https://github.com/osiris9999/linuxaudittool
A tool to audit a Linux system’s security configuration
https://github.com/osiris9999/linuxaudittool
Last synced: 7 days ago
JSON representation
A tool to audit a Linux system’s security configuration
- Host: GitHub
- URL: https://github.com/osiris9999/linuxaudittool
- Owner: Osiris9999
- Created: 2025-07-29T09:35:51.000Z (about 1 year ago)
- Default Branch: main
- Last Pushed: 2025-07-29T09:41:07.000Z (about 1 year ago)
- Last Synced: 2025-10-11T07:23:37.698Z (10 months ago)
- Language: Python
- Size: 19.5 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Audit: audit.py
Awesome Lists containing this project
README
# Linux Security Audit Script
Quick and dirty security audit for Linux servers. Checks the usual suspects - firewall, SSH config, file permissions, sketchy services, and other stuff that should probably be locked down.
## What it does
- Firewall status (UFW/iptables)
- SSH hardening checks
- Critical file permissions (/etc/passwd, /etc/shadow, etc.)
- Unnecessary/risky services
- Basic rootkit indicators
- User account issues
- Available system updates
Spits out a score and tells you what's broken.
## Usage
```bash
# Basic run (some checks will be limited)
python3 security_audit.py
# Full audit (recommended)
sudo python3 security_audit.py
```
## Sample Output
```
Linux security audit
----------------------------------------
[firewall]
ok UFW: active
FAIL iptables: no custom rules
FAIL open ports: check these: 80, 443, 3306
[ssh]
ok ssh root login: disable root ssh
FAIL ssh password auth: fix: keys only
ok ssh empty passwords: no empty passwords
[files]
ok perms passwd: /etc/passwd ok
FAIL perms shadow: /etc/shadow: mode 644 (want 640)
==================================================
AUDIT RESULTS
==================================================
Host: webserver01
Date: 2024-03-15 14:32
Score: 67.3% (15/23)
Status: NEEDS WORK
CRITICAL ISSUES:
! no password: mysql
WARNINGS:
- ports 80, 443, 3306 are open
TODO:
1. sudo ufw enable
2. SSH: keys only
3. chmod 640 /etc/shadow && chown root:shadow /etc/shadow
4. systemctl disable postfix
... and 3 more
Full report saved: audit_20240315_1432.json
```
## Requirements
- Python 3.6+
- Linux (obviously)
- Root access for complete results
Most commands should work on any modern distro. Tested on Ubuntu, CentOS, and Debian.
## What gets checked
### Firewall
- UFW status
- Basic iptables rules
- Open listening ports
### SSH Configuration
- Root login disabled
- Password authentication disabled
- Empty passwords blocked
- Max auth attempts limited
### File Permissions
Standard system files that attackers love to mess with:
- /etc/passwd (644)
- /etc/shadow (640)
- /etc/group (644)
- /etc/gshadow (640)
- /etc/sudoers (440)
- /etc/crontab (600)
### Services
Looks for commonly enabled services that you probably don't need:
- telnet, rsh, rlogin
- FTP daemons
- Mail servers (sendmail, postfix, dovecot)
- Print services (cups)
### Rootkit Detection
Basic checks for common hiding spots:
- Suspicious paths in /tmp, /dev, /usr/src
- Process count anomalies
- /etc/ld.so.preload modifications
### User Accounts
- Users with empty passwords
- Multiple UID 0 accounts (should only be root)
### Updates
Checks for available security updates using apt or yum.
## Output Files
Creates a JSON report with full details:
```json
{
"timestamp": "2024-03-15T14:32:15",
"hostname": "webserver01",
"score": 67.3,
"checks_run": 23,
"checks_passed": 15,
"critical": ["no password: mysql"],
"warnings": ["ports 80, 443, 3306 are open"],
"todo": ["sudo ufw enable", "SSH: keys only", ...]
}
```
## Limitations
This isn't a replacement for proper security tools. It's meant for:
- Quick server checkups
- Basic hardening verification
- Spotting obvious misconfigurations
For serious security auditing, use proper tools like:
- Lynis
- OpenSCAP
- Nessus
- chkrootkit/rkhunter
## Contributing
PRs welcome. Keep it simple and practical - this isn't meant to be comprehensive, just useful for common scenarios.