Security Audit That Runs Every Morning — 149 Intrusion Attempts Caught on Day One

The Problem

I run 31 AI agents on an AWS Ubuntu server. That server faces the public internet. Every second of every day, someone is probing it.

The problem isn't that attacks happen. The problem is that most people don't know they're happening. You configure your firewall on day one, set up fail2ban, pat yourself on the back, and never look again. Meanwhile, your SSH config drifts. A package update opens a port you didn't expect. fail2ban's jail expires and nobody notices.

Security isn't a one-time setup. It's a daily discipline. And I'm not going to spend 20 minutes every morning running ufw status, checking fail2ban-client status, and scanning for open ports. That's exactly the kind of work an AI agent should do.

The alternative? Hire a security auditor. That's $5,000 to $20,000 per year for periodic reviews — quarterly if you're lucky. I wanted daily. Every single morning. Before I even wake up.

The Solution

Mr.Chief's Healthcheck skill — a security hardening and audit tool that runs as a cron job. It checks every attack surface on the machine, scores each category green/yellow/red, and delivers the results straight to Telegram.

One agent. One cron job. Zero human effort after setup.

The Process

Setting up the daily audit took about 15 minutes. Here's the cron configuration:

# Daily security audit at 7:00 AM CET (6:00 AM UTC)
0 6 * * * mrchief cron run --task "Run full security healthcheck. Check UFW status, SSH configuration, fail2ban statistics, open ports, and package updates. Deliver scorecard to Telegram." --channel telegram

The Healthcheck skill checks these categories on every run:

┌─────────────────────────┬──────────────────────────────────────┐
│ Category                │ What It Checks                       │
├─────────────────────────┼──────────────────────────────────────┤
│ Firewall (UFW)          │ Active, default-deny, allowed ports  │
│ SSH Configuration       │ Root login, password auth, port      │
│ fail2ban                │ Active jails, banned IPs, ban count  │
│ Open Ports              │ Listening services, unexpected ports │
│ Package Updates         │ Unattended-upgrades, pending patches │
│ System Integrity        │ Disk usage, uptime, running services │
└─────────────────────────┴──────────────────────────────────────┘

The agent runs each check, collects the output, and builds a scorecard:

🔒 Daily Security Audit — March 12, 2026

🟢 Firewall:      UFW active, default deny, 3 rules
🟢 SSH:           Root disabled, password auth off, port 22
🟢 fail2ban:      Active, 149 bans in last 24h
🟢 Ports:         Only 22 (SSH) and 18789 (gateway) open
🟢 Updates:       Unattended-upgrades enabled, 0 pending
🟢 System:        Disk 34%, uptime 47 days

Score: 6/6 — All clear ✅

That scorecard hits my Telegram at 7:00 AM sharp. Before my first coffee.

The Results

Day one was eye-opening.

149 brute-force attempts in 24 hours. On a server I'd set up three days earlier. fail2ban was doing its job — every single one was blocked. But I didn't know that until the agent told me.

That's the point. The firewall was working. The bans were happening. But without the daily audit, I was flying blind. Now I see the numbers every morning. If they spike from 149 to 1,400, I know something changed. If a new port appears, I know immediately.

Cost comparison:

The agent doesn't replace a penetration test. But it replaces the day-to-day vigilance that nobody has time for.

Try It Yourself

Sign up for Mr.Chief, enable the Healthcheck skill, and set up the cron:

# Install the healthcheck skill
# Install via Mr.Chief dashboard after signing up at mrchief.ai/setup
# clawhub install healthcheck

# Test it manually first
mrchief run --task "Run security healthcheck and report findings"

# Set up the daily cron
mrchief cron add --schedule "0 6 * * *" \
  --task "Run full security healthcheck. Deliver scorecard to Telegram." \
  --channel telegram

You'll have a daily security audit running before tomorrow morning.

149 attacks on day one. And that's a quiet day.