LinuxSentinel
LinuxSentinel is a lightweight and modular Linux security auditing tool built with Bash.
It performs automated security checks across important areas of a Linux system, including user accounts, file permissions, privileged files, network configuration, firewall status, services, SSH configuration, persistence mechanisms, and security logs.
LinuxSentinel is designed for cybersecurity learning, Linux administration, defensive security, and authorized system auditing.
LinuxSentinel provides multiple security auditing modules through a single command-line framework.
Collects important system information:
- Operating system
- Kernel version
- System architecture
- Hostname
- System uptime
- CPU information
- Memory usage
- Disk usage
- Current user
Analyzes Linux user and account configuration.
Checks include:
- Total user accounts
- UID 0 accounts
- Sudo-enabled users
- Empty-password accounts
- Root account configuration
The module helps identify unusual privileged accounts and weak account configurations.
Analyzes potentially risky Linux file permissions.
Checks include:
- World-writable files
- SUID files
- SGID files
The tool reports discovered files for further security review.
SUID and SGID files are not automatically vulnerabilities. Many legitimate Linux applications require them.
Provides detailed visibility into privileged executables.
The module:
- Searches for SUID files
- Searches for SGID files
- Lists discovered privileged files
- Provides security review information
LinuxSentinel does not automatically remove or modify privileged files.
Analyzes the current network configuration.
Checks include:
- Network interfaces
- Interface status
- IP addresses
- Default routes
- Listening TCP ports
- Listening UDP ports
This helps identify network exposure and unexpected listening services.
Checks commonly used Linux firewall technologies.
Supported checks include:
- UFW
- nftables
- iptables
The module determines whether an active firewall ruleset is detected.
LinuxSentinel uses a detection-only approach and does not modify firewall configuration.
Analyzes system services using Linux service management information.
Checks include:
- Running services
- Enabled services
- Failed services
The purpose is to identify failed or unexpected service configurations that may require investigation.
Reviews important SSH security settings.
Checks include:
- SSH installation
- SSH service status
- SSH root-login configuration
- Password authentication
- Public-key authentication
- Empty-password authentication
- SSH port configuration
The module provides security observations without automatically modifying SSH configuration.
Searches common Linux persistence and scheduled-task mechanisms.
Checks include:
/etc/crontab
User Crontabs
Checks available user-specific scheduled tasks.
Systemd Timers
Enumerates systemd timers that may execute tasks automatically.
Scheduled tasks are not automatically classified as malicious. Unfamiliar commands, scripts, binaries, or execution paths should be manually reviewed.
📜 Security Log Analysis
Analyzes available authentication information.
The module can:
Check traditional authentication logs
Analyze system journal information
Detect failed authentication events
Report authentication-related findings
LinuxSentinel adapts to systems where traditional authentication log files may not exist.
📊 Automated Security Scoring
LinuxSentinel includes a security scoring module.
The scoring system evaluates detected findings and produces:
Security Score
Risk Level
Critical Findings
High Findings
Medium Findings
Low Findings
Informational Findings
Example format:
==========================================
LINUX SENTINEL SECURITY SCORE
==========================================
Score : XX / 100
Risk Level : LOW
------------------------------------------
FINDINGS
------------------------------------------
Critical : 0
High : 0
Medium : 0
Low : 0
Info : 0
The score is intended as a general security assessment indicator, not a replacement for a professional vulnerability assessment.
🏗️ Architecture
LinuxSentinel follows a modular architecture.
The main script acts as the controller and executes individual security modules.
┌─────────────────────┐
│ LinuxSentinel │
│ Main Controller │
└──────────┬──────────┘
│
▼
┌─────────────────────┐
│ linuxsentinel.sh │
└──────────┬──────────┘
│
┌────────────────────────────┼────────────────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ System Audit │ │ User Audit │ │ File Audit │
└──────────────┘ └──────────────┘ └──────────────┘
│ │ │
└────────────────────────────┼────────────────────────────┘
│
┌────────────────────────────┼────────────────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Privilege │ │ Network │ │ Firewall │
│ Audit │ │ Audit │ │ Audit │
└──────────────┘ └──────────────┘ └──────────────┘
│ │ │
└────────────────────────────┼────────────────────────────┘
│
┌────────────────────────────┼────────────────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Service │ │ SSH │ │ Persistence │
│ Audit │ │ Audit │ │ Audit │
└──────────────┘ └──────────────┘ └──────────────┘
│
▼
┌──────────────────┐
│ Log Analysis │
└────────┬─────────┘
│
▼
┌──────────────────┐
│ Security Scoring │
└────────┬─────────┘
│
┌──────────┴──────────┐
▼ ▼
┌─────────┐ ┌─────────┐
│ Reports │ │ Logs │
└─────────┘ └─────────┘
📂 Project Structure
LinuxSentinel/
│
├── linuxsentinel.sh
│
├── modules/
│ ├── system_audit.sh
│ ├── user_audit.sh
│ ├── file_audit.sh
│ ├── privilege_audit.sh
│ ├── network_audit.sh
│ ├── firewall_audit.sh
│ ├── service_audit.sh
│ ├── ssh_audit.sh
│ ├── persistence_audit.sh
│ ├── log_audit.sh
│ └── score.sh
│
├── logs/
│
├── reports/
│
├── README.md
│
├── LICENSE
│
└── .gitignore
🧩 Module Overview
Module Purpose
system_audit.sh System information and configuration
user_audit.sh User and account security
file_audit.sh File permission analysis
privilege_audit.sh SUID and SGID analysis
network_audit.sh Network configuration and listening ports
firewall_audit.sh Firewall configuration detection
service_audit.sh Service status analysis
ssh_audit.sh SSH security configuration
persistence_audit.sh Cron and systemd persistence checks
log_audit.sh Authentication and security log analysis
score.sh Automated security scoring
🚀 Installation
Requirements
LinuxSentinel is designed for Linux systems.
Required
Linux operating system
Bash
Git
Standard Linux command-line utilities
sudo privileges for complete auditing
Recommended
Kali Linux
Debian-based Linux distributions
📥 Clone the Repository
Clone the project:
git clone https://github.com/mustafajaved304/LinuxSentinel.git
Move into the project:
cd LinuxSentinel
🔧 Make Scripts Executable
Make the main script executable:
chmod +x linuxsentinel.sh
Make all modules executable:
chmod +x modules/*.sh
▶️ Usage
Full Security Audit
Run the complete LinuxSentinel audit:
sudo ./linuxsentinel.sh
The complete audit runs the available security modules and produces a final assessment.
Quick Audit
If quick-audit functionality is enabled in the current version:
sudo ./linuxsentinel.sh --quick
Quick mode is intended for faster security checks.
Full Mode
The full audit can also be explicitly requested:
sudo ./linuxsentinel.sh --full
Help
Display available commands:
./linuxsentinel.sh --help
Version
Display the LinuxSentinel version:
./linuxsentinel.sh --version
🔍 Running Individual Modules
Each module can also be executed independently.
For example:
sudo ./modules/system_audit.sh
sudo ./modules/user_audit.sh
sudo ./modules/file_audit.sh
sudo ./modules/privilege_audit.sh
sudo ./modules/network_audit.sh
sudo ./modules/firewall_audit.sh
sudo ./modules/service_audit.sh
sudo ./modules/ssh_audit.sh
sudo ./modules/persistence_audit.sh
sudo ./modules/log_audit.sh
sudo ./modules/score.sh
Running the main controller is recommended because it provides a complete and consistent audit workflow.
📄 Reports
LinuxSentinel generates timestamped security reports.
Reports are stored inside:
reports/
Example:
reports/
└── audit_<timestamp>.txt
Reports allow users to review audit results after the scan has completed.
📝 Logs
Execution logs are stored inside:
logs/
Example:
logs/
└── audit_<timestamp>.log
Logs can be used for:
Audit history
Troubleshooting
Security review
Comparing assessments
Documentation
🔒 Privacy
LinuxSentinel is designed to keep generated machine-specific information separate from the source code.
Audit reports and logs may contain sensitive system information such as:
IP addresses
Usernames
Hostnames
Running services
Network interfaces
Security configuration
For this reason, generated reports and logs should not be publicly uploaded unless they have been reviewed and sanitized.
The repository should use .gitignore to prevent accidental publication of local audit data.
🛡️ Non-Destructive Design
LinuxSentinel follows a detection and reporting approach.
It does not automatically:
Delete users
Change passwords
Disable services
Modify firewall rules
Modify SSH configuration
Delete cron jobs
Delete systemd timers
Remove SUID files
Remove SGID files
Modify system security settings
The tool reports findings so that the system administrator can decide what action is appropriate.
⚠️ Security Considerations
Some Linux security findings require manual investigation.
For example:
SUID Files
A SUID executable may be completely legitimate.
SGID Files
An SGID executable may be required by a system application.
Open Ports
A listening port does not automatically indicate a vulnerability.
Running Services
A running service may be expected depending on the system's purpose.
Scheduled Tasks
Cron jobs and systemd timers can be legitimate system maintenance tasks.
LinuxSentinel therefore focuses on visibility and assessment rather than automatically declaring every finding malicious.
📊 Risk Levels
LinuxSentinel categorizes findings using severity levels.
Severity Description
Critical Severe security condition requiring immediate investigation
High Significant security concern
Medium Security weakness requiring attention
Low Lower-risk security observation
Info Informational finding
The final risk level is based on the findings detected during the audit.
🛠️ Technologies Used
LinuxSentinel is intentionally built with lightweight Linux-native technologies.
Core
Bash
Linux
Git
System Utilities
awk
grep
sed
find
sort
uniq
cut
wc
df
free
uname
Networking
ip
ss
Services & Logs
systemctl
journalctl
Security Components
SSH
Cron
Systemd
UFW
nftables
iptables
🎯 Project Goals
LinuxSentinel was created to provide practical experience with:
Linux security
Bash scripting
Linux administration
Security auditing
Defensive cybersecurity
User privilege analysis
File permission analysis
Network security
Firewall analysis
SSH hardening concepts
Persistence detection
Security log analysis
Security automation
Command-line security tooling
🧠 Learning Outcomes
Working with LinuxSentinel provides practical experience in:
Linux
Linux filesystem
Linux users and groups
File permissions
Privileges
Services
Processes
Networking
System logs
Cybersecurity
Security auditing
Attack surface identification
Privilege analysis
Persistence analysis
Network exposure
Authentication security
Defensive monitoring
Bash
Variables
Functions
Conditions
Loops
Command substitution
Exit codes
Text processing
Modular scripting
Automation
🔮 Future Improvements
Potential future versions may introduce:
JSON report generation
HTML reports
PDF reports
Security baseline comparison
Historical security scores
Configuration recommendations
File integrity monitoring
Hash-based integrity verification
CVE integration
Additional Linux distributions
More advanced SSH analysis
Automated scheduled audits
Email notifications
Centralized logging
Web-based dashboard
Extended security checks
📈 Possible Future Architecture
Future versions could extend LinuxSentinel into a larger defensive security platform:
LinuxSentinel
│
┌──────────────┼──────────────┐
│ │ │
▼ ▼ ▼
Auditing Monitoring Reporting
│ │ │
▼ ▼ ▼
Security Integrity HTML/PDF
Modules Monitoring Reports
│ │ │
└──────────────┼──────────────┘
│
▼
Security Dashboard
🧪 Recommended Testing Environment
LinuxSentinel should preferably be tested in:
Personal Linux systems
Virtual machines
Cybersecurity laboratories
Authorized testing environments
Testing on production systems should be performed carefully because security auditing commands can inspect sensitive system information.
⚖️ Disclaimer
LinuxSentinel is intended for:
Authorized security auditing
Cybersecurity education
Defensive security research
Linux administration
Personal laboratory environments
Systems owned or explicitly authorized for testing
Do not use LinuxSentinel to inspect systems without authorization.
The author is not responsible for misuse of this project.
👨💻 Author
Mustafa Mehmood Javed
Cybersecurity Student
Interests include:
Cybersecurity
Linux Security
Defensive Security
Security Auditing
Bash Scripting
Network Security
System Security
GitHub:
https://github.com/mustafajaved304
📜 License
LinuxSentinel is released under the MIT License.
See the LICENSE file for details.
/etc/cron.d
/etc/cron.hourly