MTTR per severity — you can show every quarter.
Load 8 is quiet on a 16-core and a disaster on a 2-core. Load also counts processes waiting on a disk, not just CPU. And the 1-minute value is almost always noise. What the three numbers really mean, how to normalise them per core, how to separate CPU pressure from I/O pressure with /proc/pressure, and which threshold to put in an alert.
PagerDuty starts at 21 dollars per user per month and sends your alert data to the US. For a team of two to ten people it can be done with a self-hosted ntfy server, a rotation schedule in a text file and a fifty-line script: alerts go to whoever is on duty this week, escalate after ten minutes without acknowledgement to the backup, and break through the phone's silent mode. Including one-tap acknowledge.
ISO 27001 A.5.18 and NIS2 Art. 21(2)(i) require you to periodically check who has access and whether that's still right. In practice that becomes an afternoon of spreadsheets, or it doesn't happen. This script turns the review into an hour: it lays the technical inventory (servers, sudo, keys, IdP accounts) next to the HR list, flags every deviation, and produces the signed report an auditor accepts.
npm audit is free and built in, and teams still miss vulnerabilities with it — or drown in 400 reports about dev dependencies. This is the pipeline we run ourselves: parse the lockfile into an exact list, batch-query OSV.dev, separate dev from production dependencies, and keep the output per week so you can say since when a CVE has been open.
A status page on the same server as the service it describes is down when you need it. This is the setup that works: Uptime Kuma on a separate, cheap VPS, checks from outside on HTTP, TLS and TCP, a public page on status.yourdomain.com with its own certificate, incident updates you post from your phone, and the DNS and cache details that decide whether the page stays reachable when the rest is on fire.
The five RIRs (RIPE, ARIN, APNIC, AFRINIC, LACNIC) publish for free which IP block is allocated to which country. With one 30 MB download and forty lines of shell you see the country of every SSH login, and alert on "this user has never logged in from that country". No MaxMind, no API key, no data leaving the host.
A service that crashes is back in seconds with Restart=on-failure. A service that hangs, one stuck in a restart loop, or one that never started after a reboot, systemd doesn't see by itself. These are the drop-in settings, the OnFailure handler that pushes to your phone, the WatchdogSec trick for hanging processes and the cron script that closes the gaps.
Trivy is free, fast and finds everything — and that's exactly the problem: an average image yields hundreds of CVEs, most without a fix or in a tool that never runs. This is the configuration we use ourselves: --ignore-unfixed, severity thresholds, a .trivyignore with reason and date, a CI gate that only breaks on new critical findings, and a nightly scan of what actually runs on the host.
An attacker planting a backdoor in sshd or nginx leaves the process running. The file on disk has been replaced, or the process runs from a deleted file that no longer exists anywhere. Three checks that make this visible without EDR: the hash of /proc/<pid>/exe against a baseline, dpkg -V against the package database, and the (deleted) marker no legitimate process should carry.
A scanner reports CVE-2026-1234 in libxml2. You know the vulnerable function is never called in your setup. A VEX statement is how you record that — machine-readable, with a reason, and with the date you knew it. This is the OpenVEX format in twenty lines, the four statuses and when to use them, how to sign with ssh-keygen, and how scanners use the statement to suppress noise.
A forty-line script that checks every installed package against the free OSV.dev API, backport-aware, and enriches the list with EPSS score and CISA KEV status. From 1,800 packages to the five you need to patch this week. No licence, no scanner appliance.
How to see in two minutes who is hammering your SSH port, which five sshd settings make 99% of attacks pointless, and how to configure fail2ban correctly on Ubuntu 24.04 (the systemd backend trap). Then: the three attack patterns fail2ban is blind to.
Everything you can see yourself with docker stats, docker events and a healthcheck in your compose file — plus the cron script that reports a container restarting every 30 seconds within five minutes. Including the logging setting that stops containers from filling your disk.
An intruder who's inside looks for keys, passwords and backups within minutes. Plant them — fake — and let auditd report the moment someone touches them. Complete setup with auditd rules, the exclusions for updatedb and your backup tool, and a cron that pushes to your phone. Zero false positives after day one.
A scanner that sees 6.8.0 and reports 40 kernel CVEs doesn't know about Ubuntu and Debian backports. Here's how to read your kernel package's changelog yourself, compare the running kernel with the installed one, check hardware mitigations in /sys and decide when livepatch is worth it. Using the free sources: USN, Debian Security Tracker and the package changelog.
A kernel update is the only routine update that requires a reboot and that can leave your server hanging. This is the checklist we use ourselves: pre-checks (/boot, DKMS, Secure Boot), snapshot, installation, a GRUB fallback that automatically picks the old kernel after one failed boot, and the verification after the reboot. In a fifteen-minute window.
Let's Encrypt renews itself — until the day the hook fails, DNS validation breaks or someone removed the cron. This script finds every certificate on every port of every host (internal ones too, mail too, the reverse proxy nobody remembers), computes the remaining days and pushes an alert at 14 and 7 days. No Nagios, no external service.
One Zabbix per customer doesn't scale; one Zabbix for everyone leaks. This is the architecture that does work with open-source building blocks — Prometheus per customer, Grafana organisations, Alertmanager routing on a tenant label, one naming scheme and one offboarding procedure — and the honest bill for what it costs in maintenance at ten, forty and a hundred customers.
No policy, no intentions: an auditor wants artefacts with a date. These are the twelve that come up in virtually every CyFun or NIS2 audit, with the command that produces each one, and an evidence-pack.sh that puts everything in one signed archive that can still be verified six months later.
NIS2 Article 21(2) lists ten measures in legal language. This is the translation into what you do on your servers on Monday — per measure the command, the file or the script that produces the evidence. With the Belgian context: the law of 26 April 2024, the CCB, CyberFundamentals and the registration duty.
The 2026 Minimum Elements turned an SBOM into a signed, licensed, machine-verifiable artifact. Here is the full manual pipeline for one Linux host: inventory three layers, map every required field, canonicalize and sign with Ed25519, then derive VEX. It is a lot.
Four measurements that make 90% of incidents visible in advance, using only what ships with Ubuntu 24.04 or Debian 12: sysstat, journalctl, df and a thirty-line cron script that pushes to your phone. Plus why "CPU above 90%" is a bad alert.
The default install of unattended-upgrades patches security updates but leaves services running on old libraries and the new kernel sitting on disk. This is the configuration that fixes that for Ubuntu 24.04 and Debian 12: origins, blacklist, needrestart, reboot policy, mail — plus the cron script that reports which hosts have been waiting days for a reboot.
A backup job that returns exit 0 proves the job ran — not that there's anything usable in the archive. Three checks you automate: is the newest backup fresh enough (mtime check), is the archive readable (restic/borg check) and can you actually get something back out (monthly restore test with a log line). Plus the pitfall of rsync preserving mtimes.