The checks, and what they say when they cannot run
Chillbox reads a server over the SSH login you already have and reports what it found. No agent, nothing installed, nothing leaving the machine.
The rule the whole app is built on: a check that could not run is never reported as a check that passed. It says not evaluated, and it leaves your score alone.
Findings worth a page of their own
SSH still takes a password
sshd_config · PasswordAuthenticationYou set it to no, restarted, and the prompt is still there.
The Include on line 12 outranks your edit on line 57, and OpenSSH defaults to yes when nothing is set at all. One command reads what the daemon will actually do.
Redis is listening on 0.0.0.0
exposure · port 6379Is that an open database or just an untidy bind?
Protected mode may still be refusing those connections — unless a bind line is configured, which switches the guard off. Two commands tell you which one you have.
Eight checks on the host, plus what answers on the network
Private keys and .env files other users can read. Root logins over SSH. Whether a firewall is active at all. Pending security updates. Services answering on every interface instead of loopback, named by the service rather than the port number. And a new port opening that was not there the last time it looked.
Each one leads with what it costs you if it is true, because permissions are 0644 is not a reason to get out of bed and anyone on this machine can read your private key is.
- How it connects
- Plain SSH, with the login you already use
- On the server
- Nothing installed. No agent, no daemon
- Where results go
- Your phone. No account, no cloud
- Costs
- Free to try for 7 days, then $7.99 once
Point it at a server and see
It reads the machine and tells you what it found, and what it could not.