Security scans

Security scans check your server's public-facing services for potential security issues, including exposed databases, administration interfaces, and unsafe service configurations. Results help you find services that should not be reachable from the internet. Scans report findings; they do not change your firewall or fix the server's configuration.

Review the findings

Open Baremetal Servers in the cloud console, select your server, and open Security Scan. Access requires permission to read networking information.

Results are grouped by the server's assigned IP addresses. Each card shows an open-port count and any findings. Expand Findings to read the port, title, description, and severity, or use Search findings to locate a service.

Review Critical and High findings first, then the remaining severities. An open port is not automatically a vulnerability: a public website or an SSH service may be intentional. Read the description to distinguish a detected service from a confirmed unsafe configuration.

Last scan and Next scan describe the scanner's overall schedule, rather than a separate timestamp for each address. The Known CVEs tile does not currently provide a vulnerability inventory; assess the actual findings instead.

Restrict unwanted access

For each unexpected service:

1. Identify the application listening on the reported port and decide which clients need access.
2. Stop unused services. For required services, restrict access with the OS firewall, bind to the intended interface, or use a private Virtual Network between your servers.
3. Apply the service's security updates and authentication settings, following the finding's description.
4. Verify that legitimate clients can still connect, then rescan.

For example, a database used only by your application servers can listen on its private address, with firewall access limited to those servers. Adding a private network alone does not close its public listener.

Keep a remote console session available while changing firewall rules. See host firewall configuration for an OS walkthrough.

Run another scan

Select Run scan now to rescan the registered targets for this server. After it completes, refresh the page and review the findings again. If the console reports that no scan targets are registered, it cannot start that rescan; contact support if this persists.

An empty result may mean no report is available yet. Automated scans can miss issues or report false positives, so a clean result does not establish that the server is secure. Continue maintaining updates, authentication, and firewall rules.

For a finding you cannot explain, send support the server identifier, IP address, port, finding description, and changes already tried. The security scan API also exposes findings and per-address rescans.