Enterprise-Grade Linux Security Auditing & Hardening Toolkit
Bash + Python tools for system hardening, auditing weak configurations, detecting suspicious logs, analyzing open ports, and generating automated remediation reports.
Linux Security Auditor is a comprehensive security auditing suite engineered for DevSecOps engineers, sysadmins, and security professionals who need enterprise-grade security automation on resource-constrained hardware.
This toolkit transforms manual security verification into automated, repeatable checks—delivering actionable insights with minimal overhead.
- 🔍 Audit system configurations for security weaknesses
- 🛡️ Harden Linux systems against common vulnerabilities
- 📊 Analyze suspicious logs and detect anomalies
- 🔌 Scan open ports and identify attack vectors
- 📄 Generate detailed remediation reports with fix commands
- 💻 Run efficiently on minimal resources (tested on Class 12 hardware)
| Component | Usage | Percentage |
|---|---|---|
| Bash | System auditing, orchestration, native utilities | 43.7% |
| Python | Log analysis, report generation, data processing | 36.4% |
| HTML | Report templates, executive dashboards | 13.4% |
| Makefile | Build automation, CI/CD integration | 3.9% |
| Docker | Container deployment, reproducible environments | 2.6% |
# Python Runtime
- Python 3.6+ (core language)
- Jinja2 (HTML templating)
- PyYAML (config parsing)
- weasyprint (PDF generation)
# System Tools
- Bash 5.0+ (orchestration)
- nmap (advanced port scanning)
- ss/netstat (network analysis)
- auditd (enhanced logging)
- openssl (certificate checks)
- find/grep/awk/sed (log processing)- Configuration Analysis — SSH settings, firewall rules, user permissions
- Weakness Detection — Misconfigurations, weak policies, unnecessary services
- Compliance Checking — CIS Benchmark, HIPAA, PCI-DSS alignment
- Suspicious Activity Detection — syslog, auth.log, application logs
- Anomaly Recognition — Failed login patterns, unauthorized access, timeline reconstruction
- Real-time Monitoring — Failed login tracking, IP reputation analysis
- Open Port Enumeration — Comprehensive service discovery with nmap fallback
- Service Profiling — Version detection, risk assessment
- Network Exposure Mapping — Attack surface analysis, vulnerable service identification
- HTML Reports — Executive summaries with severity ratings
- Remediation Guidance — Step-by-step fix commands for each finding
- Risk Scoring — Quantitative security posture metrics
- PDF Export — Professional documentation (via weasyprint)
- Minimal Dependencies — Bash-first architecture reduces bloat
- Resource Efficient — Runs on embedded systems, VMs, containers
- Parallel Execution — Optional concurrent module execution
- Smart Caching — Avoid redundant checks
# Required
Bash 5.0+
Python 3.6+
Linux/Unix OS (Ubuntu, Debian, CentOS, Alpine, Rocky, etc.)
# Optional (recommended)
nmap # Advanced port scanning
auditd # Enhanced system auditing
openssl # Certificate analysis
jq # JSON processing (already included)# Clone repository
git clone https://github.com/boikzdev/linux-security-auditor.git
cd linux-security-auditor
# Make scripts executable
chmod +x scripts/*.sh
# Install Python dependencies
pip install -r requirements.txt# Full security audit
./scripts/audit.sh --all
# Targeted audits
./scripts/audit.sh --config # Configuration analysis only
./scripts/audit.sh --logs # Log analysis only
./scripts/audit.sh --ports # Port scanning only
./scripts/audit.sh --users # User/permission audit only
# Generate remediation report
python3 python/report_generator.py --audit-results audit_results.json --output report.html
# Verbose output for debugging
./scripts/audit.sh --all -v
# Custom output path
./scripts/audit.sh --all --output custom_results.jsonlinux-security-auditor/
│
├── 📄 README.md # This file
├── 📜 LICENSE # MIT License
├── 📋 requirements.txt # Python dependencies
├── Makefile # Build targets
├── Dockerfile # Container image
│
├── scripts/ # Bash modules (43.7% of codebase)
│ ├── audit.sh # Orchestrator & entry point
│ ├── config_audit.sh # SSH, firewall, permissions checks
│ ├── log_analysis.sh # Failed logins, anomalies
│ ├── port_scanner.sh # Port enumeration (nmap/ss)
│ └── hardening.sh # Remediation recommendations
│
├── python/ # Python modules (36.4% of codebase)
│ ├── report_generator.py # HTML/PDF report creation
│ ├── log_parser.py # Advanced log parsing
│ └── analyzer.py # Anomaly detection, scoring
│
├── configs/ # Configuration files
│ ├── security_standards.yaml # Audit baselines (CIS, etc.)
│ └── audit_profiles.yaml # Custom configurations
│
├── templates/ # HTML/CSS templates (13.4% of codebase)
│ └── report_template.html # Report layout & styling
│
├── docs/ # Documentation
│ ├── USAGE.md # Detailed command reference
│ ├── HARDENING.md # Step-by-step procedures
│ └── TROUBLESHOOTING.md # FAQ & common issues
│
├── tests/ # Unit tests
│ ├── test_analyzer.py # Analyzer tests
│ └── test_parser.py # Parser tests
│
└── .github/
└── workflows/
└── security-audit.yml # CI/CD pipeline
# Run full audit
./scripts/audit.sh --all --output /tmp/audit_$(date +%Y%m%d_%H%M%S).json
# Generate HTML report
python3 python/report_generator.py \
--audit-results /tmp/audit_*.json \
--output /tmp/security_report.html
# View report in browser
open /tmp/security_report.html# Add to crontab for daily 2 AM audits
0 2 * * * /path/to/linux-security-auditor/scripts/audit.sh \
--all \
--output /var/log/security-audit/$(date +\%Y\%m\%d).json
# Weekly report compilation
0 6 * * 0 python3 /path/to/python/report_generator.py \
--audit-results /var/log/security-audit/*.json \
--output /var/log/security-audit/weekly_report_$(date +\%Y\%m\%d).html# .github/workflows/security-gate.yml
name: Security Gate
on: [push, pull_request]
jobs:
security-audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Run Security Audit
run: |
bash scripts/config_audit.sh || exit 1
bash scripts/port_scanner.sh || exit 1
python3 python/report_generator.py --ci-mode# Build container
docker build -t linux-security-auditor:latest .
# Run audit in isolated environment
docker run --rm \
-v /etc:/etc:ro \
-v /var/log:/var/log:ro \
linux-security-auditor:latest
# Run with custom output volume
docker run --rm \
-v /etc:/etc:ro \
-v /var/log:/var/log:ro \
-v $(pwd)/reports:/reports \
linux-security-auditor:latest --output /reports/audit.json# Get recommendations
./scripts/hardening.sh
# Apply hardening (requires root)
sudo ./scripts/hardening.sh --apply
# Verify fixes with re-audit
./scripts/audit.sh --all --output /tmp/post_hardening.json
# Compare reports
diff /tmp/before.json /tmp/post_hardening.json| Category | Checks | Output Format |
|---|---|---|
| System Hardening | Kernel patches, SELinux/AppArmor status, firewall rules | Severity, findings, fixes |
| User & Permissions | Root access, sudo config, file permissions, password policy | Violations, recommendations |
| SSH Security | Port settings, key-based auth, root login, weak ciphers | Findings, hardening steps |
| Service Management | Running services, auto-start settings, unnecessary daemons | Risk assessment, disable commands |
| Network Security | Open ports, listening services, unusual connections | Port inventory, risk ratings |
| Log Analysis | Failed logins, sudo usage, errors, intrusion signatures | Anomalies, timeline, IP stats |
| File Integrity | Permissions, ownership, SUID/SGID bits, world-writable files | Violations, remediation steps |
✅ DevSecOps CI/CD — Automated security gates in deployment pipelines
✅ Compliance & Audits — CIS Benchmark, HIPAA, PCI-DSS verification
✅ Incident Response — Rapid log analysis & threat timeline reconstruction
✅ Cloud Security — Container & VM hardening for AWS, Azure, GCP
✅ Post-Deployment Hardening — Verify security configuration after deployment
✅ Vulnerability Assessment — Identify and prioritize security gaps
✅ Security Training — Learn Linux security best practices hands-on
✅ Compliance Reporting — Generate audit trails for regulators
- Backup critical configurations
- Ensure necessary permissions (some checks require root/sudo)
- Test in non-production environment first
- Review audit scope to avoid sensitive systems
- Document baseline results for comparison
| Level | Urgency | Action |
|---|---|---|
| 🔴 CRITICAL | Immediate | Remediate within hours |
| 🟠 HIGH | Urgent | Address within 1-2 weeks |
| 🟡 MEDIUM | Important | Schedule in next sprint |
| 🟢 LOW | Monitor | Document and track |
- Review audit report for your environment
- Validate findings in test environment first
- Implement recommended fixes
- Re-audit to verify remediation
- Document changes for compliance records
# Install dependencies
make install
# Run full audit
make audit
# Generate report
make report
# Run tests
make test
# Build Docker image
make docker# Run all tests
pytest tests/
# Specific test file
pytest tests/test_analyzer.py -v
# With coverage
pytest --cov=python tests/- Usage Guide — Comprehensive command reference and workflows
- Hardening Guide — Step-by-step hardening procedures
- Troubleshooting — FAQ and common issues
- Security Standards — Baseline configurations
Contributions welcome! Focus areas:
- 🔍 Additional security checks and audit modules
- 📊 Enhanced report templates and visualizations
- 🐧 Support for additional Linux distributions
- ⚡ Performance optimizations
- 🌍 Language translations
Please open issues for bugs or feature requests.
MIT License — Free to use, modify, and distribute for personal and commercial projects.
See LICENSE file for details.
- ✅ Ubuntu 20.04 / 22.04 / 24.04
- ✅ Debian 11 / 12
- ✅ CentOS 7 / 8 / Stream
- ✅ Alpine Linux
- ✅ Rocky Linux
- ✅ ARM64/ARMv7 (Raspberry Pi)
- Disk: ~26 MB (minimal footprint)
- RAM: 64 MB minimum (no bloat)
- CPU: Single-core compatible
- Bandwidth: Offline capable
Having problems?
- Check Troubleshooting Guide
- Search existing issues
- Open new issue with:
- OS version & architecture
- Bash/Python versions
- Error output (full stack trace)
- Reproduction steps
Built by a security-focused engineer passionate about making enterprise-grade security auditing practical, accessible, and automated—even on resource-constrained hardware.
This toolkit bridges the gap between manual compliance checks and expensive enterprise solutions, proving that effective security doesn't require massive infrastructure or budgets.
Making Linux security auditing practical for everyone. 🔐
⭐ If this project helps you, please consider giving it a star! ⭐
📖 Usage Guide • 🐛 Report Issue • ✨ Request Feature • 🔒 Security Report