The Software Watch server check

The server check is a short script that prints the list of software installed on a Linux server, with exact versions. You paste that list on the site's page, and each package is checked against its distribution's own security notices. A scan from outside cannot see this.

The script only prints. It sends nothing to Magpie, installs nothing, needs no password and leaves no file on the server. Nothing connects the server to Magpie.

It runs on Ubuntu, Debian, Alpine, Rocky Linux, AlmaLinux and other distributions with dpkg, rpm or apk. Packages from a distribution Magpie has no vulnerability list for are listed and marked Not checked.

Run it

1. On the site's page, choose Run the server check.

2. Copy the line it shows and run it in a terminal on the server:

   curl -fsSL https://magpie.diy/server-check.sh | sh
   

   It prints the list between two lines that say where to copy.

3. Copy everything between the two lines, paste it under Paste what it printed, and choose Add the server's list.

The site's page shows when the list was pasted, and the server's software appears on the site's Software list.

Read the script before you run it, at /server-check.sh on Magpie's website. To save the list to a file instead, run curl -fsSL https://magpie.diy/server-check.sh | sh > list.json; the two lines are not saved with it.

Keep the list current

Magpie checks the list you last pasted every day, against new vulnerabilities as they are published. It does not know when the server changes. After you update the server, choose Run it again… and paste the new list: it replaces the old one, and what you updated closes.

To record one update without running the check, open the finding and choose Mark as updated…, then enter the version installed now.

What the list holds

The Linux release and kernel, each installed package with its version, the versions of common programs such as PHP, nginx and MySQL, Docker image names, and whether the server needs a restart. You can read it before you paste it.

What it never reads

Environment variables, configuration files, keys, certificates, user names, the hostname, IP addresses, open ports, running processes, or anything in home directories or web roots.

When a paste is refused

The site's page says why: nothing that looks like the list was pasted, the list was cut off (copy it again, including its last line), or it is larger than 2 MB.

The earlier server check

An earlier version installed itself to run every day and send its list. To remove it from a server, run sudo magpie-server-check --uninstall, or curl -fsSL https://magpie.diy/server-check.sh | sudo sh -s -- --uninstall.

If the script prints an error you can't work out, Contact support.