Bluehost Self-Managed VPS and VDS: How to Scan for Vulnerabilities and Malware

Protecting your Bluehost Self-Managed VPS or Virtual Dedicated Server (VDS) from vulnerabilities and malware is a critical part of server management. You can scan your server using open-source security tools and best practices.

This guide covers package and configuration vulnerability scans, as well as scanning for malware or infections.

Important:

Bluehost Self-Managed VPS and VDS plans provide root/admin access. Security scans and software installation are your responsibility. Bluehost does not monitor, scan, or clean your server for you on a self-managed plan.
Back up important data before performing scans or making changes.
If you discover an active compromise, update all passwords and consider restoring from a known good backup.

Why Scan Your Server?

Help find outdated, vulnerable, or infected software early.
Verify you're not running unnecessary or unknown services.
Support your business security policies and compliance efforts.

What You Need

SSH or Console/root access to your server.
A recent backup (recommended).
The tools below must be installed before use. See the next section for installation commands.

Notes:

Install the tools below only once, unless you want to upgrade or reinstall them.
Use your OS's package manager (apt or dnf) for easier installation and updates.
Malware scans can use a lot of memory and CPU, especially on smaller plans. Run them during low-traffic times.
If you have apps installed on your server, such as n8n, keep in mind that these scans cover the operating system and the folders you choose to scan. They don't scan inside containers or check an app's own dependencies. If your apps are installed outside /home, /var/www, and /tmp, add their folders to the clamscan command. The open port scan may also show ports opened by your apps, so review the results to make sure each open port is expected.

How to Install Scanning Tools

Most Linux distributions do not install vulnerability or malware scanning tools by default. You must install them from your package manager before running scans.

AlmaLinux, Rocky Linux, CentOS Stream, and Fedora

The security update commands in this guide are built into dnf, so there is nothing to install for package scanning. The commands below install the malware and configuration scanning tools.

Enable EPEL (AlmaLinux, Rocky Linux, and CentOS Stream only):

ClamAV and rkhunter are provided by the EPEL (Extra Packages for Enterprise Linux) repository. Skip this step on Fedora, where they are available by default.

sudo dnf install epel-release -y

Example Output:

Installed: epel-release-... Complete!

Malware scanning:

sudo dnf install clamav rkhunter -y

Example Output:

Installed: clamav-... rkhunter-... Complete!

If the freshclam command isn't found after installation, install the ClamAV signature updater. On AlmaLinux 8 and Rocky Linux 8, the package is clamav-update instead of clamav-freshclam.

sudo dnf install clamav-freshclam -y

Configuration scanning (OpenSCAP):

sudo dnf install openscap-scanner scap-security-guide -y

Example Output:

Installed: openscap-scanner-... scap-security-guide-... Complete!

Ubuntu and Debian

Malware scanning:

sudo apt update sudo apt install clamav rkhunter -y

Example Output:

Setting up clamav ... Setting up rkhunter ...

Package and vulnerability scanning (Debian only):

The debsecan tool uses Debian's security tracker, so it is only useful on Debian. On Ubuntu, use the apt commands in the next section.

sudo apt install debsecan -y

Example Output:

Setting up debsecan ...

Network Scanning Tool

Network scans work best when run from outside your server, so install nmap on the computer or server you'll scan from, not necessarily on your Self-Managed VPS or VDS. If that system runs Linux, use sudo dnf install nmap -y (AlmaLinux, Rocky Linux, CentOS Stream, Fedora) or sudo apt install nmap -y (Ubuntu, Debian).

How to Run Scans

A. Vulnerability and Package Security Scans

AlmaLinux, Rocky Linux, CentOS Stream, and Fedora (with dnf):

sudo dnf updateinfo summary sudo dnf updateinfo list security sudo dnf check-update --security

Example Output:

Updates Information Summary: available 3 Security notice(s) 3 Important Security notice(s)

Note: CentOS Stream doesn't publish security advisory data, so these commands may return nothing. Use sudo dnf check-update to see available updates instead.

Ubuntu and Debian (with apt):

sudo apt update sudo apt list --upgradable

Example Output:

openssl/noble-updates,noble-security 3.0.13-0ubuntu3.5 amd64 [upgradable from: 3.0.13-0ubuntu3.4]

This command lists all upgradable packages, not only security updates. Packages with security in the repository name are security updates.

Known vulnerability (CVE) scan (Debian only):

sudo debsecan

Example Output:

CVE-2024-0727 openssl (low urgency) CVE-2024-27316 apache2 (remotely exploitable, medium urgency) ...

Security configuration scan (AlmaLinux, Rocky Linux, CentOS Stream, and Fedora):

OpenSCAP checks your server's configuration against a security profile. It does not look for known CVEs. First, list the security content files installed for your distribution:

ls /usr/share/xml/scap/ssg/content/

Example Output:

ssg-almalinux9-ds.xml ...

Then list the profiles available in the file for your distribution and version. Replace ssg-almalinux9-ds.xml with your file name.

oscap info /usr/share/xml/scap/ssg/content/ssg-almalinux9-ds.xml

Run the scan using a profile ID from that list:

sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard --results scan-results.xml /usr/share/xml/scap/ssg/content/ssg-almalinux9-ds.xml

Example Output:

Title Ensure Software Patches Installed Rule xccdf_org.ssgproject.content_rule_security_patches_up_to_date Ident CCE-... Result pass ...

The full results are saved to scan-results.xml in your current directory. A failed rule means a setting doesn't match the profile. It doesn't necessarily mean your server is compromised.

B. Scan for Malware or Infections

ClamAV (all distributions):

First, update the virus signatures:

sudo freshclam

On Ubuntu and Debian, a ClamAV service updates signatures automatically and can block this command with a message that the log file is locked. If that happens, stop the service, run freshclam, then start the service again:

sudo systemctl stop clamav-freshclam sudo freshclam sudo systemctl start clamav-freshclam

Then scan your website files and other common locations. The -r option scans folders recursively, and -i lists only infected files:

sudo clamscan -r -i /home /var/www /tmp

Example Output:

/var/www/html/test-file.php: Eicar-Test-Signature FOUND ----------- SCAN SUMMARY ----------- Known viruses: 8725412 Engine version: 1.4.3 Scanned directories: 15 Scanned files: 100 Infected files: 1 ...

rkhunter (rootkit scanner, all distributions):

sudo rkhunter --update sudo rkhunter --check

The check pauses between test groups. Press Enter to continue, or add --sk to the second command to skip the pauses. When the scan finishes, it prints a summary:

Example Output:

System checks summary ===================== File properties checks... Files checked: 142 Suspect files: 0 Rootkit checks... Rootkits checked : 497 Possible rootkits: 0 All results have been written to the log file: /var/log/rkhunter.log

Note: A warning from rkhunter doesn't always mean an infection. Review /var/log/rkhunter.log to see what triggered it before you take action.

C. Network and Open Port Scan

Run this scan from your own computer or a trusted external system to see which ports and services are visible on your server. Only scan servers that you own or have permission to scan.

nmap -Pn your_server_ip

Replace your_server_ip with your server's IP address or domain name.

Example Output:

PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https 3306/tcp closed mysql

Close any unexpected open ports using your server firewall.

Common Scan Commands Table

Common scan commands by scan type
Scan Type	Command(s)	Applies To
Check for security updates	`dnf updateinfo list security`	AlmaLinux, Rocky Linux, CentOS Stream, Fedora
Check for available updates	`apt list --upgradable`	Ubuntu, Debian
Scan files for malware	`clamscan -r -i /var/www`	All
Rootkit and suspicious files	`rkhunter --check`	All
Scan for open ports	`nmap -Pn your_server_ip`	External
Check known CVEs	`debsecan`	Debian
Check security configuration	`oscap xccdf eval`	AlmaLinux, Rocky Linux, CentOS Stream, Fedora

Best Practices and Next Steps

Quarantine or clean infected files. Don't just delete system files unless you're sure they're non-essential.
We recommend updating your server (apt upgrade or dnf update) after vulnerability scans. Updates can restart services or change behavior, so make sure you have a recent backup first.
Check logs for antivirus or scan results, and configure periodic scans using cron if desired.
In case of any compromise, change passwords (user, root, database, control panel) and restore from a backup that was taken before the infection, if possible.
If unsure, consult a security expert or your developer. Bluehost does not remediate custom hack or malware issues on a Self-Managed VPS or VDS for you.

Summary

Regularly scanning your Bluehost Self-Managed VPS or Virtual Dedicated Server (VDS) helps you find vulnerabilities and malware early. Use package update checks and scan with ClamAV and rkhunter, and keep in mind that no scan finds everything, so pair scans with regular updates. Keep your firewall tight and your system updated. For critical findings, restore from backup or seek expert help.

Did you find this article helpful?