Linux Security Audit Tool

A comprehensive CLI tool for auditing Linux system security posture.

For all the checks to effectively be done this tool it needs root access.

Install

pip install linux-security-audit-tool

Usage

sudo env "PATH=$PATH" security-audit --help
sudo env "PATH=$PATH" security-audit audit
sudo env "PATH=$PATH" security-audit audit -p 0 -1 # Run specific phases
sudo env "PATH=$PATH" security-audit audit -o report.md # Save markdown report
sudo env "PATH=$PATH" security-audit audit --quiet # Summary only
sudo env "PATH=$PATH" security-audit audit --debug # Show executed commands
sudo env "PATH=$PATH" security-audit audit --remediate-all # Generate remediation script for all findings
sudo env "PATH=$PATH" security-audit audit --remediate-only-critical # Generate remediation script for CRITICAL only
sudo env "PATH=$PATH" security-audit audit --remediate-non-critical # Generate remediation script for non-CRITICAL
sudo env "PATH=$PATH" security-audit audit --pdf report.pdf # Generate PDF report

CLI

security-audit [OPTIONS] COMMAND [ARGS]...
Options:
--version Show the version and exit.
--help Show this message and exit.
Commands:
audit Run a full security audit.
version Show version information.

Audit Command Options

• --output, -o FILE - Output file for markdown report
• --phases, -p [0-9] - Specific phases to run (can be repeated)
• --quiet, -q - Suppress detailed output
• --verbose, -v - Show descriptions and remediation
• --debug, -d - Show low-level commands being executed
• --remediate-all, -r - Generate remediation script for all findings
• --remediate-only-critical - Generate remediation script for CRITICAL findings only
• --remediate-non-critical - Generate remediation script for non-CRITICAL findings
• --remediate-script FILE - Save remediation script to file
• --pdf FILE - Generate PDF executive report
• --cache - Enable caching of check results
• --cache-ttl INTEGER - Cache TTL in seconds (default: 3600)

API

fromsecurity_auditimportgather_context, run_identity_checks, calculate_security_scorefromsecurity_audit.coreimportFinding, Severity# Run a full auditcontext=gather_context()
findings=run_identity_checks()
score=calculate_security_score(findings)

Audit Phases

The tool performs security checks across 9 phases:

• Phase 0: Context Gathering (hostname, OS, kernel)
• Phase 1: Identity & Access Control (users, sudo, SSH)
• Phase 2: Network Exposure (listening services, firewall, sysctl)
• Phase 3: File System & Permissions (SUID, world-writable, cron)
• Phase 4: Process & Service Posture (services, AppArmor, SELinux, rkhunter)
• Phase 5: Kernel & OS Hardening (sysctl, ASLR, module blacklist)
• Phase 6: Logging & Monitoring (auditd, logs, syslog)
• Phase 7: Package & Update Hygiene (updates, repos)
• Phase 8: Cryptographic Posture (SSH keys, TLS, password hashing)

Development

git clone https://github.com/daedalus/linux-security-audit-tool.git
cd linux-security-audit-tool
pip install -e ".[test]"# run tests
pytest
# format
ruff format src/ tests/
# format markdown
mdformat .# lint + type check (prospector runs ruff check + mypy + pylint together)
prospector --with-tool ruff --with-tool mypy --with-tool pylint src/
opengrep --config=auto --severity=ERROR src/
# find unused code (vulture reports dead code with 90%+ confidence)
vulture --min-confidence 90 src/
# analyze code complexity (lizard reports cyclomatic complexity, NLOC, etc.)
lizard src/ --CCN 10
# track API impact (impactguard analyzes how staged changes affect public API)
impactguard-check-staged