Your servers, from the outside and the inside

A small read-only program for Linux servers. It reports the server's health every minute and a full check every hour: installed packages with known vulnerabilities, open ports, login accounts and SSH keys, SSH settings, Docker containers, disk and memory. FortWatch also says when the server's release stops getting free security updates, and turns every problem into an issue beside the issues from its outside scans.

No. FortWatch's 13 scanners work from the outside and need nothing installed. The agent is optional: add it to the Linux servers where you also want the inside view. A team that runs only on Vercel or Cloudflare has no server to install it on and keeps the outside scans.

No. The agent only sends reports. It reads nothing from FortWatch's answer but the status code, follows no redirect, and cannot be told to run a command, read a file its checks do not need, change a setting or update itself. Someone who broke into FortWatch could read the reports already sent, but could not make an agent do anything.

Host facts (hostname, a hash of the machine id, OS, kernel, uptime and the machine's IP addresses), health readings, the package list, listening ports, the accounts that can log in with their SSH key fingerprints, each Docker container's name, image, Compose service, state, user, privileges and published ports, each check's result with one line of evidence, and the name of any reader that failed. Never file contents, password hashes, keys, command lines, environment variables, logs or network traffic. Run sudo fortwatch-agent -print to see a full report on your screen.

Yes, once the server is linked to its IP or domain assets in FortWatch; FortWatch proposes the assets at the server's own addresses and you confirm each link. Each listening port then shows Open when the outside port scan found it, Blocked when a scan of every TCP port did not, No when it listens only on the machine or a private network, and Not checked when no scan decides it. Ports open from outside with nothing listening on the server are listed too, with the Docker container that publishes each.

Yes. A server with no report for five minutes becomes a high problem and alerts like any issue; the first report back closes it. FortWatch also alerts when a disk will fill within a day at its current rate, when a process's memory keeps growing, and when a new open port, login account or SSH key appears.

Any Linux on amd64 or arm64; it reads packages from dpkg, rpm or apk. Vulnerable packages are matched against the distribution's own security advisories for Ubuntu, Debian, Alpine, Rocky Linux, AlmaLinux and Red Hat Enterprise Linux, and the same six get the end-of-life notice. On other distributions every other check runs. The installer starts the agent as a systemd service; on a machine without systemd, install it with --no-start and run it under your own supervisor.

Under 7 MB on disk. The systemd service is capped at 128 MB of memory and 10% of one CPU, and runs at low priority. It needs outbound HTTPS on port 443, to fortwatch.ai for the download and api.fortwatch.ai for the reports, and nothing connects to your server.

Run the installer again to update: it replaces the program and keeps your settings and token. Then run sudo systemctl restart fortwatch-agent to start the new version. The agent never updates itself. To remove it, run sudo sh fortwatch-install.sh --uninstall, which removes the service, the program, its settings, its token and its account; then remove the server in FortWatch.