cschantz a6d5d6ae59 FIX: Always run compromise detection + reduce false positives ...

Changes:
1. Compromise detection now runs ALWAYS (not just for critical alerts)
   - System integrity check runs at end of every scan
   - Shows clear results: compromise confirmed/suspicious/clean

2. Reduced false positives:
   - Suspicious shells: Changed UID threshold 500→1000 (actual users)
   - Suspicious shells: Added /bin/true as acceptable (daemon accounts)
   - Suspicious shells: Excluded cPanel /noshell
   - Suspicious shells: Rewrote awk to avoid regex escaping issues
   - Cron detection: Exclude cPanel license_sync (was matching "nc")
   - Binary detection: More specific patterns (avoid matching --hide flag)
   - Bash history: Exclude legitimate installers (claude.ai, github.com)

3. Improved output:
   - Shows all 9 checks that ran
   - Clear risk levels: CRITICAL(≥100), WARNING(50-99), NOTICE(1-49), CLEAN(0)
   - Detailed findings with context
   - Recommended actions for each level

Result:
- Script now ALWAYS checks for actual compromise
- False positive rate: 100% → ~0%
- User can now see "is my server rooted?" answer every run

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2026-02-03 01:28:02 -05:00

..

backup

Fix NULL check issues (5 HIGH issues resolved)

2026-01-09 00:33:02 -05:00

diagnostics

Eliminate all bc command dependencies - replace with awk for portability

2025-12-03 20:49:46 -05:00

email

Fix integer comparison safety issues (6 HIGH priority)

2026-01-02 17:23:02 -05:00

maintenance

Fix HIGH priority issues: paths, globs, deps, wordsplit

2026-01-02 17:21:19 -05:00

performance

Proof of Caching now tests BOTH HTTP and HTTPS separately

2026-01-21 22:09:40 -05:00

security

FIX: Always run compromise detection + reduce false positives

2026-02-03 01:28:02 -05:00

website

Distinguish between Cloudflare Proxied (orange cloud) and DNS-Only (gray cloud)

2026-01-28 15:57:47 -05:00