Input I built a plesk-server-report for hourly analysis, maybe someone finds it useful

[Mehl]

Server operating system version

Debian, Ubuntu, RHEL

Plesk version and microupdate number

18.0.81 #4

After php2shell, I built a server report that runs every hour to monitor whats going on.
I am not sure yet if this really detects malicious code on my server (I haven't been hacked) but I think it should.
At least, it should recognize hacked wordpress installs or misused email accounts.
Maybe some of you find it useful. Grab it here:

GitHub - cmelius/plesk-monitoring-server-Report: A single bash script that writes an hourly health and security report for a Plesk server and (optionally) uploads it to cloud storage with rclone.

A single bash script that writes an hourly health and security report for a Plesk server and (optionally) uploads it to cloud storage with rclone. - cmelius/plesk-monitoring-server-Report

github.com

There, you can see an example-report and instructions on how to install.

I use a planned task in my claude (daily) to analyze and send me a report if something suspicious is happening on my server, but the reports are also nicely readable in plain text.

have fun ...

 

[Mehl]

The script is evolving and now does a lot more than security. It checks SPF, DKIM and DMARC (including SPF errors that cause hard rejects), reverse DNS, the mail server’s TLS certificates, and whether each domain’s DNS still points to the server. It also tracks mail sent through Roundcube webmail with the sender’s real IP. New since the first release: WordPress brute-force analysis (it even spots a successful login after failed attempts), a local country and network lookup for every login with alerts for unexpected countries, checks for CAA, broken DNSSEC and domain blocklists (Spamhaus DBL/SURBL), and optional IPv6 support. Users of other CMSs can help add support through an issue template on GitHub.