Hermes Security Audit

🔒 Hermes Agent Security Audit — AI Agent Antivirus & Vulnerability Scanner

Free. Open-source. No API keys, no paid tools, no Docker. 12 battle-tested security checks for Linux servers running AI agents.

When to Use

• The user asks to audit or harden a Linux server.
• Checking for malware, rootkits, crypto miners, or SSH brute force.
• After installing new tools or Docker containers.
• When CPU or memory usage looks unusual.
• Before exposing the agent to external platforms (Telegram, Discord).

The 12 checks

1. Open ports — find hidden services (CUPS 631, SMTP 25, Zabbix 10050).
2. Process audit — spot crypto miners (xmrig, stratum) and orphaned proxies.
3. SSH brute force — count failed auth attempts, identify attacker IPs.
4. SUID/SGID files — privilege-escalation vectors.
5. Cron jobs — hidden miners and persistence across all users.
6. Docker audit — privileged containers, host network, unexpected images.
7. chkrootkit — signature-based rootkit scan.
8. rkhunter — behavioral rootkit + backdoor scan.
9. ClamAV — full antivirus over /tmp, /opt, /root.
10. Lynis — hardening score (0–100).
11. Exposed credentials — API keys, tokens, private keys in plain sight.
12. Network connections — who's calling home.

The exact commands for each method live in AGENTS.md.

Procedure

1. Run the 12 checks in order.
2. Classify each finding by severity (critical / high / medium / low).
3. Apply safe fixes where automated (fail2ban, disable services, relocate keys).
4. Report results with severity, flagging known false positives.

Pitfalls

• chkrootkit false-positives on modern kernels (basename, date, dirname) — expected, don't alarm.
• rkhunter flags snap users and hidden config files — benign.
• Never run destructive commands without user confirmation.

Verification

• Each of the 12 checks produced a result.
• Findings are classified by severity and fixed or flagged.
• The final report lists what changed (ports closed, services disabled, keys moved).