{"id":31812686,"url":"https://github.com/osiris9999/linuxaudittool","last_synced_at":"2026-07-24T03:32:00.814Z","repository":{"id":307086016,"uuid":"1028275949","full_name":"Osiris9999/LinuxAuditTool","owner":"Osiris9999","description":"A tool to audit a Linux system’s security configuration","archived":false,"fork":false,"pushed_at":"2025-07-29T09:41:07.000Z","size":20,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-10-11T07:23:37.698Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Osiris9999.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":"audit.py","citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-29T09:35:51.000Z","updated_at":"2025-07-29T09:41:11.000Z","dependencies_parsed_at":"2025-07-29T11:50:15.089Z","dependency_job_id":"f3bd7628-8d66-4f3d-b50a-dc5f46fc835b","html_url":"https://github.com/Osiris9999/LinuxAuditTool","commit_stats":null,"previous_names":["osiris9999/linuxaudittool"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Osiris9999/LinuxAuditTool","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Osiris9999%2FLinuxAuditTool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Osiris9999%2FLinuxAuditTool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Osiris9999%2FLinuxAuditTool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Osiris9999%2FLinuxAuditTool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Osiris9999","download_url":"https://codeload.github.com/Osiris9999/LinuxAuditTool/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Osiris9999%2FLinuxAuditTool/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35826032,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-24T02:00:07.870Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-11T07:22:16.463Z","updated_at":"2026-07-24T03:32:00.790Z","avatar_url":"https://github.com/Osiris9999.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Linux Security Audit Script\n\nQuick and dirty security audit for Linux servers. Checks the usual suspects - firewall, SSH config, file permissions, sketchy services, and other stuff that should probably be locked down.\n\n## What it does\n\n- Firewall status (UFW/iptables)\n- SSH hardening checks  \n- Critical file permissions (/etc/passwd, /etc/shadow, etc.)\n- Unnecessary/risky services\n- Basic rootkit indicators\n- User account issues\n- Available system updates\n\nSpits out a score and tells you what's broken.\n\n## Usage\n\n```bash\n# Basic run (some checks will be limited)\npython3 security_audit.py\n\n# Full audit (recommended)\nsudo python3 security_audit.py\n```\n\n## Sample Output\n\n```\nLinux security audit\n----------------------------------------\n\n[firewall]\n  ok   UFW: active\n  FAIL iptables: no custom rules\n  FAIL open ports: check these: 80, 443, 3306\n\n[ssh]\n  ok   ssh root login: disable root ssh\n  FAIL ssh password auth: fix: keys only\n  ok   ssh empty passwords: no empty passwords\n\n[files]\n  ok   perms passwd: /etc/passwd ok\n  FAIL perms shadow: /etc/shadow: mode 644 (want 640)\n\n==================================================\nAUDIT RESULTS\n==================================================\nHost: webserver01\nDate: 2024-03-15 14:32\nScore: 67.3% (15/23)\nStatus: NEEDS WORK\n\nCRITICAL ISSUES:\n  ! no password: mysql\n\nWARNINGS:\n  - ports 80, 443, 3306 are open\n\nTODO:\n  1. sudo ufw enable\n  2. SSH: keys only\n  3. chmod 640 /etc/shadow \u0026\u0026 chown root:shadow /etc/shadow\n  4. systemctl disable postfix\n  ... and 3 more\n\nFull report saved: audit_20240315_1432.json\n```\n\n## Requirements\n\n- Python 3.6+\n- Linux (obviously)\n- Root access for complete results\n\nMost commands should work on any modern distro. Tested on Ubuntu, CentOS, and Debian.\n\n## What gets checked\n\n### Firewall\n- UFW status\n- Basic iptables rules\n- Open listening ports\n\n### SSH Configuration\n- Root login disabled\n- Password authentication disabled  \n- Empty passwords blocked\n- Max auth attempts limited\n\n### File Permissions\nStandard system files that attackers love to mess with:\n- /etc/passwd (644)\n- /etc/shadow (640) \n- /etc/group (644)\n- /etc/gshadow (640)\n- /etc/sudoers (440)\n- /etc/crontab (600)\n\n### Services\nLooks for commonly enabled services that you probably don't need:\n- telnet, rsh, rlogin\n- FTP daemons\n- Mail servers (sendmail, postfix, dovecot)\n- Print services (cups)\n\n### Rootkit Detection\nBasic checks for common hiding spots:\n- Suspicious paths in /tmp, /dev, /usr/src\n- Process count anomalies\n- /etc/ld.so.preload modifications\n\n### User Accounts\n- Users with empty passwords\n- Multiple UID 0 accounts (should only be root)\n\n### Updates\nChecks for available security updates using apt or yum.\n\n## Output Files\n\nCreates a JSON report with full details:\n```json\n{\n  \"timestamp\": \"2024-03-15T14:32:15\",\n  \"hostname\": \"webserver01\", \n  \"score\": 67.3,\n  \"checks_run\": 23,\n  \"checks_passed\": 15,\n  \"critical\": [\"no password: mysql\"],\n  \"warnings\": [\"ports 80, 443, 3306 are open\"],\n  \"todo\": [\"sudo ufw enable\", \"SSH: keys only\", ...]\n}\n```\n\n## Limitations\n\nThis isn't a replacement for proper security tools. It's meant for:\n- Quick server checkups\n- Basic hardening verification\n- Spotting obvious misconfigurations\n\nFor serious security auditing, use proper tools like:\n- Lynis\n- OpenSCAP\n- Nessus\n- chkrootkit/rkhunter\n\n## Contributing\n\nPRs welcome. Keep it simple and practical - this isn't meant to be comprehensive, just useful for common scenarios.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fosiris9999%2Flinuxaudittool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fosiris9999%2Flinuxaudittool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fosiris9999%2Flinuxaudittool/lists"}