Linux Security Scanner
Script
scripts/security-audit.sh — the single entry point for all checks.
The script is self-contained, portable, and works on any modern Linux system. It auto-detects available tools (ss/netstat, ufw/iptables/nftables, journalctl) and gracefully skips unavailable ones.
Quick Start
Run a full audit:
bash scripts/security-audit.sh --all
Or with no arguments (same as --all):
bash scripts/security-audit.sh
Individual Checks
Run any single check by name:
| Command | What it checks |
|---|---|
--ssh | PermitRootLogin, PasswordAuthentication, Port, Protocol in sshd_config |
--ports | Listening TCP ports (ss or netstat) |
--firewall | ufw status, iptables filter rules, nftables ruleset |
--failed-logins | lastb output and journalctl SSH auth failures (last 24h) |
--sudoers | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants |
--world-writable | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) |
--suid | All SUID binaries, risk assessment, unusual path detection |
Example:
bash scripts/security-audit.sh --ssh --failed-logins
Full Audit Workflow
- Run
bash scripts/security-audit.sh --all - The script outputs a colorized report to stdout
- A structured markdown report is stored in the
$REPORTvariable (accessible within the same shell session) - For programmatic use, redirect output to a file
Common Findings & Recommendations
- SSH hardening: Disable root login, disable password auth, use key-only auth, change default port
- Firewall: Ensure only necessary ports are open; prefer deny-by-default
- Sudoers: Avoid NOPASSWD where possible; keep permissions at 440; audit who has full sudo access
- SUID: Review unusual SUID paths; minimize SUID binaries; check for known CVEs on common ones (pkexec, sudo, etc.)
- World-writable files: These are security risks — investigate why they're writable and restrict permissions
Notes
- Requires root/sudo for some checks (failed-logins reads /var/log/btmp, ss shows process info)
- Runs entirely in the shell — no external dependencies beyond standard Linux tools
- Respects permission boundaries — non-accessible checks are noted, not forced