Checks

Linode account users are assessed for two-factor authentication (2FA) enablement. 2FA adds a second verification factor (a TOTP code or security key) on top of the password, so a stolen or guessed password alone is not enough to sign in to the Linode Cloud Manager.

Linode instances are assessed for enrollment in the Linode Backup service, which performs automatic daily and weekly snapshots of an instance's disks. Without it enabled, there is no managed recovery point to restore from after a data-loss event.

Linode instances are assessed for disk encryption status. Disk encryption protects data at rest on the instance's underlying disks, keeping stored data unreadable without the encryption keys even if the physical media is accessed.

Linode instances are assessed for Watchdog (Lassie) status. Watchdog is Linode's automatic recovery feature that monitors an instance and reboots it if it powers off unexpectedly, helping maintain availability without manual intervention.

Linode Cloud Firewalls are checked to verify each one is attached to at least one device, such as a Linode instance or NodeBalancer. A firewall only filters traffic for the resources it is assigned to, so an unassigned firewall enforces no protection at all.

Linode Cloud Firewalls apply a default inbound policy to ingress traffic that does not match any explicit rule. This check verifies the default is set to DROP, enforcing a default-deny posture so that only traffic intentionally permitted by a rule is allowed in.

Linode Cloud Firewalls apply a default outbound policy to egress traffic that matches no explicit rule. This check verifies the default is set to DROP, enforcing default-deny egress so that only approved outbound connections are allowed to leave the instance.

Linode Cloud Firewalls are checked to determine whether explicit inbound rules are configured. Defined ingress rules express the intended allow-list of sources, ports, and protocols instead of relying solely on the firewall's default policy.

Linode Cloud Firewalls are checked to determine whether explicit outbound rules are configured. Defined egress rules express which destinations, ports, and protocols an instance is permitted to reach, rather than depending only on the firewall's default policy.

Linode Cloud Firewalls can be in an enabled or disabled state. This check verifies the firewall status is enabled, because a firewall must be active for its inbound and outbound policies and rules to actually filter network traffic.